From owner-freebsd-current Mon Apr 22 23:25: 5 2002 Delivered-To: freebsd-current@freebsd.org Received: from rwcrmhc52.attbi.com (rwcrmhc52.attbi.com [216.148.227.88]) by hub.freebsd.org (Postfix) with ESMTP id 06DCC37B438 for ; Mon, 22 Apr 2002 23:24:19 -0700 (PDT) Received: from blossom.cjclark.org ([12.234.91.48]) by rwcrmhc52.attbi.com (InterMail vM.4.01.03.27 201-229-121-127-20010626) with ESMTP id <20020423062419.VQSY1901.rwcrmhc52.attbi.com@blossom.cjclark.org>; Tue, 23 Apr 2002 06:24:19 +0000 Received: (from cjc@localhost) by blossom.cjclark.org (8.11.6/8.11.6) id g3N6OFS85102; Mon, 22 Apr 2002 23:24:15 -0700 (PDT) (envelope-from cjc) Date: Mon, 22 Apr 2002 23:24:15 -0700 From: "Crist J. Clark" To: Doug White Cc: Lyndon Nerenberg , freebsd-current@FreeBSD.ORG Subject: Re: Adding a 'bpf' group for /dev/bpf* Message-ID: <20020422232415.C84809@blossom.cjclark.org> References: <200204202139.g3KLdEJ80591@orthanc.ab.ca> <20020422111600.G5217-100000@resnet.uoregon.edu> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.2.5i In-Reply-To: <20020422111600.G5217-100000@resnet.uoregon.edu>; from dwhite@resnet.uoregon.edu on Mon, Apr 22, 2002 at 11:16:58AM -0700 X-URL: http://people.freebsd.org/~cjc/ Sender: owner-freebsd-current@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG On Mon, Apr 22, 2002 at 11:16:58AM -0700, Doug White wrote: > On Sat, 20 Apr 2002, Lyndon Nerenberg wrote: > > > For the benefit of packet sniffers and other things that only want > > read-only access to /dev/bpf*, what do people think of adding a 'bpf' > > group for those programs? This allows bpf devices to be read by > > programs running with an effective gid of 'bpf' instead of the current > > requirement for an effective user of root. I've been running this way > > on many of our servers for several months now, and things like snort, > > tcpdump, etc., are quite happy with it (under stable). > > There's the other small problem that you have to be root to set > promiscuous mode. Nope. Just read access to bpf(4). -- Crist J. Clark | cjclark@alum.mit.edu | cjclark@jhu.edu http://people.freebsd.org/~cjc/ | cjc@freebsd.org To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-current" in the body of the message