On Mon, Aug 14, 2006 at 11:05:15PM +0000, Alexey Toptygin wrote: > On Mon, 14 Aug 2006, Johannes Berg wrote: > > >In my seemingly never-ending quest to actually use the d80211 stack for > >something useful I just wanted to write a small setuid tool that: > >* creates and opens a new monitor interface > >* drops priviledges > >* ... does things with received frames ... (not interesting for this > >discussion) > >* removes new monitor interface > > > >So I figured I'd just keep an fd open to > >/sys/class/net/mymonitorinterface/remove_iface to which I could write the > >interfaces name after I was done with it. However, when writing to that fd > >I got -EACCESS because it checks for CAP_NET_ADMIN. > > Why not have the tool create a monitor interface, open it, and fork; the > child drops privileges and does the reading, and the parent wait(2)s for > the child and removes the interface once it has collected the child?
Kismet achieves this nearly the same way -- It keeps a root process for channel control, and talks over IPC to a nonpriv process. When it's done, it sends the shutdown command to the root process and restores the interface settings (or removes monitor interfaces, etc). If you set up all your interfaces before the fork you can keep the IPC very simple. -m -- Mike Kershaw/Dragorn <[EMAIL PROTECTED]> GPG Fingerprint: 3546 89DF 3C9D ED80 3381 A661 D7B2 8822 738B BDB1
pgpZ01U7AVtk5.pgp
Description: PGP signature
