Subject: Re: [vserver] Operation not permitted
From: Herbert Poetzl <herbert@13thfloor.at>
Date: Tue, 30 Oct 2007 16:05:07 +0100

On Tue, Oct 30, 2007 at 02:20:13PM +0100, Albert Czarnecki wrote:
> Hi
> 
> I trying used tcpdump or traceroute in virtual machine and I have messages
> 
> traceroute 102.100.102.48
> traceroute: raw socket: Operation not permitted
> tcpdump -i eth0 -n port 443
> tcpdump: socket: Operation not permitted
> 
> What I must changed to have a run traceroute / tcpdump?

you need CAP_NET_RAW, note that giving that capability
is very insecure in such way that the guest can sniff
on all packets and can inject forged packets with that
capability set

replacing traceroute with tracepath and using tcpdump
on the host is usually the better choice ...

HTC,
Herbert

> Albert Cz