Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 1109616

Summary: run Wireshark GUI as user (not root), allow packet capturing if user is member of group wireshark (setcap install)
Product: Red Hat Enterprise Linux 6 Reporter: Evgueni Souleimanov <esoule>
Component: wiresharkAssignee: Peter Hatina <phatina>
Status: CLOSED WONTFIX QA Contact: BaseOS QE Security Team <qe-baseos-security>
Severity: low Docs Contact:
Priority: unspecified    
Version: 6.5CC: tsmetana
Target Milestone: rcKeywords: FutureFeature
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Enhancement
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2015-02-26 08:56:13 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
wireshark.spec for building Wireshark with setcap (capture as non-root)
none
Difference between wireshark.spec from wireshark-1.8.10-7.el6_5 and proposed wireshark.spec none

Description Evgueni Souleimanov 2014-06-16 00:56:53 UTC
Created attachment 908966 [details]
wireshark.spec for building Wireshark with setcap (capture as non-root)

Description of problem:

Wireshark prompts for root password when run from the menu. If "unprivileged" button is clicked, it is not possible to capture packets.

Version-Release number of selected component (if applicable):

wireshark-1.8.10-7.el6_5

How reproducible:

Always reproducible with the steps below on EL 6.

Steps to Reproduce:

1. Click on the K-Menu, point to Applications, click Internet, click Wireshark Network Analyzer.

Actual results:

Root password prompt is shown, where the user may click "unprivileged" button if the user just wants to open pcap trace files. User must go through this dialog every time he uses the Wireshark GUI.

If the user provides the root password, the GUI (with all protocol dissectors) runs as root, and the user is asked to save files to root's home directory, and trace files are saved with the owner root.

Expected results:

No root password prompt is shown, just application window.

If the user is member of group wireshark, the user may choose an interface and start capturing. When the user is prompted to save the capture, it goes to the home directory of the user, and trace files saved with the user as owner.

If the user is not member of group wireshark, a message is shown to the user that the user may not capture. The user may only view stored pcap trace files using File / Open.

Additional info:

Attached wireshark.spec does what I described in "Expected results". I took relevant lines from fc19.

Comment 1 Evgueni Souleimanov 2014-06-16 01:00:40 UTC
Created attachment 908967 [details]
Difference between wireshark.spec from wireshark-1.8.10-7.el6_5 and proposed wireshark.spec

Comment 3 Peter Hatina 2015-02-26 08:48:47 UTC
Thank you for your request.  We decided not to go away from consolehelper, we don't want to break anything.  If you really want to use wireshark without consolehelper (set_cap, etc), please, use RHEL-7.

Comment 4 RHEL Program Management 2015-02-26 08:56:13 UTC
Development Management has reviewed and declined this request.
You may appeal this decision by reopening this request.