NetFilter
[Top] [All Lists]

ipset: how to run non-root

To: netfilter@lists.netfilter.org
Subject: ipset: how to run non-root
From: Mike Wright <xktnniuymlla@mailinator.com>
Date: Sat, 18 Nov 2006 14:49:13 -0800
Delivered-to: sp-com-lists@consult.net
Delivered-to: netfilter-list1@securepoint.com
List-archive: </pipermail/netfilter>
List-help: <mailto:netfilter-request@lists.netfilter.org?subject=help>
List-id: General discussion and user questions <netfilter.lists.netfilter.org>
List-post: <mailto:netfilter@lists.netfilter.org>
List-subscribe: <https://lists.netfilter.org/mailman/listinfo/netfilter>, <mailto:netfilter-request@lists.netfilter.org?subject=subscribe>
List-unsubscribe: <https://lists.netfilter.org/mailman/listinfo/netfilter>, <mailto:netfilter-request@lists.netfilter.org?subject=unsubscribe>
Sender: netfilter-bounces@lists.netfilter.org
User-agent: Mozilla Thunderbird 1.0.2-6 (X11/20050513)
Hi all,

I'm trying to use ipset from a php script on an apache server.

ipset requires root user in order to execute, but the webserver is running as apache. suexec is not a possibility because it won't execute programs with root permissions. It is possible to have a cron job perform the task but that introduces a time delay.

I've tried changing ownership of ipset to apache:apache but that didn't work. Still received the "must be root" warning.

I looked into the source of ipset.c but it seems like the socket() call must be done as root, and I don't know how to hack around that.

Does anybody know how I might accomplish this?

Thanks,
Mike Wright


<Prev in Thread] Current Thread [Next in Thread>