Change network settings programmatically without root

Question

I want to change network configurations like dhcp, ip address and so on programmatically.

But what I don't want, is to run my application as root. So my question is: What would be a common approach to solve that? Is this even possible?

Is there maybe any group that is allowed to do that without gaining any other rights? Or should I 'chown' the config files to a special group and add the user to that group?

Related to this (If that is off topic, tell me and I will open another question): The target is an embedded device and the application should be the only one that is accessible by the user. Is there any good (best) practice? Should I create a special user for that application. Any hints are appreciated.

Answer 1

You might set capabilities on your program. This would allow it to do certain privileged tasks without the need to run completely as root. The capability in question here is CAP_NET_ADMIN:

CAP_NET_ADMIN
    Perform various network-related operations:
     * interface configuration;
     * administration of IP firewall, masquerading, and accounting;
     * modify routing tables;
     * bind to any address for transparent proxying;
     * set type-of-service (TOS)
     * clear driver statistics;
     * set promiscuous mode;
     * enabling multicasting;
     * use  setsockopt(2)  to set the following socket options: SO_DEBUG, SO_MARK,
       SO_PRIORITY (for a priority outside the range 0 to 6), SO_RCVBUFFORCE,  and
       SO_SNDBUFFORCE.

You'll find more information on capabilities in the capabilities(7) and setcap(8) manpages.

To secure this even more, in case you only need a specific subset of users to be able to run this program, you could put those users into a group, chgrp your program into this group and chmod it to 0750.

Answer 2

If you're using NetworkManager on your computer, you could use NM-CLI.

nmcli is a command-line tool for controlling NetworkManager and getting its status. It is not meant as a replacement of nm-applet or other similar clients. Rather it's a complementary utility to these programs. The main nmcli's usage is on servers, headless machines or just for power users who prefer the command line.

   The use cases comprise:

   --  Initscripts: ifup/ifdown can utilize NetworkManager via nmcli
       instead of having to manage connections itself and possible
       interfere with NetworkManager.

   --  Servers, headless machines: No GUI is available; then nmcli is used
       to talk directly to NetworkManager and control only system-wide
       connections.

   --  User sessions: For this case, nmcli can talk to nm-applet to find
       user connections.  It can still talk directly to NetworkManager for
       manipulating these connections.  As nmcli doesn't have direct
       access to user configuration data in GConf, nm-applet handles that
       itself.  That may, for example, cause the applet to pop up keyring
       dialogs when secrets are needed.

Answer 3

If your target device supports it, the setuid-mechanism might be the way to go

http://en.wikipedia.org/wiki/Setuid

Some programs need root privileges, and what you do with setuid is that the executable file belongs to root and has the setuid-bit set, so when another user executes it, the executable is run with root privileges.

But also note that

Due to potential security issues, many operating systems ignore the setuid attribute when applied to executable shell scripts.