Can you list iptables as a non-root user and why?

Question

public class MainActivity extends AppCompatActivity {

  @Override
  protected void onCreate(Bundle savedInstanceState) {
    super.onCreate(savedInstanceState);
    setContentView(R.layout.activity_main);
  }

  @Override
  public boolean onCreateOptionsMenu(Menu menu) {
    // Inflate the menu; this adds items to the action bar if it is present.
    getMenuInflater().inflate(R.menu.menu_main, menu);
    return true;
  }

  @Override
  public boolean onOptionsItemSelected(MenuItem item) {
    // Handle action bar item clicks here. The action bar will
    // automatically handle clicks on the Home/Up button, so long
    // as you specify a parent activity in AndroidManifest.xml.
    int id = item.getItemId();

    //noinspection SimplifiableIfStatement
    if (id == R.id.action_settings) {
      return true;
    }

    return super.onOptionsItemSelected(item);
  }

  /**
   * Increase the score for Team A by 1 point.
   */
  public void addOneForTeamA(View v) {
    displayForTeamA(1);
  }

  /**
   * Increase the score for Team A by 2 points.
   */
  public void addTwoForTeamA(View v) {
    displayForTeamA(2);
  }

  /**
   * Increase the score for Team A by 3 points.
   */
  public void addThreeForTeamA(View v) {
    displayForTeamA(3);
  }

  /**
   * Displays the given score for Team A.
   */
  public void displayForTeamA(int score) {
    TextView scoreView = (TextView) findViewById(R.id.team_a_score);
    scoreView.setText(String.valueOf(score));
  }
}

these are the two errors that i am getting please help me solve them. these lines of code are actualyy copied fromgithub udacity android for beginer code

Error:(21, 36) error: cannot find symbol variable menu
Error:(33, 23) error: cannot find symbol variable action_settings

Solution 1

It appears iptables needs both CAP_NET_RAW and CAP_NET_ADMIN to be able to read the tables. I tried

$ cp /usr/sbin/iptables ~/iptables  # note, it may be a symbolic link
$ sudo setcap CAP_NET_RAW,CAP_NET_ADMIN+ep  ~/iptables
$ ~/iptables  -nvL

and it was ok.

Solution 2

Indeed, iptables uses the netlink interface to communicate with the kernel. It opens a netlink socket to xtables, then issues commands via this socket. Access control is performed when the socket is opened, not for individual commands, so the same permissions are required for listing and modifying rules. The only way to allow a user to list rules but not modify them is to give them a carefully-written setuid (or setcap) executable.

It would be nice if there was an interface to netfilter in /proc, but as far as I know the task of implementing it has never been completed.

Comments

[W0rmH0le]

Do you have any item in res/menu/menu_main.xml with ID == action_settings?

[krk phr]

nope actually i have done a very similar code before and it worked just fine i dont know why am i geting this now

[W0rmH0le]

This error is happening because there are no views (or menu items) with ID == action_settings. Check res/menu/menu_main.xml and get the proper ID (or share file res/menu/menu_main.xml)

[krk phr]

i ll just reask the question with xml code and the correct code too please see if uou figure out the solution to this app

[krk phr]

thank you all of you for helping.@Guilherme P thank you your advise worked.just deleted those things

[jesse_b]

Do those linked questions really include a workaround though? I see suggestions to just use root and/or to use sudo, but both of those would allow the users to also modify rules no?

[Hakan Baba]

As a workaround they suggest to wrap sudo iptables in a script or call iptables in a cron job by root. I thought of these as workarounds to fall back to the privileged user in a different way.

[jesse_b]

Yea, but your question has me thinking there is a good use case for more granular iptables permissions. The first thing I thought when I read this was low tier support personnel could need the ability to view firewall rules as part of initial troubleshooting on an incident but have no access to modify them. If you gave them sudo permissions you would be giving them way more than just view iptables. Even as one person suggested giving them permission to sudo a script could be problematic but that sounds like the closest thing so far.

[Paulo Neves]

The true answer, for a huge class of problems

[0e1val]

Please note that the original question is for situations without root access: sudo is root access, and setuid bit requires root access too.