0

Many tools in Linux allow for checking things as a non-root user. For example, at any time, I can check whether a service is running:

$ systemctl status ntp

However, the iptables needs to be used as root whatever the option. I'm wondering what issue there could be to allow -L to a non-root user:

$ iptables -L -nvx

still tells me that I need to be root.

Wouldn't a good hacker be able to figure out the firewall anyway and thus blocking the -L option is just obfuscation which as we know is not security?

1
1

It isn't available because nobody has gone through the extra effort to make it available.

iptables works by opening a connection to the part of the system that's responsible for managing the firewall, which is inside the kernel. (See https://unix.stackexchange.com/questions/385109/can-you-list-iptables-as-a-non-root-user-and-why for more details.) This subsystem has a very simple authorization model: root can connect, and others can't connect. (More precisely, to connect, you need the right capabilities, but that doesn't matter here.) There is no further authorization based on the commands (listing or modification).

It is possible to have confidential information in the firewall settings, for example a port knocking sequence. Enabling that wasn't a primary design goal of Linux's firewall mechanism, but it happens to be supported.

3
  • Well to simplify the answer, if not root then anyone, and you don't want anyone to be able to see the full config of your iptables.
    – nethero
    Jun 25 at 14:16
  • @nethero That's not really the point. The point is that if not root then anyone, and this also applies to changing the firewall rules. You definitely don't want every local user to be able to change firewall rules! Jun 25 at 15:05
  • You are right about IP tables having very outdated access model, but the botom line is it is either root (sudoer, sesudo or other selinux) or everyone really. A lot of the tools have a very similar model.
    – nethero
    Jun 28 at 7:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.