diff options
Diffstat (limited to 'packaging/macosx/ChmodBPF/root')
| -rwxr-xr-x | packaging/macosx/ChmodBPF/root/Library/Application Support/Wireshark/ChmodBPF/ChmodBPF | 41 | ||||
| -rw-r--r-- | packaging/macosx/ChmodBPF/root/Library/LaunchDaemons/org.wireshark.ChmodBPF.plist | 14 |
2 files changed, 55 insertions, 0 deletions
diff --git a/packaging/macosx/ChmodBPF/root/Library/Application Support/Wireshark/ChmodBPF/ChmodBPF b/packaging/macosx/ChmodBPF/root/Library/Application Support/Wireshark/ChmodBPF/ChmodBPF new file mode 100755 index 00000000..1dc12e7a --- /dev/null +++ b/packaging/macosx/ChmodBPF/root/Library/Application Support/Wireshark/ChmodBPF/ChmodBPF @@ -0,0 +1,41 @@ +#! /bin/zsh +# shellcheck shell=bash + +# +# Unfortunately, macOS's devfs is based on the old FreeBSD +# one, not the current one, so there's no way to configure it +# to create BPF devices with particular owners or groups. BPF +# devices on macOS are also non-cloning, that is they can +# be created on demand at any time. This startup item will +# pre-create a number of BPF devices, then make them owned by +# the access_bpf group, with permissions rw-rw----, so that +# anybody in the access_bpf group can use programs that capture +# or send raw packets. +# +# Change this as appropriate for your site, e.g. to make +# it owned by a particular user without changing the permissions, +# so only that user and the super-user can capture or send raw +# packets, or give it the permissions rw-r-----, so that +# only the super-user can send raw packets but anybody in the +# admin group can capture packets. +# + +# Pre-create BPF devices. Set to 0 to disable. +FORCE_CREATE_BPF_MAX=256 + +SYSCTL_MAX=$( sysctl -n debug.bpf_maxdevices ) +if [ "$FORCE_CREATE_BPF_MAX" -gt "$SYSCTL_MAX" ] ; then + FORCE_CREATE_BPF_MAX=$SYSCTL_MAX +fi + +syslog -s -l notice "ChmodBPF: Forcing creation and setting permissions for /dev/bpf0-$(( FORCE_CREATE_BPF_MAX - 1))" + +CUR_DEV=0 +while [ "$CUR_DEV" -lt "$FORCE_CREATE_BPF_MAX" ] ; do + # Try to do the minimum necessary to trigger the next device. + read -r -n 0 < /dev/bpf$CUR_DEV > /dev/null 2>&1 + CUR_DEV=$(( CUR_DEV + 1 )) +done + +chgrp access_bpf /dev/bpf* +chmod g+rw /dev/bpf* diff --git a/packaging/macosx/ChmodBPF/root/Library/LaunchDaemons/org.wireshark.ChmodBPF.plist b/packaging/macosx/ChmodBPF/root/Library/LaunchDaemons/org.wireshark.ChmodBPF.plist new file mode 100644 index 00000000..1b3317e3 --- /dev/null +++ b/packaging/macosx/ChmodBPF/root/Library/LaunchDaemons/org.wireshark.ChmodBPF.plist @@ -0,0 +1,14 @@ +<?xml version="1.0" encoding="UTF-8"?> +<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> +<plist version="1.0"> +<dict> + <key>Label</key> + <string>org.wireshark.ChmodBPF</string> + <key>RunAtLoad</key> + <true/> + <key>Program</key> + <string>/Library/Application Support/Wireshark/ChmodBPF/ChmodBPF</string> + <key>AssociatedBundleIdentifiers</key> + <string>org.wireshark.Wireshark</string> +</dict> +</plist> |