Run step with elevated priviledges

Help
1

I have am making an application that requires CAP_NET_RAW. I would like to include a convenience run step so I can change my current workflow:

zig build
sudo zig-out/bin/gatorcat --log-level err dc --ifname enx00e04c68006a --recv-timeout-us 50000 --config-file eni.zon

to this:

zig build run --log-level err dc --ifname enx00e04c68006a --recv-timeout-us 50000 --config-file eni.zon

Is this possible? I think this is not generally possible since I would have to run the zig compiler with sudo… but maybe somebody knows something about capabilities that I don’t know.

2

You can run the run step with sudo without having to run the compiler with sudo:

Replace something like const run_cmd = b.addRunArtifact(exe); with:

const opt_executor = b.option([]const u8, "executor", "executor");

const run_cmd = if (opt_executor) |executor| blk: {
    const executor_run = b.addSystemCommand(&.{executor});
    executor_run.addArtifactArg2(exe, .{});
    break :blk executor_run;
} else b.addRunArtifact(exe);

Then you can use the -Dexecutor=sudo option to execute your executable, but not the compiler with sudo.

You can also just hardcode sudo into an addSystemCommand.

3

You could also have a separate setcap step that sets the required capabilities on the produced binary. This makes it then also easy to use it in other ways like with a debugger.