tcpdump should open file, where captured packets are going to be writ…

[Sashan]

…ten to,

before it switches to user nobody.

patch has been submitted to upstream:
#637

[mcr]

The problem with this is that tcpdump opens files again with -C switches, and so really mechanisms were tcpdump has any privilege are broken. Your patch is welcome, but we need to decide how to do privilege separation correctly: tcpdump has perhaps three or four levels of trust.

[Sashan]

The problem with this is that tcpdump opens files again with -C switches, and so really mechanisms were tcpdump has any privilege are broken. Your patch is welcome, but we need to decide how to do privilege separation correctly: tcpdump has perhaps three or four levels of trust.

I see. To be honest I have not looked at that deeply enough. I've just crafted the patch, which addresses the most common scenario for Solaris, which is mentioned in #637. I'll try to re-work my patch.