Sample Header Ad - 728x90

Allowing a non-root user to create TUN/TAP interfaces

2 votes
1 answer
2041 views
I have a situation where I need a non-root user to be allowed to create TUN/TAP interfaces. I understand that this requires the CAP_NET_ADMIN capability. There have been other questions about this, but the answers seem to focus on granting the CAP_NET_ADMIN capability to a **file**/**program**, not to the user. In my case, I need the capability to be assigned to the **user**, so they can use whatever tool they see fit to create the interfaces (i.e. not restricted to a specific file/program used to create them). Is this possible in Linux? Specifically, I'm using Ubuntu 22.04. For context, the reason for this is that I'm creating the TUN interface through a custom program that makes the system calls, and I need this to work while debugging it. Since it builds a new binary every time I run the debugger, switching to root and assigning the capability to the binary and then switching back to debug the binary is not feasible.
Asked by Jordan (131 rep)
Apr 24, 2023, 02:21 PM
Last activity: Jul 6, 2025, 06:03 AM