Running applications with operators requiring Linux capabilities

The following operators require special privileges (Linux capabilities) to interact with raw network packets and kernel drivers:

There are different steps to enable Linux capabilities for Streams applications based on how they are run.

Distributed

For distributed Streams applications, the Streams runtime must grant capabilities to the program before executing it. This requires 'root' privileges. To do this:
  1. The Streams domain must be registered as a Linux system service
  2. The Streams instance must have the property instance.canSetPeOSCapabilities set to 'true'
  3. The Streams instance must have the property instance.runAsUser set to the desired username (generally $USER)
  4. The Streams instance must have the property instance.applicationBundlesPath set to a directory under /tmp

The Streams runtime will automatically identify which capabilities are needed for the application when launching the PE.

Standalone

For standalone Streams applications, Linux capabilities can be granted to programs if the Linux kernel and file system where the application is located support extended file attributes.

To grant Linux capabilities to the application:
  1. Root privileges are required
  2. The SAB must be unpacked with the spl-app-info command into a directory on an extended file attribute-supported file system (e.g., on a local disk volume such as /tmp)
  3. Use setcap as root or with sudo to grant the necessary capabilities. For example, sudo setcap 'CAP_NET_RAW+eip CAP_NET_ADMIN+eip' .../bin/standalone.exe

The set of capabilities depends on what operators are used. See the Properties section of the individual operators for the full list of required capabilities.

On systems that do not support extended file attributes, standalone applications can be run as root

sudo STREAMS_INSTALL=$STREAMS_INSTALL .../bin/standalone.exe