Skip to content
InfralityDocs
infrality.ioOpen dashboard

Service and privileges

The one privilege

Section titled “The one privilege”

The agent sends ICMP echo requests from a raw socket, and on Linux sends its ARP sweep from a packet socket. Both need CAP_NET_RAW. Nothing else it does needs any privilege.

Without it, the ping sweep cannot run and the ARP sweep falls back to reading the kernel’s neighbour table: hardware addresses and manufacturers still appear, but a host that answers ARP and nothing else is never found.

The service

Section titled “The service”

Both install paths — the script and the .deb / .rpm — run the agent as a dedicated unprivileged account under a systemd sandbox:

/usr/lib/systemd/system/infrality-agent.service
[Service]
ExecStart=/usr/bin/infrality-agent daemon
Restart=on-failure
RestartSec=10


User=infrality-agent
Group=infrality-agent
AmbientCapabilities=CAP_NET_RAW
CapabilityBoundingSet=CAP_NET_RAW
NoNewPrivileges=true


ProtectSystem=strict
ProtectHome=true
PrivateTmp=true
PrivateDevices=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
RestrictNamespaces=true
RestrictSUIDSGID=true
RestrictRealtime=true
LockPersonality=true
MemoryDenyWriteExecute=true
RestrictAddressFamilies=AF_INET AF_INET6 AF_NETLINK AF_PACKET


StateDirectory=infrality-agent
WorkingDirectory=/var/lib/infrality-agent
ReadWritePaths=-/etc/infrality-agent
  • AmbientCapabilities delivers the capability to a non-root process; CapabilityBoundingSet means it can never acquire another one.
  • NoNewPrivileges and ProtectSystem=strict make the rest of the filesystem read-only to it, except its state directory and its configuration folder.
  • RestrictAddressFamilies: IP for the probes and the API, netlink to list the machine’s interfaces, and AF_PACKET for the ARP sweep.

The script’s unit names /usr/local/bin, the packages’ /usr/bin; otherwise they are identical, and the agent’s test suite fails if they drift.

Check what is running:

Terminal window
systemctl show infrality-agent -p User -p AmbientCapabilities

What the install changes on the host

Section titled “What the install changes on the host”
Change Why
A system account infrality-agent No login, no home directory, no shell
/etc/infrality-agent/ — owner the account, mode 0750 Settings chosen on the dashboard are written back to the file there
/etc/infrality-agent/config.yaml — mode 0600 It holds the API key; nobody else may read it
/var/lib/infrality-agent/ Created by systemd for topology.json
The binary, with cap_net_raw+ep So it can also be run by hand without sudo

Everything in the unit beyond that is a per-process restriction applied at start, gone when the service stops.

Running it by hand

Section titled “Running it by hand”

setcap is a file attribute, not a system change, and lets any user run the agent:

Terminal window
sudo setcap cap_net_raw+ep /usr/local/bin/infrality-agent
infrality-agent run

That is the path for containers (grant NET_RAW, use host networking) and for testing.

On macOS, raw sockets need root: sudo infrality-agent daemon. On Windows, run it from an Administrator terminal.

The remaining sharp edge

Section titled “The remaining sharp edge”

CAP_NET_RAW also permits reading and forging packets on the host’s interfaces. It is the smallest capability the kernel offers for what the agent does, but it is not nothing — which is why it is the only one, held by an account that can do nothing else. Moving the ping sweep to unprivileged ICMP sockets, which need no capability at all, is planned.