Hacktoberfest 2026：メンテナが10月に向けて印を付けた、オープンで初心者向けの issue。 Hacktoberfest の issue を見る

[Bug] NMAPDEV (nmap) runs unprivileged under UID 20211 ('You are not root -- using TCP pingscan rather than ICMP'), breaking ARP/ICMP discovery and MAC detection

オープン
  • 何か問題がありますか？
#1,852 コメント 1 件 リアクション 0 件 担当者 0 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

まだ誰も着手していません。

評価

難易度
3/5
見積もり時間
半日
初心者へのやさしさ
57/100
issue の種類
バグ
明瞭さ
明確に書かれている
活発さ
活発
技術スタック
docker, linux, python
領域
backend, networking

調査の方向性

Start by reading the NMAPDEV configuration at server/plugins/nmap_dev_scan/config.json and the container Dockerfile; the report identifies both as possible places to address the privilege detection behavior. Reproduce the default scan under UID 20211 with the listed capabilities and compare its output with a scan using --privileged. Done means the configured scan uses raw ARP and ICMP probes and returns real MAC addresses for local hosts.

索引モデルが issue の本文から書いたものです。

説明

bug 🐛 next release/in dev image 🚀 Waiting for reply⏳
What installation are you running?

Production (netalertx) 📦

Is there an existing issue for this?
The issue occurs in the following browsers. Select at least 2.
  • Firefox
  • Chrome
  • Edge
  • Safari (unsupported) - PRs welcome
  • N/A - This is an issue with the backend
Current Behavior

Since the container runs as the non-root user netalertx (UID 20211) with Linux capabilities (CAP_NET_RAW, CAP_NET_ADMIN) and /usr/bin/sudo is a pass-through wrapper (#!/bin/sh / "$@"), running NMAPDEV with its default arguments (sudo nmap -sn -PR -oX - ) causes nmap to check geteuid() == 0, assume it is unprivileged, and print:

Warning:  You are not root -- using TCP pingscan rather than ICMP

As a result:

  1. On local subnets: nmap does not perform raw ARP discovery (-PR is ignored) and does not return MAC addresses in the XML output (mac == ''). Consequently, nmap_dev.py either skips all local hosts (IP or MAC missing) or, if NMAPDEV_FAKE_MAC=True is enabled, generates duplicate fa:ce:... fake MACs for local devices that actually have real MAC addresses.
  2. On routed/remote subnets: nmap cannot send raw ICMP echo probes and falls back to unprivileged TCP connect() on ports 80 and 443 only, missing all hosts (smartphones, tablets, IoT appliances, printers) that do not have port 80/443 open and only reply to ICMP ping.
Expected Behavior

nmap should utilize the container's CAP_NET_RAW / CAP_NET_ADMIN capabilities when running under UID 20211 so that raw ARP (-PR) and ICMP echo (-PE) scans work as intended and local MAC addresses are properly retrieved.

Suggested Fix:
nmap natively supports running with Linux capabilities under non-root UIDs when either:

  1. ENV NMAP_PRIVILEGED=1 is set in the container environment (Dockerfile), or
  2. --privileged is added to the default NMAPDEV_ARGS in server/plugins/nmap_dev_scan/config.json (e.g. sudo nmap --privileged -sn -PR -oX - ).
Steps To Reproduce
  1. Run NetAlertX with the recommended hardened docker-compose.yml (UID 20211, cap_add: NET_RAW, NET_ADMIN).
  2. Enable NMAPDEV with default NMAPDEV_ARGS='sudo nmap -sn -PR -oX - '.
  3. Observe Warning: You are not root -- using TCP pingscan rather than ICMP in stderr and missing MAC addresses / missed ICMP-only hosts in nmap_dev.py output.
  4. Set NMAPDEV_ARGS='sudo nmap --privileged -sn -PR -oX - ' (or NMAP_PRIVILEGED=1) -> nmap immediately uses raw sockets, returns arp-response with real MAC addresses on local subnets, and echo-reply on routed subnets.
Relevant app.conf settings
LOADED_PLUGINS=['ARPSCAN', 'NMAPDEV', ...]
NMAPDEV_RUN='schedule'
NMAPDEV_FAKE_MAC=True
# Default (broken under UID 20211):
NMAPDEV_ARGS='sudo nmap -sn -PR -oX - '
# Working workaround:
NMAPDEV_ARGS='nmap --privileged -sn -PE -oX - '
docker-compose.yml
services:
  netalertx:
    image: ghcr.io/netalertx/netalertx:26.10.0
    network_mode: host
    cap_drop:
      - ALL
    cap_add:
      - NET_ADMIN
      - NET_RAW
      - NET_BIND_SERVICE
Debug or Trace enabled
  • I have read and followed the steps in the wiki link above and provided the required debug logs and the log section covers the time when the issue occurs.
Relevant app.log section
[NMAPDEV] Executing: sudo nmap -sn -PR -oX - 192.168.101.0/24
Warning:  You are not root -- using TCP pingscan rather than ICMP
[NMAPDEV] Found 2 devices
Docker Logs
[NMAPDEV] Executing: sudo nmap -sn -PR -oX - 192.168.101.0/24
Warning:  You are not root -- using TCP pingscan rather than ICMP
主要言語
Python
スター
7.2k
フォーク
456
平均マージ
16時間 25分
マージ済み PR（30日）
30

環境構築

Codespaces で開く

このプロジェクトの開発コンテナを、あなたの GitHub アカウントでブラウザ上に起動します。

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

netalertx/NetAlertX のほかの issue

netalertx/NetAlertX の issue をすべて見る

似ている issue

Python の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。