Netinstall on Linux without root!

Netinstall was reported to run on Linux when started as user root. I’ve never tried - I think starting wine, which is required, as root is a bad idea.

With a detailed look the problem seems simple: Netinstall needs to bind to a privileged port, that is port 69 for tftp. All it needs is a special capability CAP_NET_BIND_SERVICE. Usually you can set this capability on the executable file with setcap, at execution time the kernel grants the extra permission.
Sadly this does not work with netinstall. The netinstall file is a MS Windows executable, acting as payload for wine only. The wine executable is the real one that matters. (Setting the capability for wine would work, but I do not want all my MS Windows executables to be started with that privilege.)

So I decided to write a wrapper.
This wrapper has the capability set. When it executes it sets the capability to be inheritable, makes it ambient to actually do inherit, does some wine setup and finally executes wine with the netinstall executable - including the capability. Job done, netinstall works as unprivileged user!

You need to get the netinstall wrapper source code, then build it with a compiler of choice, install to /usr/bin/netinstall, set the capability and place the real netinstall executable at /usr/share/netinstall/netinstall.exe.

These commands should do the trick if all dependencies are installed, the install and setcap steps need root privileges:

wget 'https://aur.archlinux.org/cgit/aur.git/plain/netinstall.c?h=netinstall'
gcc -o netinstall netinstall.c -lcap
install -s netinstall /usr/bin/netinstall
setcap CAP_NET_BIND_SERVICE+ep /usr/bin/netinstall

Finally netinstall.exe needs to be placed.

If you are running Arch Linux I’ve prepared everything for you: Just install netinstall from AUR.

Any feedback is welcome, please report your findings.
Have fun!

I can confirm that netinstall starts fine on Debian buster … I didn’t try to actually netinstall any device, but netinstall.exe (I tried 6.46.5 which happened to be laying around) does start while previously it complained with error message “bind bootp failed: (10013)”.

I’ve changed (hard coded) path to netinstall.exe executable … /usr/share is not a good place for stuff locally installed. You may want to make this setting a bit more configurable. Either as complile-time define or run-time (either through command line parameter or environment variable). I’m aware this may prove a security breach though.

Glad it works for you. Can’t be that wrong then.

For me it is not locally/manually installed as I built an Arch Linux package for it. :winking_face_with_tongue:
But I get your point. I think I will polish this a bit and push it to github…

The path will be configurable at compile-time only, as granting privileges for a runtime defined path is a security issue.