NFD

It's my third time running into this issue so I did it.
https://gerrit.named-data.net/c/NFD/+/6329

After this change, Ethernet face works with either NFD started as root, or NFD started as non-root with capabilities.

Start NFD binary as root¶

Setup steps:

sudo groupadd --system ndn
sudo useradd --system --gid ndn --create-home --home-dir /var/lib/ndn --shell /usr/sbin/nologin ndn

cd /usr/local/etc/ndn
sudo cp nfd.conf.sample nfd.conf
sudo infoedit -f nfd.conf -s general.user -v ndn
sudo infoedit -f nfd.conf -s general.group -v ndn

sudo HOME=/var/lib/ndn -u ndn ndnsec key-gen /operator
sudo HOME=/var/lib/ndn nfd

NFD console log:

1611758413.846030  INFO: [nfd.PrivilegeHelper] elevated to effective uid=0 gid=0
1611758413.887127  INFO: [nfd.PrivilegeHelper] dropped to effective uid=998 gid=998
1611758413.890453  INFO: [nfd.FaceTable] Added face id=256 remote=ether://[01:00:5e:00:17:aa] local=dev://eth0

Face list:

$ nfdc face list scheme ether
faceid=256 remote=ether://[01:00:5e:00:17:aa] local=dev://eth0 congestion={base-marking-interval=100ms default-threshold=65536B} mtu=1500 counters={in={0i 0d 0n 0B} out={0i 0d 0n 0B}} flags={non-local permanent multi-access}

Start NFD binary as non-root¶

Setup steps:

sudo groupadd --system ndn
sudo useradd --system --gid ndn --create-home --home-dir /var/lib/ndn --shell /usr/sbin/nologin ndn

cd /usr/local/etc/ndn
sudo cp nfd.conf.sample nfd.conf
sudo infoedit -f nfd.conf -s face_system.unix.path -v /tmp/nfd.sock

sudo setcap cap_net_raw=eip /usr/local/bin/nfd
sudo HOME=/var/lib/ndn -u ndn ndnsec key-gen /operator
sudo HOME=/var/lib/ndn -u ndn nfd

NFD console log:

1611758639.241697  INFO: [nfd.FaceTable] Added face id=256 remote=ether://[01:00:5e:00:17:aa] local=dev://eth0

Face list:

$ NDN_CLIENT_TRANSPORT=unix:///tmp/nfd.sock nfdc face list scheme ether
faceid=256 remote=ether://[01:00:5e:00:17:aa] local=dev://eth0 congestion={base-marking-interval=100ms default-threshold=65536B} mtu=1500 counters={in={0i 0d 0n 0B} out={0i 0d 0n 0B}} flags={non-local permanent multi-access}