Why is dhclient saying: "SIOCSIFADDR: Permission denied"?

Solution 1:

Based on the stack trace at http://silenzio.dk/pi/dhc.strace the first SIOCSIFADDR: Permission denied error occurs at line 735, during execution of process 26092: ifconfig eth2 inet 0 up. Now only root can ifconfig something up, so let's trace the chain of fork()/exec() and look for UID changes. It turns out that:

1. process 26092 is a child of 26090 (line 689)
2. process 26090 runs with UID 101 and GID 102 (lines 355--358)
3. process 26090 tries to set its UID/GID back to 0, but fails (line 310)
4. process 26090 is a child of 26089 (line 286)
5. process 26089 switched its UID:GID to 101:102 (lines 282--283)

So, the errors occur because the executing child process does not have the necessary root privileges. Why does this happen? The debian/changelog file in the dhcp3-3.0.6.dfsg sources says:

dhcp3 (3.0.1-2ubuntu4) breezy; urgency=low

  Derooted the DHCP client:
  * Added debian/patches/deroot-client.patch:
    - client/dhclient.c: After initialization, dro privileges to dhcp:dhcp and
      only keep CAP_NET_RAW and CAP_NET_BIND_SERVICE.
    - Add a setuid wrapper call-dhclient-script to call
      /etc/dhcp3/dhclient-script as root.
    - Install call-dhclient-script into /lib/dhcp3-client/.

My guess is that call-dhclient-script has lost its set-UID bit, and is thus not executing with root privileges as it should. (According to the debian/dhcp3-client.postinst file in the sources, it should be owned by root:dhcp and mode 4754)

Solution 2:

What does your "dmesg" output show when you run dhclient?

If you're running Hardy, AppArmor is part of the default install. It's possible that the dhclient profile has gone haywire. Check "sudo aa-status" to see what is happening there.

Additionally how does your /etc/network/interfaces file read? Perhaps you have conflicting addresses, routes, etc that dhclient doesn't want to play with?

Solution 3:

I would try installing nscd if that package is missing, and if it does not work with this, install also libnss-db.

Not sure if that will solve your problem, however, those are the things that your trace is trying to find and it fails.