NET_RAW capability dropped for NFQ mode when uid/gid is specified
When using suricata with any uid/gid specified and nfq mode, the following code is run. As a result, NET_RAW capability is dropped.
However, when a reject rule is executed, libnet_init gets called via below code path and fails the worker thread.
Please add NET_RAW to the capabilities for NFQ mode as well if libnet is to be used.
2020-08-10T14:14:22.841972792Z  10/8/2020 -- 14:14:22 - (respond-reject-libnet11.c:101) <Error> (RejectSendLibnet11L3IPv4TCP) -- [ERRCODE: SC_ERR_LIBNET_INIT(144)] - libnet_init failed: libnet_open_raw4(): SOCK_RAW allocation failed: Operation not permitted
2020-08-10T14:14:22.841983169Z  10/8/2020 -- 14:14:22 - (tm-threads.c:2087) <Error> (TmThreadCheckThreadState) -- [ERRCODE: SC_ERR_FATAL(171)] - thread W-NFQ#0 failed
No data to display