setcap plugin failing

I can’t figure out how to debug this issue of the setcap plugin failing:

zeek@zeekmgr:~$ broctl install

setcap plugin: executing setcap on each node: - Executing setcap: FAIL:


OS: Debian9
Zeek: v2.6.1 installed from source into /usr/local/bro
Plugins: af_packet installed from source and PingTrip/broctl-setcap file installed by hand into /usr/local/bro/lib/broctl/plugins.

The following is appended to the bottom /usr/local/bro/etc/broctl.cfg:

Configure broctl-setcap plugin

setcap.command=sudo /sbin/setcap cap_net_raw+eip /usr/local/bro/bin/bro && sudo /sbin/setcap cap_net_raw+eip /usr/local/bro/bin/capstats

And this to /etc/sudoers.d/zeek on each of the sensors:

Cmnd_Alias BRO_SETCAP = /sbin/setcap cap_net_raw+eip /usr/local/bro/bin/bro

Cmnd_Alias CAPSTATS_SETCAP = /sbin/setcap cap_net_raw+eip /usr/local/bro/bin/capstats
Defaults!/sbin/setcap !requiretty

Any ideas what to check to see what is going wrong?

Is the account you are using zeek or bro? your prompt says zeek but
the sudoers file says bro.

Thanks Justin. I stared at those configs for a long time and never noticed the problem. That should fix it.