Improve usability of non-privileged operation
cover Improve usability of non-privileged operation
Ohai!
I recently undertook the project of not having my VPN client run as root anymore. I noticed there are a lot of questions about this on the internet, and I think one reason that this is more difficult then necessary is that the "official" client.down script doesn't work when used in the conjunction with the down-root plugin.
I noticed that both the up and the down script get a lot of information through environment variables, and the up script relies on that already anyways. So I figured doing the same in the down script would be a reasonable thing to do (it's also what the most commonly referred to external up/down scripts do).
With this change, the down script can actually be used with the down-root plugin just like this:
plugin openvpn-plugin-down-root.so "/etc/openvpn/client.down"
Hope this makes sense,
Conrad
Conrad Hoffmann (2):
Use provided env vars in up/down script.
Document down-root plugin usage in client.down
contrib/pull-resolv-conf/client.down | 6 +++++- contrib/pull-resolv-conf/client.up | 4 ++-- 2 files changed, 7 insertions(+), 3 deletions(-)
Signature · 1 line
2.13.3
PATCH 1/2 Use provided env vars in up/down script.
This makes the down script work both as regular down script as well as with the down-root plugin. The up script is just changed for consistency.
--- contrib/pull-resolv-conf/client.down | 2 +- contrib/pull-resolv-conf/client.up | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-)
contrib/pull-resolv-conf/client.down +1 -1
@@ -37,7 +37,7 @@ PATH=/bin:/usr/bin:/usr/local/bin:/sbin:/usr/sbin:/usr/local/sbin if type resolvconf >/dev/null 2>&1; then - resolvconf -d "${1}" -f + resolvconf -d "${dev}" -f elif [ -e /etc/resolv.conf.ovpnsave ] ; then # cp + rm rather than mv in case it's a symlink cp /etc/resolv.conf.ovpnsave /etc/resolv.conf
contrib/pull-resolv-conf/client.up +2 -2
@@ -87,11 +87,11 @@ elif [ $ndoms -gt 1 ]; then fi # This is the complete file - "$domains" has a leading space already -out="# resolv.conf autogenerated by ${0} (${1})${nl}${dns}${ds}${domains}" +out="# resolv.conf autogenerated by ${0} (${dev})${nl}${dns}${ds}${domains}" # use resolvconf if it's available if type resolvconf >/dev/null 2>&1; then - printf "%s\n" "${out}" | resolvconf -p -a "${1}" + printf "%s\n" "${out}" | resolvconf -p -a "${dev}" else # Preserve the existing resolv.conf if [ -e /etc/resolv.conf ] ; then
Signature · 1 line
2.13.3
Re: [Openvpn-devel] [PATCH applied] Use provided env vars in up/down script.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
ACK. Verified that ${dev} does indeed exists in --up and when the plug-in runs with OPENVPN_PLUGIN_DOWN mode, which is facilitated via the down-root plug-in.
Your patch has been applied to the following branches
commit 94c1ce22ebcc1f672bb80598afccc130aa01fafc (master) commit 9f390f0209aa119f7625a75ae309787bc6785831 (release/2.4)
Author: Conrad Hoffmann Date: Wed Aug 2 20:14:34 2017 +0200
Use provided env vars in up/down script.
Signed-off-by: Conrad Hoffmann <[email protected]...>
Acked-by: David Sommerseth <[email protected]...>
Message-Id: <[email protected]...>
URL: https://www.mail-archive.com/[email protected]/msg15165.html
Signed-off-by: David Sommerseth <[email protected]...>- --
kind regards,
David Sommerseth
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (GNU/Linux)
iQIcBAEBCgAGBQJZkau8AAoJEIbPlEyWcf3yxFwP/jdgEw7U5naNlSTSOmDnOE32 ox/JMuKEeWx4U4j+ngsijBGciX+kaEWihPCFfYgTnZw25aR2vQfz5eGeDpdNrf7h Sk/sddAjy1urIn97aA2gdbNOt2JXjuPYXPbTMvbp/HAby3rjdsP+WwftRS5PlNfC wh85felObSHULdw/9keLZMVYgrkNWKB1FdAsKxXW0ky5bj3qTYL5BNPtqPe0Iw6D iSi3XeUwRYDQ0tegzoIJYaEIzEfCSiTpr64mOvotVvmNDDg5y5QkMJg9UtXrkBsC xFd7CIOjBArht44U7OM0tK1KNEqa5W7n3EFUu10hsuEUVI5VAQwPLppTt9Zf7ja2 X0MhMBD7+Eh3lOX+SKjuOfO+lKhNtM3f0T3Nklrz7zxhNlMinn3a4w9xgDMHrsj2 vhBuQfRtvsnQEY41egibEL0dNRvwVSDdGziFtgRBc75qUihFD+yVbLdYxz1lQ9RP jmWKJn6QS6U4at88z0h+gYM2XYLXTbNzAn49C78HQZbTw2gSlpUcrVEEF554FPSt zWQ47p5sUbUDptS1pPrCPsh+s03drWYOYqVY6O2NHz4Qz+vgd//eXW2pKMf90l2E wuPxbA7wIzUGhwGWFzGyf/u7v9zqJnj9a7hOS7Poka90tSiMCsw1iIkLPsR5Lu2d yyhWjWqhpKLTr1rpc3dq
=dG9l
-----END PGP SIGNATURE-----
PATCH 2/2 Document down-root plugin usage in client.down
In reply to Conrad Hoffmann--- contrib/pull-resolv-conf/client.down | 4 ++++ 1 file changed, 4 insertions(+)
contrib/pull-resolv-conf/client.down +4 -0
@@ -30,6 +30,10 @@ # the client "up" script will run fine, but the "down" script # will require the use of the OpenVPN "down-root" plugin # which is in the plugins/ directory of the OpenVPN source tree +# The config example above would have to be changed to: +# client +# up /etc/openvpn/client.up +# plugin openvpn-plugin-down-root.so "/etc/openvpn/client.down" # A horrid work around, from a security perspective, # is to run OpenVPN as root. THIS IS NOT RECOMMENDED. You have
Signature · 1 line
2.13.3
Re: [Openvpn-devel] [PATCH applied] Document down-root plugin usage in client.down
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
ACK.
Your patch has been applied to the following branches
commit cbeff7b1b3f2815ee27f4479dca502c220fc4d15 (master) commit 597b6224e254775915956b8db45c090709b17b1a (release/2.4)
Author: Conrad Hoffmann Date: Wed Aug 2 20:14:35 2017 +0200
Document down-root plugin usage in client.down
Signed-off-by: Conrad Hoffmann <[email protected]...>
Acked-by: David Sommerseth <[email protected]...>
Message-Id: <[email protected]...>
URL: https://www.mail-archive.com/[email protected]/msg15164.html
Signed-off-by: David Sommerseth <[email protected]...>- --
kind regards,
David Sommerseth
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (GNU/Linux)
iQIcBAEBCgAGBQJZkavnAAoJEIbPlEyWcf3y9HMP/ihfyiarn7ADfF1wCrWxCrcU ZbtPELZHmIMxgAhmK7z6RSiomr7MmfCHi4M9MGrqBNYKSWTyySHg9vaPE5sT8ThP Rky9zwrgMBhJVvKIQEv63B/h3HjVGw9eg8SvkRbNlUYPh3lH8q1h7/2pmRiBsQi7 o6QUWrSSlX2/w2WFg21S8Uj0I+2pzMx7fHykEjbC/EUTuYGzxMWPxLqUEXY+ayD8 E92hewWDkVo8cNXTxQaw2UUk59LBUsux8hf7GnCnlTZ2yCTsaYbWFOOWsuW0FuKZ liN/xzIstlQn3HbWA27gbcUrjkOfdl7thANnFjormV8TSm8BYYmjhyKqyVx2g6pH jwWgOEuP3GlvykFj5dC3S5D4DfhHGVqgtYs9h+TieeN7qXO+hrkD+94cLqyYEAb4 rGeAUWKUjRCWzTG5doADRj3RA37ScUjtJptgXfqiWWUcKpUlIfxG90tiOTV1J737 bDgi8eSnSxCYSg56Difwtr7mAGuXejZNqil8zMXVjkRa5fc7qaxzk4pw/3T4o/aU R3Jl99KJtb/BKqL3GbQTZSEY7E8n3hGxCznK3t4u6Asu0f6eXrK/1TF4A1adOTVm ZBkpjrWWE+YAOtMCoiKBz/1R0fzCbbGVYoSrwuiXx+DJBg+pTWxRuKxrzcLtoB9r Jnh5QxUVgRguD7Z36lby
=dFSr
-----END PGP SIGNATURE-----
Quoted 13 lines · Conrad Hoffmann
Ohai!
I recently undertook the project of not having my VPN client run as root anymore. I noticed there are a lot of questions about this on the internet, and I think one reason that this is more difficult then necessary is that the "official" client.down script doesn't work when used in the conjunction with the down-root plugin.
I noticed that both the up and the down script get a lot of information through environment variables, and the up script relies on that already anyways. So I figured doing the same in the down script would be a reasonable thing to do (it's also what the most commonly referred to external up/down scripts do).
Quoted 7 lines
With this change, the down script can actually be used with the down-root plugin just like this:
plugin openvpn-plugin-down-root.so "
/etc/openvpn/client.down"Hope this makes sense,
Conrad
Hi Conrad,
Nice catch! And thanks for your patches! As you're a new contributor, I just wanted to let you know your patch is in the pipe now and will be reviewed and tested as soon as some of us are ready to process it.
And based on a 10 seconds look, this does look correct - we just need to need to do a little test run first.
Signature · 4 lines
kind regards, David Sommerseth OpenVPN Technologies, Inc