Lokinet fails to run under normal user about lokinet

[Haafingar]

Can confirm this

[majestrate]

On Mon, Dec 03, 2018 at 06:06:06PM -0800, Kee Jefferys wrote: Normal user does not have enough privileges to run Lokinet `[NFO] unnamed (559) Tue Dec 4 13:04:48 2018 AEDT llarp/context.cpp:130 lokinet-0.3.1-3d0f28bb (dev build) [NFO] unnamed (559) Tue Dec 4 13:04:48 2018 AEDT llarp/context.cpp:131 starting up [NFO] unnamed (559) Tue Dec 4 13:04:48 2018 AEDT llarp/context.cpp:95 nodedb_dir loaded 10 RCs from [/home/dev/.lokinet/netdb] [NFO] unnamed (559) Tue Dec 4 13:04:48 2018 AEDT llarp/router.cpp:1304 add upstream resolver 128.52.130.209 [NFO] unnamed (559) Tue Dec 4 13:04:48 2018 AEDT llarp/router.cpp:1304 add upstream resolver 85.208.208.141 [NFO] unnamed (559) Tue Dec 4 13:04:48 2018 AEDT llarp/router.cpp:1304 add upstream resolver 103.236.162.119 [NFO] unnamed (559) Tue Dec 4 13:04:48 2018 AEDT llarp/router.cpp:1309 set local dns to 127.3.2.1:53 [ERR] unnamed (559) Tue Dec 4 13:04:48 2018 AEDT llarp/router_contact.cpp:232 Failed to open i2procks.signed [ERR] unnamed (559) Tue Dec 4 13:04:48 2018 AEDT llarp/router.cpp:1324 malformed rc file: i2procks.signed [NFO] unnamed (559) Tue Dec 4 13:04:48 2018 AEDT llarp/router.cpp:998 outbound link ready [NFO] unnamed (559) Tue Dec 4 13:04:48 2018 AEDT llarp/router.cpp:771 Bound RPC server to 127.0.0.1:1190 [NFO] unnamed (559) Tue Dec 4 13:04:48 2018 AEDT llarp/router.cpp:786 You have 0 inbound links [NFO] unnamed (559) Tue Dec 4 13:04:48 2018 AEDT llarp/router.cpp:838 Your Encryption pubkey 26a15bef27de37f4cac50f5bfd434fb7d62f15ace09bfd28b152ae52b492fd04 [NFO] unnamed (559) Tue Dec 4 13:04:48 2018 AEDT llarp/router.cpp:841 Your Identity pubkey 3a93cea823d25519c86839dee1f276e733e5187a6922b567c089fa757ffab74c [NFO] unnamed (559) Tue Dec 4 13:04:48 2018 AEDT llarp/router.cpp:852 Signing rc... [NFO] unnamed (559) Tue Dec 4 13:04:48 2018 AEDT llarp/router.cpp:864 have 10 routers [NFO] unnamed (559) Tue Dec 4 13:04:48 2018 AEDT llarp/router.cpp:910 setting up default network endpoint [NFO] unnamed (559) Tue Dec 4 13:04:48 2018 AEDT llarp/handlers/tun.cpp:124 default:k89rfz5to3ige3f9yymy7inm63pitehmf4sumqgnfdcew9ihtomy.loki setting ifname to lokitun0 [NFO] unnamed (559) Tue Dec 4 13:04:48 2018 AEDT llarp/handlers/tun.cpp:157 default:k89rfz5to3ige3f9yymy7inm63pitehmf4sumqgnfdcew9ihtomy.loki set ifaddr to 192.168.10.1 with netmask 24 [NFO] unnamed (559) Tue Dec 4 13:04:48 2018 AEDT llarp/handlers/tun.cpp:80 default:k89rfz5to3ige3f9yymy7inm63pitehmf4sumqgnfdcew9ihtomy.loki local dns set to 127.3.2.1:53 [NFO] unnamed (559) Tue Dec 4 13:04:48 2018 AEDT llarp/handlers/tun.cpp:93 default:k89rfz5to3ige3f9yymy7inm63pitehmf4sumqgnfdcew9ihtomy.loki upstream dns set to 103.236.162.119:53 [NFO] unnamed (559) Tue Dec 4 13:04:48 2018 AEDT llarp/handlers/tun.cpp:93 default:k89rfz5to3ige3f9yymy7inm63pitehmf4sumqgnfdcew9ihtomy.loki upstream dns set to 85.208.208.141:53 [NFO] unnamed (559) Tue Dec 4 13:04:48 2018 AEDT llarp/handlers/tun.cpp:93 default:k89rfz5to3ige3f9yymy7inm63pitehmf4sumqgnfdcew9ihtomy.loki upstream dns set to 128.52.130.209:53 [NFO] unnamed (559) Tue Dec 4 13:04:48 2018 AEDT llarp/service/context.cpp:286 added hidden service endpoint default:k89rfz5to3ige3f9yymy7inm63pitehmf4sumqgnfdcew9ihtomy.loki [NFO] unnamed (559) Tue Dec 4 13:04:48 2018 AEDT llarp/router.cpp:918 starting hidden service context... [NFO] unnamed (559) Tue Dec 4 13:04:48 2018 AEDT llarp/handlers/tun.cpp:219 Setting up global DNS IP tracker [NFO] unnamed (559) Tue Dec 4 13:04:48 2018 AEDT llarp/handlers/tun.cpp:328 Set Up networking for default:pyepzmi4s61987gwkg7iyw4gfg6brccwzugdqby1wa89e9dnfn7o.loki [ERR] unnamed (559) Tue Dec 4 13:04:48 2018 AEDT vendor/libtuntap-master/tuntap-unix-linux.c:117 Can't set interface name [WRN] unnamed (559) Tue Dec 4 13:04:48 2018 AEDT llarp/ev.cpp:257 failed to start interface [WRN] unnamed (559) Tue Dec 4 13:04:48 2018 AEDT vendor/libtuntap-master/tuntap-unix-linux.c:151 Can't destroy the interface [ERR] unnamed (559) Tue Dec 4 13:04:48 2018 AEDT llarp/handlers/tun.cpp:263 default:pyepzmi4s61987gwkg7iyw4gfg6brccwzugdqby1wa89e9dnfn7o.loki failed to set up tun interface [WRN] unnamed (559) Tue Dec 4 13:04:48 2018 AEDT llarp/handlers/tun.cpp:340 Only utilizing first hidden service for .loki look ups [NFO] unnamed (559) Tue Dec 4 13:04:48 2018 AEDT llarp/handlers/tun.cpp:349 TunDNS set up 127.3.2.1:53 to 128.52.130.209:53 [NFO] unnamed (559) Tue Dec 4 13:04:48 2018 AEDT llarp/dnsc.cpp:810 DNSc adding relay 128.52.130.209:53 [NFO] unnamed (559) Tue Dec 4 13:04:48 2018 AEDT llarp/dnsd.cpp:602 DNSd binding to 127.3.2.1:53 bind(): Permission denied [ERR] unnamed (559) Tue Dec 4 13:04:48 2018 AEDT llarp/handlers/tun.cpp:353 Couldnt init dns daemon [ERR] unnamed (559) Tue Dec 4 13:04:48 2018 AEDT llarp/service/context.cpp:200 default failed to start [ERR] unnamed (559) Tue Dec 4 13:04:48 2018 AEDT llarp/router.cpp:921 Failed to start hidden service context ` Run under root or with sudo Lokinet runs fine, will need to work on privileges to fix this

looks like it didn't setcap lokinet right, a temp fix is sudo setcap cap_net_admin,cap_net_bind_service=+eip /usr/local/bin/lokinet this has been fixed in my dev branch

…

-- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: #94

[majestrate]

On Mon, Dec 03, 2018 at 06:26:30PM -0800, Haafingar wrote: Can confirm this

can you run: getcap $(which lokinet) and tell me what it gives?

…

-- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: #94 (comment)

[KeeJef]

I ran

getcap $(which lokinet)

That didnt give me any output

Running ls -la lokinet in the loki-network directory gives me

-rwxr-xr-x 1 dev dev 38936856 Dec 6 12:59 lokinet

This was built from 33a4ac8

[majestrate]

On Wed, Dec 05, 2018 at 06:26:11PM -0800, Kee Jefferys wrote: I ran > getcap $(which lokinet) That didnt give me any output Running `ls -la lokinet` in the loki-network directory gives me

in order to setcap lokinet binary MUST be installed with root otherwise it's a massive huge gaping security hazard.

…

> -rwxr-xr-x 1 dev dev 38936856 Dec 6 12:59 lokinet This was built from 33a4ac8 -- You are receiving this because you commented. Reply to this email directly or view it on GitHub: #94 (comment)

[KeeJef]

this issue seems to be caused by not running

sudo make install

[liilac]

Requesting re-opening of this issue as the fix is Linux specific.

Notable platforms where root is required despite alternatives being available and root usage for this sort of thing being strongly discouraged include macOS and FreeBSD.

[majestrate]

On Sat, Dec 08, 2018 at 11:12:11PM -0800, Lilac wrote: Requesting re-opening of this issue as the fix is Linux specific.

i am unsure how to proceed for systems like netbsd/freebsd/macos as they don't seem to have a setcap or equiv. we may have to start up as root and then setuid/setgid to drop privileges, which is fine but would need another issue to track it.

…

-- You are receiving this because you commented. Reply to this email directly or view it on GitHub: #94 (comment)

[liilac]

On macOS there are definitely unprivileged APIs that can be used here, at the very least.

On FreeBSD, I don't recall what off the top of my head, but I believe TrustedBSD provides some similar facilities.

[majestrate]

@liilac make a new issue for each to track them if you can. thanks.

[liilac]

Sure @majestrate

[xznhj8129]

this issue seems to be caused by not running

sudo make install

I am on Manjaro and have tried compiling it but it fails with incomprehensible errors, so I am trying to run it from the tar.xz binary release, i have found absolutely nothing to figure out how to make it run.