From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-0.5 required=3.0 tests=DKIM_ADSP_CUSTOM_MED, DKIM_INVALID,DKIM_SIGNED,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SPF_PASS,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 563D7C43381 for ; Wed, 20 Mar 2019 22:42:20 +0000 (UTC) Received: from krantz.zx2c4.com (krantz.zx2c4.com [192.95.5.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id D6460218AE for ; Wed, 20 Mar 2019 22:42:19 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="rnPzEtcR" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org D6460218AE Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=gmail.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=wireguard-bounces@lists.zx2c4.com Received: from krantz.zx2c4.com (localhost [IPv6:::1]) by krantz.zx2c4.com (ZX2C4 Mail Server) with ESMTP id 7999ca01; Wed, 20 Mar 2019 22:41:46 +0000 (UTC) Received: from krantz.zx2c4.com (localhost [127.0.0.1]) by krantz.zx2c4.com (ZX2C4 Mail Server) with ESMTP id 080c06f7 for ; Tue, 19 Mar 2019 15:16:36 +0000 (UTC) Received: from mail-pg1-x541.google.com (mail-pg1-x541.google.com [IPv6:2607:f8b0:4864:20::541]) by krantz.zx2c4.com (ZX2C4 Mail Server) with ESMTP id 3f2811a5 for ; Tue, 19 Mar 2019 15:16:35 +0000 (UTC) Received: by mail-pg1-x541.google.com with SMTP id h8so14066550pgp.6 for ; Tue, 19 Mar 2019 08:16:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:subject:thread-topic:thread-index:date:message-id :accept-language:content-language:content-id :content-transfer-encoding:mime-version; bh=CQ2WJMFDuAuUyf9KULhq/gNkr4F61MEnr/9J6PIKs6k=; b=rnPzEtcRE5Nw60XRz9BCfNXP4Ha3H/93zjX7+qJW4GBCr9etMwSPspPbi8VMMGdHS+ fDoMOxahzK5BjLQOupGvvlgQZPHqdd5XFgR5eIc7VdjVO54jaakrUnLlLkht9FAi/eLS tvyjhOYvdSfbt2MPbenZ9+ZhbyTdXNABX1NqFM218TYNmTM3K8kOwVb32KeJpAQUQUI5 nt0cfpTAeBcPHlSrg1nRubNVqtmFARWilnazcb8n/COVuhFuijMUMkoUtyXdj2qB3rJ0 KHnavkpEkZgwncSjx++bap4BpHGbDUdy8ObvM7Y78b4+dWVa3iXAEUYEB6qlQq9O8IK9 2wuw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:subject:thread-topic:thread-index:date :message-id:accept-language:content-language:content-id :content-transfer-encoding:mime-version; bh=CQ2WJMFDuAuUyf9KULhq/gNkr4F61MEnr/9J6PIKs6k=; b=KzfnFOu8t2ay6jyee8Mgvgs5zv73livIFofD7bXP9+z+G7vU2LqRKQKmevp0XJla/O g/Zod2XlBLFlZ0uAwcsfmrvmN6+LL+Jnb+6fUB6yaOy1ku4qn16H2Ray6ahrgHxKLS9z q+IG6QNKh95wmnzRKHW+v+loAU2EJX0GVOB5PMLTbaMO0XLV9JJk1zbz7UxSOjSrqZ+S MQhjd6x41Hm1mYtxa0f0vPRL8v3AnlXbna0WUpakwwZazvzFz9M/UHx0+eAs3F0NhZrO uqMR+2g6UOwxxKgBWt2qBQqucSOOM+Ovm2J4l2Zg1lIBd2kKkXTra2Ml8RYXtO0h+Iu1 YZfw== X-Gm-Message-State: APjAAAXHeq0vRn/X+4qicctv7+ei5wPxLP/dKeot2Rkw8UOErSN+SdFx 7JqucIl0lgxhqr33sVHWLVP/bNxu X-Google-Smtp-Source: APXvYqzxB66wE2gVjRZ5F2nj8mb6+nAArrEZ3eXEoOUnBUlfSqUSJxg/lYGgViu5i7vOnObtPbl3PA== X-Received: by 2002:a62:6d81:: with SMTP id i123mr2444365pfc.235.1553008605022; Tue, 19 Mar 2019 08:16:45 -0700 (PDT) Received: from HK2PR04MB3586.apcprd04.prod.outlook.com ([52.98.85.245]) by smtp.gmail.com with ESMTPSA id q86sm36772967pfi.171.2019.03.19.08.16.43 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 19 Mar 2019 08:16:44 -0700 (PDT) From: Michael Lam To: "wireguard@lists.zx2c4.com" Subject: Wireguard-Go security Thread-Topic: Wireguard-Go security Thread-Index: AQHU3mbARA6s7cRIy0SexYAG3U9lXw== X-MS-Exchange-MessageSentRepresentingType: 1 Date: Tue, 19 Mar 2019 15:16:40 +0000 Message-ID: <1E650988-A618-4131-BC8E-711D601A20B0@gmail.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-Exchange-Organization-SCL: -1 X-MS-TNEF-Correlator: X-MS-Exchange-Organization-RecordReviewCfmType: 0 Content-ID: <2B931F5C2141BD4A9F9275B0D1FF6B0C@apcprd04.prod.outlook.com> MIME-Version: 1.0 X-Mailman-Approved-At: Wed, 20 Mar 2019 23:41:43 +0100 X-BeenThere: wireguard@lists.zx2c4.com X-Mailman-Version: 2.1.15 Precedence: list List-Id: Development discussion of WireGuard List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: wireguard-bounces@lists.zx2c4.com Sender: "WireGuard" Hi all, Just a suggestion, I would really love to run Wireguard-go (in OpenBSD) with root privilege dropped. Any chance this get implemented? I also tried to simply start wireguard-go on OpenBSD with a normal user. However it won't start due to the fact that it is trying to set the Tunnel MTU during startup with a tun1 device already created. If that can be by-passed some-how (maybe fail-continue) then it may also work. Obviously I also tried to ensure that the /dev/tun1 permission is correct and the /var/run/wireguard directory permission is correct before trying out. Rgds, Michael _______________________________________________ WireGuard mailing list WireGuard@lists.zx2c4.com https://lists.zx2c4.com/mailman/listinfo/wireguard