Support for running as non-root user on OpenBSD with WG_TUN_FD?

Support for running as non-root user on OpenBSD with WG_TUN_FD?

[Brian]

Hi there,

From what I can find, I should be able to run wireguard-go as a non-root user on OpenBSD, as long as I set the MTU on the interface to 1420 before starting WireGuard: https://git.zx2c4.com/wireguard-go/commit/?id=4d5819183e218e040fa0a73df560b4a4a9a768d7

I have the tun2 interface configured with the MTU set to 1420. However, I’m seeing the following error when actually running wireguard-go as the non-root user:

ERROR: (tun2) 2020/03/24 22:47:37 Failed to create TUN device: open /dev/tun2: permission denied

I don’t know Go very well, but it seems like main.go calls the CreateTUN function, and CreateTUN (in tun_openbsd.go) tries to open /dev/tun2 in read-write mode? There seems to be an option to set the WG_TUN_FD environment variable, so that CreateTUNFromFile gets called instead of CreateTUN, but I don’t understand how to properly get a file descriptor in this context.

Thanks for any insight anyone can provide!

-Brian

Re: Support for running as non-root user on OpenBSD with WG_TUN_FD?

[Brian]

> On Mar 25, 2020, at 9:31 PM, Brian <brian@mutualaid.info> wrote:

> I don’t know Go very well, but it seems like main.go calls the CreateTUN function, and CreateTUN (in tun_openbsd.go) tries to open /dev/tun2 in read-write mode? There seems to be an option to set the WG_TUN_FD environment variable, so that CreateTUNFromFile gets called instead of CreateTUN, but I don’t understand how to properly get a file descriptor in this context.

I’ve since done some reading and I think that WG_TUN_FD is designed more for contexts like running Wireguard in a container.

I’ve been able to get it working as a non-root user on OpenBSD but I did have to give the _wireguard user or group read/write permissions on /dev/tun2 and /var/run/wireguard. I’m exploring some alternatives to this but don’t think there is a bug or anything here. If there are any “best practices” for running wireguard-go as a non-root user I’d love to hear them!

-Brian