create_ap: init at 0.4.6 #54000

klntsky · 2019-01-15T20:39:38Z

Motivation for this change

Things done

Additionally, I've included a systemd service which provides a nix interface to some of the most frequently used configurable options (the other can also be set via extraConfig).

I have tested the following:

AP creation
- without passphrase
- with passphrase
- SHARE_METHOD
  - nat
  - bridge
  - none
- ISOLATE_CLIENTS
- HIDDEN
dnsmasq-related
- ETC_HOSTS
- additional hosts (-e flag)
- MAC_FILTER / MAC_FILTER_ACCEPT
usage without network manager
- AP creation (no need to retest all the options above, because nmcli is used only to set/unset the unmanaged status)
other
- --list-running / --list-clients / --stop

pkgs/tools/networking/create_ap/default.nix

nixos/modules/services/networking/create_ap.nix

infinisil · 2019-01-23T21:27:53Z

nixos/modules/services/networking/create_ap.nix

+        Restart="on-failure";
+        RestartSec=5;
+        ExecStart = "${pkgs.create_ap}/bin/create_ap --config ${configFile}";
+      };


Try using the DynamicUser systemd option and maybe some others regarding privileges (man systemd.exec) to be able to run this without root privileges.

Sadly, it isn't quite easy: the script checks the user id.

if [[ $(id -u) -ne 0 ]]; then echo "You must run it as root." >&2 exit 1 fi

https://github.com/oblique/create_ap/blob/016fd2b38f87d56344b87b588a6c887628884482/create_ap#L1270

I can dedicate some more time to patching it, though, if running as a separate user is required.

Ah I see, in this case I think root is fine, but the security related systemd settings would be very much appreciated (ProtectSystem, ProtectHome and the Private* settings, see man systemd.exec).

If patching is simple and it works pretty much out of the box with non-root, then that would be even better. We're trying not to have services run as root in general after all, see #41092

What do you think would be better?

We're trying not to have services run as root in general after all

I'm all for this and I am sure that it is possible - it's just that I have had not enough experience with systemd to get it working right now.

Please wait until I finally figure out how to set it up with DynamicUser on.

klntsky · 2019-01-27T12:11:41Z

One more thing to consider: the script is able to run and control multiple instances of itself in parallel (i.e. via --list-running / --stop).

But when started as a service in its current implementation, only one instance is possible.

Maybe it is a good idea to replace the single instance configuration with a list of them. Then it will be possible to define multiple configs and thus create multiple access points:

  services.create_ap = [
  { enable = true;  ... }
  { enable = true;  ... }
  { enable = true;  ... }
  ];

Or maybe it is even better to handle two cases: when config.services.create_ap is a list and when it is an attribute set.

klntsky · 2019-01-27T12:31:59Z

nixos/modules/services/networking/create_ap.nix

klntsky · 2019-01-27T19:03:00Z

Now I need some time to check all possible usage scenarios with DynamicUser again.

klntsky · 2019-01-28T19:22:40Z

Without CAP_DAC_OVERRIDE it can't set unmanaged status to devices owned by NetworkManager, because of read-only file system.

If the device is already unmanaged, then everything's OK - that's why I caught this problem that late.

Strangely enough, ReadWritePaths = "-/etc/NetworkManager/" line that was added earlier didn't help (I was thinking that it did).

infinisil · 2019-01-28T19:29:53Z

Try to do an strace of the process to see which path it tries to write to.

klntsky · 2019-01-28T20:20:46Z

sed -i tries to create a temporary file.

It can be observed even from status output:

Jan 28 23:18:29 nixos create_ap[16451]: Network Manager found, set wlp2s0f0 as unmanaged device... sed: couldn't open temporary file /etc/NetworkManager/sedW6bpNK: Permission denied

# strace -f -o /tmp/strace.log -s 2048 -p 1 & systemctl start create_ap

21764 openat(AT_FDCWD, "/etc/NetworkManager/sedd6IF0R", O_RDWR|O_CREAT|O_EXCL, 0600) = -1 EROFS (Read-only file system)

/etc/NetworkManager/ is in ReadWritePaths at the moment.

klntsky · 2019-01-28T20:29:26Z

Well, everything works as it should:

Paths listed in ReadWritePaths= are accessible from within the namespace with the same access modes as from outside of it.

It is impossible to modify files in /etc/ while under DynamicUser without CAP_DAC_OVERRIDE.

ryantm · 2019-02-18T05:45:58Z

@8084 Can you please change the commit message to match https://github.com/NixOS/nixpkgs/blob/master/.github/CONTRIBUTING.md "init" and "create_ap" are flipped

klntsky · 2019-02-18T08:37:58Z

@ryantm OK, I'll --squash and force-push the commit with correct message after I'm done.

infinisil · 2019-03-29T13:15:16Z

nixos/modules/services/networking/create_ap.nix

+    SSID=${cfg.ssid}
+    PASSPHRASE=${cfg.passphrase}
+    USE_PSK=0
+    ${cfg.extraConfig}


Now that I've opened NixOS/rfcs#42, I'm not so sure anymore about this anymore. Because once we introduce such hardcoded defaults and extraConfig, it's hard to go back. Consider using the approach in the RFC instead.

deliciouslytyped · 2019-10-28T22:42:07Z

bump? I'm interested in this.

infinisil · 2019-10-29T12:16:45Z

@klntsky Would you mind if I pushed a commit to this PR to make it use the approach in NixOS/rfcs#42?

Co-authored-by: Silvan Mosberger <contact@infinisil.com>

klntsky · 2019-10-29T20:48:52Z

@infinisil I definitely do not mind, thank you.

I don't have enough time myself to work on this PR, sadly.

infinisil · 2019-10-29T22:19:27Z

Cool, did that, somebody should test this again before merging though, I could try with my own laptop later perhaps, not sure if it can do it though

ryantm · 2020-01-01T23:29:02Z

@klntsky Can you test the latest version?

stale · 2020-06-30T15:26:13Z

Thank you for your contributions.

This has been automatically marked as stale because it has had no activity for 180 days.

If this is still important to you, we ask that you leave a comment below. Your comment can be as simple as "still important to me". This lets people see that at least one person still cares about this. Someone will have to do this at most twice a year if there is no other activity.

Here are suggestions that might help resolve this more quickly:

Search for maintainers and people that previously touched the related code and @ mention them in a comment.
Ask on the NixOS Discourse.
Ask on the #nixos channel on irc.freenode.net.

klntsky · 2020-07-09T09:52:22Z

As for now, I believe it's best to drop the service entirely and provide the binary only, due to lack of human powers to wrap it properly.

klntsky requested a review from infinisil as a code owner January 15, 2019 20:39

GrahamcOfBorg added 6.topic: nixos 8.has: module (update) 8.has: package (new) 10.rebuild-darwin: 0 10.rebuild-linux: 1-10 labels Jan 15, 2019

infinisil requested changes Jan 23, 2019

View reviewed changes

klntsky force-pushed the init-create_ap branch from ec133f0 to ddd1f24 Compare January 26, 2019 14:39

GrahamcOfBorg added the 11.by: package-maintainer label Jan 26, 2019

infinisil reviewed Jan 27, 2019

View reviewed changes

nixos/modules/services/networking/create_ap.nix Outdated Show resolved Hide resolved

infinisil approved these changes Feb 18, 2019

View reviewed changes

dywedir changed the title ~~init: create_ap at 0.4.6~~ create_ap: init at 0.4.6 Feb 19, 2019

klntsky force-pushed the init-create_ap branch from e22be2b to 720d3a3 Compare February 20, 2019 08:11

infinisil reviewed Mar 29, 2019

View reviewed changes

klntsky and others added 2 commits October 29, 2019 15:11

create_ap: init at 0.4.6

3f89731

nixos/create_ap: init

53a2387

Co-authored-by: Silvan Mosberger <contact@infinisil.com>

infinisil force-pushed the init-create_ap branch from 720d3a3 to 53a2387 Compare October 29, 2019 20:59

stale bot added the 2.status: stale https://github.com/NixOS/nixpkgs/blob/master/.github/STALE-BOT.md label Jun 30, 2020

stale bot removed the 2.status: stale https://github.com/NixOS/nixpkgs/blob/master/.github/STALE-BOT.md label Jul 9, 2020

klntsky closed this Jul 9, 2020

klntsky mentioned this pull request Jul 9, 2020

create_ap: init at 0.4.6 #92787

Closed

10 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

create_ap: init at 0.4.6 #54000

create_ap: init at 0.4.6 #54000

klntsky commented Jan 15, 2019

infinisil Jan 23, 2019

klntsky Jan 24, 2019

infinisil Jan 26, 2019

klntsky Jan 26, 2019

klntsky commented Jan 27, 2019

klntsky commented Jan 27, 2019 •

edited

klntsky commented Jan 27, 2019

klntsky commented Jan 28, 2019

infinisil commented Jan 28, 2019

klntsky commented Jan 28, 2019

klntsky commented Jan 28, 2019

ryantm commented Feb 18, 2019

klntsky commented Feb 18, 2019

infinisil Mar 29, 2019

deliciouslytyped commented Oct 28, 2019

infinisil commented Oct 29, 2019

klntsky commented Oct 29, 2019

infinisil commented Oct 29, 2019

ryantm commented Jan 1, 2020

stale bot commented Jun 30, 2020

klntsky commented Jul 9, 2020

create_ap: init at 0.4.6 #54000

create_ap: init at 0.4.6 #54000

Conversation

klntsky commented Jan 15, 2019

Motivation for this change

Things done

infinisil Jan 23, 2019

Choose a reason for hiding this comment

klntsky Jan 24, 2019

Choose a reason for hiding this comment

infinisil Jan 26, 2019

Choose a reason for hiding this comment

klntsky Jan 26, 2019

Choose a reason for hiding this comment

klntsky commented Jan 27, 2019

klntsky commented Jan 27, 2019 • edited

klntsky commented Jan 27, 2019

klntsky commented Jan 28, 2019

infinisil commented Jan 28, 2019

klntsky commented Jan 28, 2019

klntsky commented Jan 28, 2019

ryantm commented Feb 18, 2019

klntsky commented Feb 18, 2019

infinisil Mar 29, 2019

Choose a reason for hiding this comment

deliciouslytyped commented Oct 28, 2019

infinisil commented Oct 29, 2019

klntsky commented Oct 29, 2019

infinisil commented Oct 29, 2019

ryantm commented Jan 1, 2020

stale bot commented Jun 30, 2020

klntsky commented Jul 9, 2020

klntsky commented Jan 27, 2019 •

edited