iwd non-root permissions

feinedsquirrel · 2022-03-28 17:08:31

I have read a lot of posts here, on reddit, and elsewhere about the new root, wheel, or netdev requirements for iwd. On my machines with a broadcom chip, (old macbook pro, and an old imac {I've seen other issues using iwd with these cards, but those are for another topic}) after v1.23 the restrictions came into effect. But, on my 2020 xps 15 (intel wireless card), I have not needed to add myself to any of those groups, and I can still run iwctl without root.
I verified my sudoers file, to ensure that I didn't simply forget that I may have put NOPASSWD on calling iwctl. I have not added a line for that there.

My question is, does anyone have an idea of where I could look to see what is allowing the permissions to run iwctl? I'd like to use this as a learning experience, and potentially find a mis-configuration on my part.

/etc/iwd/main.conf

[Scan]
DisablePeriodicScan=true

[General]
EnableNetworkConfiguration=true
AddressRandomization=network

[Network]
NameResolvingService=resolvconf

runing iwctl in a fresh terminal such that it doesn't have recent sudo rights

$ iwctl
NetworkConfigurationEnabled: enabled
StateDirectory: /var/lib/iwd
Version: 1.26
[iwd]#

groups

$ groups
http video uucp storage lp audio my_user

seth · 2022-03-28 21:37:33

Check /usr/share/dbus-1/system.d/iwd-dbus.conf
You're btw principally allowed to run iwctl, just not to talk to iwd via dbus.

feinedsquirrel · 2022-03-30 17:09:28

I checked that iwd-dbus.conf file, just the plain root, wheel, netdev and default deny blocks.
To clarify, I can actually call commands on the iwctl# command line, without root. I should have mentioned I understand that running iwctl and talking to iwd via dbus are different.

I also forgot to mention I have a short iwd.service override file, with the following contents:

[Service]
RuntimeDirectory=resolvconf
ReadWritePaths=/etc/resolv.conf

but I don't imagine that having anything to do with the iwd via dbus permissions.
I wonder if something just didn't get cleaned up after the update from pre-v1.23, and maybe a removal/re-install of iwd would start enforcing the permissions rules. I don't mind the rules not being enforced, but perhaps I have other issues with my install if these maybe aren't the only permissions rules not being enforced.

seth · 2022-03-31 08:29:09

Can you

dbus-send --system --print-reply --dest=org.freedesktop.systemd1 /org/freedesktop/systemd1 org.freedesktop.systemd1.Manager.Reload

feinedsquirrel · 2022-04-03 17:05:53

result:

$ dbus-send --system --print-reply --dest=org.freedesktop.systemd1 /org/freedesktop/systemd1 org.freedesktop.systemd1.Manager.Reload
Error org.freedesktop.DBus.Error.InteractiveAuthorizationRequired: Interactive authentication required.

seth · 2022-04-03 20:14:32

Well, that interface is certainly still protected.
Is iwctl perhaps suid'?

stat $(which iwctl)
pacman -Qikk iwd

feinedsquirrel · 2022-04-04 18:11:17

$ stat $(which iwctl)
  File: /usr/bin/iwctl
  Size: 106616    	Blocks: 216        IO Block: 4096   regular file
Device: 259,6	Inode: 11417180    Links: 1
Access: (0755/-rwxr-xr-x)  Uid: (    0/    root)   Gid: (    0/    root)
Access: 2022-04-03 11:03:08.829979573 -0600
Modify: 2022-03-23 00:04:12.000000000 -0600
Change: 2022-03-28 08:55:16.811028881 -0600
 Birth: 2022-03-28 08:55:16.811028881 -0600

$ pacman -Qikk iwd
Name            : iwd
Version         : 1.26-1
Description     : Internet Wireless Daemon
Architecture    : x86_64
URL             : https://git.kernel.org/cgit/network/wireless/iwd.git/
Licenses        : LGPL
Groups          : None
Provides        : None
Depends On      : glibc  readline  libreadline.so=8-64  ell
Optional Deps   : None
Required By     : None
Optional For    : None
Conflicts With  : None
Replaces        : None
Installed Size  : 1917.95 KiB
Packager        : Andreas Radke <andyrtr@archlinux.org>
Build Date      : Wed 23 Mar 2022 12:04:12 AM MDT
Install Date    : Mon 28 Mar 2022 08:55:16 AM MDT
Install Reason  : Explicitly installed
Install Script  : Yes
Validated By    : Signature

iwd: 45 total files, 0 altered files

Just looked up SUID. I've seen the term before, but not understood it. With this context, it makes a lot more sense what it means. Seems like it could be quite a powerful little change.
From what I understand with these outputs, anyone can execute, but it is not SUID. Is that correct? And presumably the dbus permissions would block the interaction on the back end of "other" did execute "iwctl".

seth · 2022-04-05 13:16:34

anyone can execute, but it is not SUID. Is that correct?

Unfortunately yes - would have otherwise been an obvious explanation of the situation

feinedsquirrel · 2022-04-05 17:17:25

would have otherwise been an obvious explanation

Yeah, once I understood SUID, I figured that was what we were hoping for. Any other ideas, by chance?
I could uninstall/re-install, but if that "fixes" it, I suspect I'd lose the education on why it is happening. But, could just be one of those things, like rebooting. Something just gets messed up sometimes.

seth · 2022-04-07 20:22:39

Unless you've other relevant configs in /usr/share/dbus-1/system.d/ or /etc/dbus-1/system.d/ I'd try to remove the iwd override.
It probably should™ not cause that, but we don't live in a shouldland…

Arch Linux

#1 2022-03-28 17:08:31

iwd non-root permissions

#2 2022-03-28 21:37:33

Re: iwd non-root permissions

#3 2022-03-30 17:09:28

Re: iwd non-root permissions

#4 2022-03-31 08:29:09

Re: iwd non-root permissions

#5 2022-04-03 17:05:53

Re: iwd non-root permissions

#6 2022-04-03 20:14:32

Re: iwd non-root permissions

#7 2022-04-04 18:11:17

Re: iwd non-root permissions

#8 2022-04-05 13:16:34

Re: iwd non-root permissions

#9 2022-04-05 17:17:25

Re: iwd non-root permissions

#10 2022-04-07 20:22:39

Re: iwd non-root permissions

Board footer