-2

/etc/os-release says Debian GNU/Linux 9 (stretch)

/proc/version says Linux version 4.4.132+ (jenkins@fdc-06) (gcc version 5.4.0 20160609 (Ubuntu/Linaro 5.4.0-6ubuntu1~16.04.9) ) #1 SMP

sudo /sbin/wpa_supplicant -v prints wpa_supplicant v2.4

I’m setting thses permissions in /etc/wpa_supplicant/wpa_supplicant.conf config file.

Tried both ways, the documented one:

ctrl_interface=DIR=/var/run/wpa_supplicant GROUP=linaro

and another one I’ve found after reading source code of that supplicant:

ctrl_interface=/var/run/wpa_supplicant
ctrl_interface_group=linaro

Neither of them works:

$ ls -la /var/run/wpa_supplicant
ls: cannot open directory '/var/run/wpa_supplicant': Permission denied
$ sudo ls -la /var/run/wpa_supplicant
srwxrwx---  1 root root   0 Mar 22 19:24 wlan0

Both owner and group is root despite what’s written in the config.

Worked OK just a few months ago, with Linux 4.4.71+.

How to set the permissions on that UNIX socket?

P.S. Some context: this is embedded system running on ARM SoC. I’m consuming that control interface programmatically, i.e. I need my software, running under normal user account, control Wi-Fi: connect, disconnect, set passwords, etc. There's no Linux desktop nor X-windows running.

Update: as advised in the comments, adding more context. This is custom made embedded device based on RK3288, running Linux kernel, minimal set of systemd services (wpa_supplicant is among them), and a single application I’ve developed. Users interact with my app using a touchscreen, and through the network (but first they need to connect somehow). There’s no X window or Wayland, no desktop, no mouse or keyboard.

  • 1
    Can you add your user to a group to allow for the rights to read/write/execute the files you need them to? – kemotep Mar 22 at 20:34
  • @kemotep I’ve included the output of “ls -la” in my question. Only root has access to that socket. I don’t want to run my software as root, among other features it exposes a couple of network services, running as a root have huge consequences for security. – Soonts Mar 22 at 20:45
  • What I am saying is that you can create a group and give that group the rights it needs to access that file/directory/socket. Alternatively you can open up the permissions on that location to allow non-root users access. Going with group permissions is more secure. Additionally if it is safe, that user can be given sudo rights or permission to run only a select number of commands as root. There are a few ways we can do this, what would constitute an acceptable answer for this post? – kemotep Mar 22 at 20:54
  • @kemotep An acceptable answer would answer the question “how to change security of that socket”? It’s not a file, it’s a UNIX domain socket created by wpa_supplicant process, it’s only visible in the file system for the lifetime of the server process. Even if chmod/chown will work, the changes will only last until restart of that service. – Soonts Mar 22 at 21:00
  • Is it necessary to complete those functions via this Unix socket and not by giving your user the necessary permissions to start/stop/configure wpa_supplicant? – kemotep Mar 22 at 21:14
0

The problem was that wpa_supplicant did not load my config. Not sure it loaded any config at all, I was unable to find path to default config in documentation or source code. Here’s how to fix.

sudo nano /lib/systemd/system/wpa_supplicant.service

Find the following line:

ExecStart=/sbin/wpa_supplicant -u -s -O /run/wpa_supplicant

Change it to

ExecStart=/sbin/wpa_supplicant -u -s -iwlan0 -c/etc/wpa_supplicant/wpa_supplicant.conf

Reboot Linux to apply changes.

Not sure whether previous OS version had that in wpa_supplicant.service, or previous wpa_supplicant used default config; flashing the previous OS to NAND just to check that is a bit complicated.

P.S. Here’s relevant portion of the command line help.

  -c = Configuration file
  -C = ctrl_interface parameter (only used if -c is not)
  -i = interface name
  -I = additional configuration file
  -d = increase debugging verbosity (-dd even more)
  -f = log output to debug file instead of stdout
  -g = global ctrl_interface
  -G = global ctrl_interface group
  -s = log output to syslog instead of stdout
  -O = override ctrl_interface parameter for new interfaces
  -q = decrease debugging verbosity (-qq even less)
  -u = enable DBus control interface
  -W = wait for a control interface monitor before starting

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.