1

/etc/os-release says Debian GNU/Linux 9 (stretch)

/proc/version says Linux version 4.4.132+ (jenkins@fdc-06) (gcc version 5.4.0 20160609 (Ubuntu/Linaro 5.4.0-6ubuntu1~16.04.9) ) #1 SMP

sudo /sbin/wpa_supplicant -v prints wpa_supplicant v2.4

I’m setting thses permissions in /etc/wpa_supplicant/wpa_supplicant.conf config file.

Tried both ways, the documented one:

ctrl_interface=DIR=/var/run/wpa_supplicant GROUP=linaro

and another one I’ve found after reading source code of that supplicant:

ctrl_interface=/var/run/wpa_supplicant
ctrl_interface_group=linaro

Neither of them works:

$ ls -la /var/run/wpa_supplicant
ls: cannot open directory '/var/run/wpa_supplicant': Permission denied
$ sudo ls -la /var/run/wpa_supplicant
srwxrwx---  1 root root   0 Mar 22 19:24 wlan0

Both owner and group is root despite what’s written in the config.

Worked OK just a few months ago, with Linux 4.4.71+.

How to set the permissions on that UNIX socket?

P.S. Some context: this is embedded system running on ARM SoC. I’m consuming that control interface programmatically, i.e. I need my software, running under normal user account, control Wi-Fi: connect, disconnect, set passwords, etc. There's no Linux desktop nor X-windows running.

Update: as advised in the comments, adding more context. This is custom made embedded device based on RK3288, running Linux kernel, minimal set of systemd services (wpa_supplicant is among them), and a single application I’ve developed. Users interact with my app using a touchscreen, and through the network (but first they need to connect somehow). There’s no X window or Wayland, no desktop, no mouse or keyboard.

11
  • 1
    Can you add your user to a group to allow for the rights to read/write/execute the files you need them to?
    – kemotep
    Mar 22, 2019 at 20:34
  • @kemotep I’ve included the output of “ls -la” in my question. Only root has access to that socket. I don’t want to run my software as root, among other features it exposes a couple of network services, running as a root have huge consequences for security.
    – Soonts
    Mar 22, 2019 at 20:45
  • What I am saying is that you can create a group and give that group the rights it needs to access that file/directory/socket. Alternatively you can open up the permissions on that location to allow non-root users access. Going with group permissions is more secure. Additionally if it is safe, that user can be given sudo rights or permission to run only a select number of commands as root. There are a few ways we can do this, what would constitute an acceptable answer for this post?
    – kemotep
    Mar 22, 2019 at 20:54
  • @kemotep An acceptable answer would answer the question “how to change security of that socket”? It’s not a file, it’s a UNIX domain socket created by wpa_supplicant process, it’s only visible in the file system for the lifetime of the server process. Even if chmod/chown will work, the changes will only last until restart of that service.
    – Soonts
    Mar 22, 2019 at 21:00
  • Is it necessary to complete those functions via this Unix socket and not by giving your user the necessary permissions to start/stop/configure wpa_supplicant?
    – kemotep
    Mar 22, 2019 at 21:14

3 Answers 3

4

Actually, the way to set the configuration of a non-root group associated with the UNIX socket of wpa_supplicant is pretty weird (and not documented). The following steps could be useful.

  • Create a group (linaro in your case); I will anyway use "netdev" in my examples, which should already exist in most distributions (if not existing: sudo groupadd netdev);
  • associate the user to that group (e.g., for the user "my_user": sudo usermod -a -G netdev my_user);
  • check how wpa_supplicant is started (ps -ef | grep wpa_supplicant):
    • if the -O option is used, like -O /run/wpa_supplicant, change it to a string including DIR and GROUP attributes, assigning GROUP to netdev, like in -O "DIR=/run/wpa_supplicant GROUP=netdev";
    • if -O and -i are not used, while -s is used, then you need to set the -O option like before; notice that any setting included in the wpa_supplicant configuration file (e.g., -c option) will not be used in this case; example of correct configuration: /sbin/wpa_supplicant -u -s -O "DIR=/run/wpa_supplicant GROUP=netdev";
    • if -O is not used, while -i and -c are used, then you can set the GROUP attribute in the wpa_supplicant configuration file (e.g., specified with -c option); example: ctrl_interface=DIR=/run/wpa_supplicant GROUP=netdev.

You can use /var/run in place of /run in the above examples, as generally /var/run is a symbolic link of /run.

2

The problem was that wpa_supplicant did not load my config. Not sure it loaded any config at all, I was unable to find path to default config in documentation or source code. Here’s how to fix.

sudo nano /lib/systemd/system/wpa_supplicant.service

Find the following line:

ExecStart=/sbin/wpa_supplicant -u -s -O /run/wpa_supplicant

Change it to

ExecStart=/sbin/wpa_supplicant -u -s -iwlan0 -c/etc/wpa_supplicant/wpa_supplicant.conf

Reboot Linux to apply changes.

Not sure whether previous OS version had that in wpa_supplicant.service, or previous wpa_supplicant used default config; flashing the previous OS to NAND just to check that is a bit complicated.

P.S. Here’s relevant portion of the command line help.

  -c = Configuration file
  -C = ctrl_interface parameter (only used if -c is not)
  -i = interface name
  -I = additional configuration file
  -d = increase debugging verbosity (-dd even more)
  -f = log output to debug file instead of stdout
  -g = global ctrl_interface
  -G = global ctrl_interface group
  -s = log output to syslog instead of stdout
  -O = override ctrl_interface parameter for new interfaces
  -q = decrease debugging verbosity (-qq even less)
  -u = enable DBus control interface
  -W = wait for a control interface monitor before starting
1
1

Use wpa_priv

Start wpa_priv as root (e.g., from system startup scripts) with the enabled interfaces configured on the command line:

wpa_priv -B -c /var/run/wpa_priv -P /var/run/wpa_priv.pid [driver:interface]

wpa_priv -B -c /var/run/wpa_priv -P /var/run/wpa_priv.pid nl80211:wlan0

Then, run wpa_supplicant as non-root with a user that is in the wpapriv group:

wpa_supplicant -i wlan0 -c wpa_supplicant.conf

Check wpa_priv man-page: https://www.linux.org/docs/man8/wpa_priv.html

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .