5

I've set up wireguard and I am very happy with it, I can't help but wonder two things though:

  1. How come wg-quick can only be used by root ?
  2. Can I give another user permission to do wg-quick <up/down> <interface> without actual root access?

I am guessing that it was to do with moving/copying/symlinking the file into a root owned directory, and reloading a daemon or something. Anyhow, I'd love some elaboration and a suggestion to a solution

1

4 Answers 4

3

wg-quick requires root access because it's using wg and ip to make changes to network interfaces.

Do not add wg-quick to sudoers, it will give unrestricted root access. wg-quick configs have hooks to run arbitrary scripts (PreUp, PostUp, etc.) as root, "most commonly used to configure custom DNS options or firewall rules."

wg-quick is really a convenience script as the manpage says:

Generally speaking, this utility is just a simple script that wraps invocations to wg(8) and ip(8) in order to set up a WireGuard interface. It is designed for users with simple needs, and users with more advanced needs are highly encouraged to use a more specific tool, a more complete network manager, or otherwise just use wg(8) and ip(8), as usual.

2

Warning: Following this answer is a security risk, It gives full root access with no password needed, to the user.

Using hint from @ctrl-alt-delor answer, I managed to craft a working solution. In my scenario, I wanted a non sudo user called jenkins being able to run wg-quick <up/down> just like author.

Run: sudo visudo

root            ALL = (ALL) ALL
%admin          ALL = (ALL) ALL

Below added lines -------

jenkins ALL = (ALL) NOPASSWD: /opt/homebrew/bin/bash
jenkins ALL = (ALL) NOPASSWD: /usr/sbin/networksetup
jenkins ALL = (ALL) NOPASSWD: /sbin/ifconfig
jenkins ALL = (ALL) NOPASSWD: /opt/homebrew/bin/wg
jenkins ALL = (ALL) NOPASSWD: /opt/homebrew/bin/wg-quick

It's important to list the prerequisites before the final command that we want to execute! Otherwise, it will not work! I hope that this will help someone!

After this, the normal user jenkins was able to run this command. If you face

encountered an error: "wg-quick: Version mismatch: bash 3 detected, when bash 4+ required"

then simply run

which bash

copy path output and put it at the beggining of wg-quick file(/opt/homebrew/bin/wg-quick)

In my case, top of the wg-quick will have: #!/opt/homebrew/bin/bash

After this operation, user can run this wg-quick up/down and execute this job from automator/sh script :)

Resource used: https://osxdaily.com/2014/02/06/add-user-sudoers-file-mac/

2
  • 2
    As one of the other answers noted, you have just given the 'jenkins' user unrestricted root access, by allowing them to run a root-level shell. Working with system-level commands in sudo is generally going to open up a number of security issues, unless you are very strict in your command definitions, which - at some point - will be more work than it's worth. Please consider the implications of your sudoers rules very carefully.
    – Thomas N
    Jul 7, 2021 at 15:28
  • You may as well add jenkins to group admin, with no password needed. This configuration gives god access to everything. Jul 10, 2021 at 18:44
0

Yes. But don't (see other answers).

Warning: don't do this for this command.

Option 1: Figure out why, and do the right thing.

Option 2: sudo

Run with sudo and type password. I guess that you are already doing this.

Option 3: configure password-less sudo for this command.

Un-safe for this command.

Edit the /etc/sudoers file, so that you can run this command with sudo and no password. (Be careful, use visudo to validate the file.)

When this is working, you can write a wrapper script, to make it easier to run.

2
  • How to edit such file? I have a regular user and admin user accounts. I would like to edit it in a way such regular user can execute wg-quick withoud need for sudo or password. Help is very much appreciated :)
    – pawisoon
    Jul 6, 2021 at 13:03
  • @pawisoon read man sudoers. Configure so that command can be run with sudo, but no password needed. Then write a script wrapper, shell-function or alias, to make the sudo invisible. Jul 10, 2021 at 18:39
0

On my own laptop, just solved this by applying suid bit to wg-quick and wg executable.

which wg: /usr/bin/wg
which wg-quick: /usr/bin/wg-quick

sudo chmod u+s /usr/bin/wg-quick
sudo chmod u+s /usr/bin/wg
1
  • 3
    This enables any user to execute any arbitrary code as root. For example: echo -e "[Interface]\nPreUp = whoami" > /tmp/exploit.conf && wg-quick up /tmp/exploit.conf Jun 3, 2023 at 16:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .