[Pearpc-devel] another approach for tun/tap configuration ?

[Pierre Letouzey]

Hi

First, a great thanks to the PearPC developpers, since you're doing a
great job. I just finished installing and configuring an OpenDarwin on
my Linux/x86 box, and it now works smoothly. There is only one point
where I had some trouble and made some adaptations in the PearPC 0.4
code, concerning the network tun/tap configuration. Instead of using
the proposed scripts ifppc_up and ifppc_down, I managed to make things
works in another way, which seems cleaner. Since your code is
containing comments like
// FIXME: How shall we configure networking??? This thing can only be
// a temporary solution
then I thought you might be interested by the following approach:


1) First I change the group of /dev/net/tun, in order for the user
that will launch ppc to belong to this group (say, user=letouzey,
group=pearpc).

2) Then I register once and for all a tun interface, using the tool
tunctl coming from the UML project (in Debian, see paquet
uml-utilities):

tunctl -u letouzey -t ppc0

Due to point 1) this doesn't even require root permission.

3) I configure the host-side IP of this interface ppc0:

sudo ifconfig ppc0 192.168.1.80
#plus maybe route, iptables, and whatever please you


4) Now establishing the virtual network when pearpc launches is
notably simplier. In src/system/osapi/posix/sysethtun.cc:
- I commented out all calls to execIFConfigScript
- I ensured that "ppc0" is always selected as interface

And that's all, it works directly. The interesting part is that point
2) and 3) can be done (let's say) by some startup script, long before
pearpc is actually used. Moreover "ppc0" could then become an option
of the configuration file, something like tun_interface = "ppc0".
The only issue is portability: I don't know whether such a tool as
tunctl exists or could be ported to other systems like BeOS.

Hope this could help...

Pierre Letouzey

PS: I also made an attempt at running PearPC on debian sarge ppc
install-CD, but this doesn't go far: boot screen, then message
"Welcome to Linux, kernel 2.6.8-powerpc", then a few line later
setup_arch: enter
setup_arch: bootmem
arch: exit
and then nothing more. Any idea what's going on or how to fix?
Thanks in advance.

[Sebastian Biallas]

[..]

This indeed looks nice. But I have no idea how/whether this supported in
the different distributions.

Post by Pierre Letouzey
PS: I also made an attempt at running PearPC on debian sarge ppc
install-CD, but this doesn't go far: boot screen, then message
"Welcome to Linux, kernel 2.6.8-powerpc", then a few line later
setup_arch: enter
setup_arch: bootmem
arch: exit
and then nothing more. Any idea what's going on or how to fix?

There are (at least) two problem:

1) The console isn't initialised. I have no idea why.

2) It goes into an infinite loop detecting the cdrom (no idea either).
If you disable the cdrom Linux 2.6 boots without console.

Sebastian

[Daniel Foesch]

Post by Pierre Letouzey
1) First I change the group of /dev/net/tun, in order for the user
that will launch ppc to belong to this group (say, user=letouzey,
group=pearpc).
2) Then I register once and for all a tun interface, using the tool
tunctl coming from the UML project (in Debian, see paquet
tunctl -u letouzey -t ppc0
Due to point 1) this doesn't even require root permission.

Root should always own the device, otherwise a non-root person could change
the ownership and lock out other users from using the device.

The correct approach is to set the owner to be root.pearpc (owner: root,
group: pearpc) then provide the necessary access to the group, and assign
the users to be using the tun as in that group.

This keeps the owner as root, and still provides the access to all. If it's
necessary to have the owner switched from root, then you gain no security
over running the tun setup as root itself.

But I like that we wouldn't need the setuid scripts to get it setup...
because the way we are doing it now can hardly be called secure or even
safe.


--
Daniel Foesch

[Pierre Letouzey]

Post by Daniel Foesch

Post by Pierre Letouzey
1) First I change the group of /dev/net/tun, in order for the user
that will launch ppc to belong to this group (say, user=letouzey,
group=pearpc).
2) Then I register once and for all a tun interface, using the tool
tunctl coming from the UML project (in Debian, see paquet
tunctl -u letouzey -t ppc0
Due to point 1) this doesn't even require root permission.

Root should always own the device, otherwise a non-root person could
change the ownership and lock out other users from using the device.
root, group: pearpc) then provide the necessary access to the group,
and assign the users to be using the tun as in that group.
This keeps the owner as root, and still provides the access to all.
If it's necessary to have the owner switched from root, then you
gain no security over running the tun setup as root itself.
But I like that we wouldn't need the setuid scripts to get it
setup... because the way we are doing it now can hardly be called
secure or even safe.
--
Daniel Foesch

Oups, I realize now that my first mail can be confusing. Indeed, the
only change I've done to /dev/net/tun concerns its group. Changing the
owner of /dev/net/tun to some non-root account is clearly a bad idea.

Pierre Letouzey