regarding unpriv-ip command

[b4sh]

you could add following to your ip wrapper to disallow invoking commands
this could be done by using not allowed commands also to iterate through...
best regards

ip-unpriv.sh

#!/bin/sh
allowed_cmds=("route" "asdf")
chk=()
for((i=0; i<${#allowed_cmds[@]}; i+=1))
do

if [ ! "$( echo $1 | grep ${allowed_cmds[$i]} )" = "" ]
then

chk[$i]=1

else

chk[$i]=0

fi

done
for((i=0; i<${#chk[@]}; i+=1))
do

if [ ${chk[$i]} = 1 ]
then

sudo /bin/ip $*

fi

done

[b4sh]

#!/bin/sh
allowed_cmds=("route" "link" "addr")
chk=()
for((i=0; i<${#allowed_cmds[@]}; i+=1))
do

if [ ! "$( echo $1 | grep ${allowed_cmds[$i]} )" = "" ]
then

chk[$i]=1

else

chk[$i]=0

fi

done
for((i=0; i<${#chk[@]}; i+=1))
do

if [ ${chk[$i]} = 1 ]
then

sudo /bin/ip $*

fi

done

[b4sh]

tested and working so far ... injection attempts should fail

[tct]

A better place to create documentation is on the OpenVPN wiki:
EG. ​ https://community.openvpn.net/openvpn/wiki/UnprivilegedUser

[Gert Döring]

Maybe that whole page should go and be replaced by instructions how to do this with giving appropriate capabilities to OpenVPN and then just using the built-in netlink support...

[Gert Döring]

Both script variants are sheer horror of bashisms. The "allowed command check" can be very trivially done with a standard POSIX shell case statement

case $1 in
   route|link|addr) sudo /sbin/ip $@ ;;
   *) echo "BOH!" ;;
esac

... but this is more for reference.

I have checked our source tree and can't find the "your ip wrapper" you are referring to (which file name to look for?) - but with netlink, this is all somewhat moot anyway, as OpenVPN will no longer call external programs in the default config.

[tct]

This was initially submitted as: New Patch Submission .

All patches to OpenVPN must go via the developer mailing list.

There has been no follow up either here, the ML or the Wiki.

Considering the review comment:

Both script variants are sheer horror of bashisms

Closing.

[Gert Döring]

I left it open for the "update documentation in the Wiki" part...