Allow the use of vmnet as an unprivileged user
Nobody has claimed this yet.
- Dominant language
- C
- Stars
- 3.7k
- Forks
- 336
- PR merge metrics
- No merged PRs in 30d
Description
Hi there!
I have a patch that I've been using on my own laptop for a few days to allow the use of vmnet as an unprivileged user. It works by opening the vmnet interface early and then dropping privileges if it detects that it is running setuid. chmod u+s on the hyperkit binary is then sufficient to allow unprivileged use of vmnet.
There are obviously security concerns with making the hyperkit binary setuid. As far as I can tell, the worst thing a user should be able to do is create a VM with the same UUID that another user wants to use so that a vmnet interface is created with the same MAC address, blocking the creation of the other user's VM. I'm not sure if this is worth worrying about or not.
I'll be opening a pull request with my proposed implementation of this momentarily.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating hyperkit’s vmnet setup and the setuid privilege-handling path described in the issue. Review the proposed ordering and security implications, then verify unprivileged vmnet operation while ensuring existing privileged behavior remains intact.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c, macos
- Domain
- operating-systems, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100