121 lines
3.8 KiB
Groff
121 lines
3.8 KiB
Groff
.\" This manpage has been automatically generated by docbook2man
|
|
.\" from a DocBook document. This tool can be found at:
|
|
.\" <http://shell.ipoline.com/~elmert/comp/docbook2X/>
|
|
.\" Please send any bug reports, improvements, comments, patches,
|
|
.\" etc. to Steve Cheng <steve@ggi-project.org>.
|
|
.TH "WPA_PRIV" "8" "07 September 2010" "" ""
|
|
|
|
.SH NAME
|
|
wpa_priv \- wpa_supplicant privilege separation helper
|
|
.SH SYNOPSIS
|
|
|
|
\fBwpa_priv\fR [ \fB-c \fIctrl path\fB\fR ] [ \fB-Bdd\fR ] [ \fB-P \fIpid file\fB\fR ] [ \fBdriver:ifname \fI[driver:ifname ...]\fB\fR ]
|
|
|
|
.SH "OVERVIEW"
|
|
.PP
|
|
\fBwpa_priv\fR is a privilege separation helper that
|
|
minimizes the size of \fBwpa_supplicant\fR code that needs
|
|
to be run with root privileges.
|
|
.PP
|
|
If enabled, privileged operations are done in the wpa_priv process
|
|
while leaving rest of the code (e.g., EAP authentication and WPA
|
|
handshakes) to operate in an unprivileged process (wpa_supplicant) that
|
|
can be run as non-root user. Privilege separation restricts the effects
|
|
of potential software errors by containing the majority of the code in an
|
|
unprivileged process to avoid the possibility of a full system
|
|
compromise.
|
|
.PP
|
|
\fBwpa_priv\fR needs to be run with network admin
|
|
privileges (usually, root user). It opens a UNIX domain socket for each
|
|
interface that is included on the command line; any other interface will
|
|
be off limits for \fBwpa_supplicant\fR in this kind of
|
|
configuration. After this, \fBwpa_supplicant\fR can be run as
|
|
a non-root user (e.g., all standard users on a laptop or as a special
|
|
non-privileged user account created just for this purpose to limit access
|
|
to user files even further).
|
|
.SH "EXAMPLE CONFIGURATION"
|
|
.PP
|
|
The following steps are an example of how to configure
|
|
\fBwpa_priv\fR to allow users in the
|
|
\fBwpapriv\fR group to communicate with
|
|
\fBwpa_supplicant\fR with privilege separation:
|
|
.PP
|
|
Create user group (e.g., wpapriv) and assign users that
|
|
should be able to use wpa_supplicant into that group.
|
|
.PP
|
|
Create /var/run/wpa_priv directory for UNIX domain sockets and
|
|
control user access by setting it accessible only for the wpapriv
|
|
group:
|
|
.sp
|
|
.RS
|
|
|
|
.nf
|
|
mkdir /var/run/wpa_priv
|
|
chown root:wpapriv /var/run/wpa_priv
|
|
chmod 0750 /var/run/wpa_priv
|
|
.fi
|
|
.RE
|
|
.PP
|
|
Start \fBwpa_priv\fR as root (e.g., from system
|
|
startup scripts) with the enabled interfaces configured on the
|
|
command line:
|
|
.sp
|
|
.RS
|
|
|
|
.nf
|
|
wpa_priv -B -c /var/run/wpa_priv -P /var/run/wpa_priv.pid wext:wlan0
|
|
.fi
|
|
.RE
|
|
.PP
|
|
Run \fBwpa_supplicant\fR as non-root with a user
|
|
that is in the wpapriv group:
|
|
.sp
|
|
.RS
|
|
|
|
.nf
|
|
wpa_supplicant -i ath0 -c wpa_supplicant.conf
|
|
.fi
|
|
.RE
|
|
.SH "COMMAND ARGUMENTS"
|
|
.TP
|
|
\fB-c ctrl path\fR
|
|
Specify the path to wpa_priv control directory
|
|
(Default: /var/run/wpa_priv/).
|
|
.TP
|
|
\fB-B\fR
|
|
Run as a daemon in the background.
|
|
.TP
|
|
\fB-P file\fR
|
|
Set the location of the PID
|
|
file.
|
|
.TP
|
|
\fBdriver:ifname [driver:ifname ...]\fR
|
|
The <driver> string dictates which of the
|
|
supported \fBwpa_supplicant\fR driver backends is to be
|
|
used. To get a list of supported driver types see wpa_supplicant help
|
|
(e.g, wpa_supplicant -h). The driver backend supported by most good
|
|
drivers is \fBwext\fR\&.
|
|
|
|
The <ifname> string specifies which network
|
|
interface is to be managed by \fBwpa_supplicant\fR
|
|
(e.g., wlan0 or ath0).
|
|
|
|
\fBwpa_priv\fR does not use the network interface
|
|
before \fBwpa_supplicant\fR is started, so it is fine to
|
|
include network interfaces that are not available at the time wpa_priv
|
|
is started. wpa_priv can control multiple interfaces with one process,
|
|
but it is also possible to run multiple \fBwpa_priv\fR
|
|
processes at the same time, if desired.
|
|
.SH "SEE ALSO"
|
|
.PP
|
|
\fBwpa_supplicant\fR(8)
|
|
.SH "LEGAL"
|
|
.PP
|
|
wpa_supplicant is copyright (c) 2003-2007,
|
|
Jouni Malinen <j@w1.fi> and
|
|
contributors.
|
|
All Rights Reserved.
|
|
.PP
|
|
This program is dual-licensed under both the GPL version 2
|
|
and BSD license. Either license may be used at your option.
|