Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Remove redundant command from README.md #38

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
+0 −1
Open

Remove redundant command from README.md #38

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 0 additions & 1 deletion README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -72,7 +72,6 @@ sudo ${HOMEBREW_PREFIX}/opt/socket_vmnet/bin/socket_vmnet --vmnet-gateway=192.16

To install the launchd service:
```bash
brew tap homebrew/services
# sudo is necessary for the next line
sudo ${HOMEBREW_PREFIX}/bin/brew services start socket_vmnet
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We have this warning:

Warning
Typically, the socket_vmnet binary in the ${HOMEBREW_PREFIX} can be replaced by any user in the admin group.

I think the issue is worse. The socket_vmnet executable can be replaced by a program you run. Some program or script that you run as your user (without sudo) can replace socket_vmnet executable. Then when it is run by lima, the replaced executable run as root.

So the real fix is to remove the brew service instructions, they are unsafe.

If we want to give instructions, they must include all the commands to make running the brew version safe:

  • Change ownership (recursively) of the directory where socket_vmnet is installed
  • Create safe directory for the socket and logs
  • Fixing ownership to make brew upgrade work

With these changes the brew "easy" solution is not so attractive.

I don't think this can be fixed without installing the files as root, like other package managers.

Copy link
Member

@jandubois jandubois Sep 19, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think this can be fixed without installing the files as root, like other package managers.

I think this is correct. For that reason we used to require that the daemon files are owned by root. But that requirement has been softened in #1220 for the benefit of Homebrew users.

It creates a vulnerability that allows programs run by the admin user to escalate to root privileges without getting a sudo prompt.

So installing socket_vmnet with brew is not a good idea if you would have qualms about enabling password-less sudo.

```
Expand Down