git: if_tun: Support to delegate per-interface /dev/tunN to normal users

[Aaron LI]

commit 9859887a3a7c492ceadbd08cc5c07ea776df924c
Author: Aaron LI <aly at aaronly.me>
Date:   Sat Oct 10 17:32:07 2026 +0800

    if_tun: Support to delegate per-interface /dev/tunN to normal users
    
    The tun(4) interface doesn't support a 'net.link.tap.user_open' like
    sysctl to allow normal users to use an created /dev/tunN, even this
    device node has been chown'ed for the user.  This made it impossible for
    a normal user to use a tun(4) interface, e.g., in 'ssh -w' as mentioned
    in commit 06d94267609af69188f670c64af6dce7c7dd45c9.
    
    To fix this limitation, remove the root privilege check on the
    per-interface /dev/tunN device nodes, so their access is determined by
    the file permissions.  Therefore, an admin can create an tun(4)
    interface and delegate it to a normal user by changing the ownership,
    e.g.,
    
        $ ifconfig tun0 create
        $ chown <user> /dev/tun0
    
    Note that the default ownership for /dev/tunN has been changed from uucp:
    dialer to root:wheel, avoiding the uucp user implicitly gaining access
    to the tun devices.
    
    The privilege requirement on the auto-cloning device /dev/tun remains
    unchanged; root is still required as before.

Summary of changes:
 share/man/man4/tun.4 | 132 ++++++++++++++++++++++++++++++++-------------------
 sys/net/tun/if_tun.c |  37 ++++++++++-----
 sys/sys/param.h      |   3 +-
 3 files changed, 110 insertions(+), 62 deletions(-)

http://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/9859887a3a7c492ceadbd08cc5c07ea776df924c


-- 
DragonFly BSD source repository