Option for not Generating Keyfiles in wg2nd

[flu0r1ne]

Generating keyfiles would be nice as an option (or perhaps NOT generating keyfiles as a --nokeys option & using PresharedKey / PrivateKey embedded in the netdev file). This would reduce the number of configuration files & leave a single netdev file to set permissions on. This --nokeys option would also allow configuration to be created locally without incorrect key paths.

Contributed by @itoffshore on aurweb

[flu0r1ne]

This would be a good edition and perhaps a better default. Implementing this would require that restrictive permissions be placed on the netdev configuration file.

[itoffshore]

forcing users to run wg2nd as root is probably the best option - so the netdev configuration is always created with secure permissions.

[flu0r1ne]

When writing secure files, such as keyfiles, they are assigned the ownership root:systemd and the access mode 640. Currently, I use libcap to ensure users possess the necessary permissions for these operations, as some constrained environments limit user capabilities.

wg2nd/src/main.cpp

Lines 234 to 247 in 50df8f9

	// Change ownership to root:systemd-network
	struct group *grp;
	grp = getgrnam("systemd-network");
	if (grp == nullptr) {
	die_errno("Failed to find the 'systemd-network' group");
	}
	if (chown(full_path.c_str(), 0, grp->gr_gid) != 0) {
	die_errno("Failed to change ownership of file %s", full_path.c_str());
	}
	// Set permissions
	if (chmod(full_path.c_str(), S_IRUSR | S_IWUSR | S_IRGRP) != 0) {
	die_errno("Failed to set permissions for file %s", full_path.c_str());
	}

wg2nd/src/main.cpp

Lines 385 to 393 in 50df8f9

	// Print nice error message if the user does not have the required permissions
	if(cap_get_flag(current_cap, cap, CAP_PERMITTED, &is_set)) {
	goto die_cap_failure;
	}
	if(is_set != CAP_SET) {
	char * name = cap_to_name(cap);
	die("Failed to obtain capability \"%s\": do you need to elevate permissions?", name);
	}

I was pointing out the fact that wg2nd currently creates world-readable configuration files because they do not contain any sensitive information. That would have to change.