Bug 57069 - breaks /dev/net/tun permissions
Summary: breaks /dev/net/tun permissions
Status: NEW
Alias: None
Product: Sisyphus
Classification: Development
Component: tunctl (show other bugs)
Version: unstable
Hardware: all Linux
: P5 blocker
Assignee: Nobody's working on this, feel free to take it
QA Contact: qa-sisyphus
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2025-11-29 18:18 MSK by Sergey Vlasov
Modified: 2025-11-29 18:18 MSK (History)
0 users

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Sergey Vlasov 2025-11-29 18:18:30 MSK 
При установленном пакете tunctl переопределяются права доступа к /dev/net/tun:

/lib/udev/rules.d/50-udev-default.rules:KERNEL=="tun", MODE="0666", OPTIONS+="static_node=net/tun"
/lib/udev/rules.d/90-tun.rules:KERNEL=="tun", GROUP="tun" MODE="0660"

С такими настройками не работает, например, NetworkManager-openconnect:

NetworkManager[1265]: <info>  [1764420364.8055] manager: (vpn0): new Tun device (/org/freedesktop/NetworkManager/Devices/7)
NetworkManager[12688]: Connected to xxx.xxx.xxx.xxx:443
NetworkManager[12688]: SSL negotiation with SERVER.NAME
NetworkManager[12688]: Server certificate verify failed: signer not found
NetworkManager[12688]: Connected to HTTPS on SERVER.NAME with ciphersuite (TLS1.2)-(ECDHE-SECP256R1)-(RSA-SHA512)-(AES-256-GCM)
NetworkManager[12688]: Got CONNECT response: HTTP/1.1 200 OK
NetworkManager[12688]: CSTP connected. DPD 30, Keepalive 20
NetworkManager[12688]: Established DTLS connection (using GnuTLS). Ciphersuite (DTLS1.2)-(ECDHE-RSA)-(AES-256-GCM).
NetworkManager[12688]: Configured as yyy.yyy.yyy.yyy, with SSL connected and DTLS connected
NetworkManager[12688]: Session authentication will expire at Sat Dec 13 15:46:04 2025
openconnect[12688]: Failed to open tun device: Отказано в доступе
openconnect[12688]: Set up tun device failed
openconnect[12688]: Send BYE packet: Set up tun device failed
openconnect[12688]: Unrecoverable I/O error; exiting.

Сейчас пакет tunctl, похоже, никому не нужен, но может присутствовать в качестве окаменелости в давно установленных системах (зависимость на него присутствовала в etcnet < 0.9.10-alt19).  Возможно, следует его закопать (всё, что может эта утилита, должен уметь ip tuntap) и занести в remove-obsoleted-packages.  Ну либо возрождать https://lists.altlinux.org/pipermail/devel/2007-March/135940.html для параноиков.