When adding third-party sources for resolv.conf entries
(e.g., radns, http://hack.org/mc/hacks/radns/ )
it's desirable for a non-root user to be able to invoke resolvconf.

Locally I've created a `resolvconf' group and made /etc/resolvconf/run
owned by and group-writable by that group.  I can then give permission to
run resolvconf to other users by adding them to that group.

First, thanks for the report.


Giving users permissions to write in the target of /etc/resolvconf/run
is find so far as the /sbin/resolvconf and /etc/resolvconf/update.d/libc
is concerned.  But other hook scripts in /etc/resolvconf/update(-libc).d/
generally need to be run by root.


/etc/resolvconf/run is usually a symbolic link to another location,
by default /run/resolvconf.  So it is /run/resolvconf that has to be
owned by the "resolvconf" group.  I presume this is what you meant.

What do you think should be done to the resolvconf package to make
it easier to set up your mode of operation?

Do you think that others are likely to want to operate resolvconf this way?
Why?

Package: resolvconf
Version: 1.79
Followup-For: Bug #638393

dhcpcanon is an example of a DHCP client that runs as a non-root user (via systemd service or wrapper) and it's able to set the network because it has the CAP_NET_ADMIN capability, but it can't set the DNS servers because resolvconf requires root.

So, i also think it would be desirable for a non-root user to be able to invoke resolvconf.

ju

I've just published https://github.com/dkg/resolvconf-admin, which is a
setuid helper program, which could allow a non-root user to invoke
resolvconf.

I welcome any review of it.  I'm willing to package it for debian if
this is something that people would find useful.

I personally prefer to just use systemd-resolved these days.

I've just published https://github.com/dkg/resolvconf-admin, which is a
setuid helper program, which could allow a non-root user to invoke
resolvconf.

I welcome any review of it.  I'm willing to package it for debian if
this is something that people would find useful.

I personally prefer to just use systemd-resolved these days.

an RFP (#875874) was filed, and i've now packaged resolvconf-admin for
debian, and it's in unstable.

Systems that want to enable some non-priv users to run resolvconf as
non-root should be able to use that.  Perhaps that means this bug report
can be closed by updating the resolvconf documentation to refer to this
mechanism?

If the resolvconf developers prefer a different approach, or see any
problems with resolvconf-admin, please report bugs, either in the debian
BTS or at https://github.com/dkg/resolvconf-admin.

this remains true. :)

an RFP (#875874) was filed, and i've now packaged resolvconf-admin for
debian, and it's in unstable.

Systems that want to enable some non-priv users to run resolvconf as
non-root should be able to use that.  Perhaps that means this bug report
can be closed by updating the resolvconf documentation to refer to this
mechanism?

If the resolvconf developers prefer a different approach, or see any
problems with resolvconf-admin, please report bugs, either in the debian
BTS or at https://github.com/dkg/resolvconf-admin.

this remains true. :)