hyperident-gateway / setup-capabilities.sh

#!/bin/bash
# Setup script to grant CAP_NET_ADMIN capability to bare executable
# This allows bare to create TUN devices without requiring sudo

set -e

echo "🔧 Hyperident Gateway - Capability Setup"
echo "========================================="
echo ""
echo "This script will grant the CAP_NET_ADMIN capability to the bare executable."
echo "This allows creating TUN devices without running the entire program as root."
echo ""

# Make sure we're using Node v20
export NVM_DIR="$HOME/.nvm"
[ -s "$NVM_DIR/nvm.sh" ] && \. "$NVM_DIR/nvm.sh"
nvm use 20 > /dev/null 2>&1

# Find bare wrapper script
BARE_WRAPPER=$(which bare)

if [ -z "$BARE_WRAPPER" ]; then
    echo "❌ Error: bare executable not found"
    echo "   Install with: npm install -g bare"
    exit 1
fi

# Find the actual bare runtime binary (ELF executable, not the Node.js wrapper)
BARE_DIR=$(dirname "$(dirname "$BARE_WRAPPER")")/lib/node_modules/bare
BARE_PATH="$BARE_DIR/node_modules/bare-runtime-linux-x64/bin/bare"

if [ ! -f "$BARE_PATH" ]; then
    echo "❌ Error: Could not find bare runtime binary"
    echo "   Wrapper at: $BARE_WRAPPER"
    echo "   Expected binary at: $BARE_PATH"
    exit 1
fi

# Verify it's an ELF binary
if ! file "$BARE_PATH" | grep -q "ELF.*executable"; then
    echo "❌ Error: $BARE_PATH is not an ELF executable"
    exit 1
fi

echo "Found bare wrapper at: $BARE_WRAPPER"
echo "Found bare runtime at: $BARE_PATH"
echo ""

# Check if already has capability
CURRENT_CAPS=$(getcap "$BARE_PATH" 2>/dev/null || echo "none")
echo "Current capabilities: $CURRENT_CAPS"
echo ""

# Find ip command
IP_PATH=$(which ip)
if [ -z "$IP_PATH" ]; then
    echo "❌ Error: 'ip' command not found"
    echo "   Install with: apt-get install iproute2"
    exit 1
fi

echo "Found ip command at: $IP_PATH"
echo ""

# Check if we need sudo
if [ "$EUID" -ne 0 ]; then
    echo "⚠️  This script requires sudo privileges to set capabilities."
    echo "   You will be prompted for your password."
    echo ""

    # Set capabilities on both bare and ip
    echo "Setting CAP_NET_ADMIN on bare runtime..."
    sudo setcap cap_net_admin+ep "$BARE_PATH"

    echo "Setting CAP_NET_ADMIN on ip command..."
    sudo setcap cap_net_admin+ep "$IP_PATH"
else
    # Already running as root
    setcap cap_net_admin+ep "$BARE_PATH"
    setcap cap_net_admin+ep "$IP_PATH"
fi

# Verify capabilities were set
BARE_CAPS=$(getcap "$BARE_PATH")
IP_CAPS=$(getcap "$IP_PATH")

echo ""
echo "✅ Capabilities set successfully!"
echo ""
echo "Bare runtime:"
echo "   $BARE_CAPS"
echo ""
echo "IP command:"
echo "   $IP_CAPS"
echo ""
echo "You can now run the gateway without sudo:"
echo "   bare test/test-utun.js"
echo "   bare gateway.js"
echo ""
echo "To remove these capabilities later, run:"
echo "   sudo setcap -r $BARE_PATH"
echo "   sudo setcap -r $IP_PATH"
echo ""