Privilege Escalation

Privilege Escalation

Rancher Desktop has various needs to run as a privileged user, typically platform-specific:

Windows

• (Installer) Install WSL
• (Installer) Update WSL kernel
• Writing to C:\Windows\system32\drivers\etc\hosts
• Custom networking?

macOS

• Install vde_vmnet tools
• Run vde_vmnet tools (sudoers file)
• Create /private/var/run/rancher-desktop-lima
  • This gets deleted every boot
  • Use /var/run directly, with prefix?
• /etc/paths.d management
• Create docker socket symlink
• Self-updating of setuid helper
  • Are the SUSE certs (per-dev) using the same cert?

Linux

• Create docker socket symlink
• Custom networking

Desired State

• Privilege escalation is only needed at install time
  • For macOS / Linux AppImage, this may be an optional component installed separately.
• The application can still run without privilege escalation with a reduced feature set.
  • E.g. fall back to SLIRP-only networking on macOS.

Implementation Strategies

sudo

• Only applicable on macOS / Linux
• Issues around conflicting sudoers configuration
• Not great for admin access

LaunchDaemon

• macOS only
• Single prompt to install
• socket activation
  • include which interface to use in the request?
• Convention seems to be to drop the executable in /Library/PrivilegedHelperTools/
• Maybe use SMJobBless instead?

Privileged helper

• macOS/Linux: setuid binary
  • Need to hard-code things, but should be safe with adequate checking
• Windows: privileged service
  • Requires Administrator access to install
  • Also need it for uninstall
• Needs to grant privilege escalation every time RD updates (new binary)

Planning

• Ignore Windows for now
• Make lima.ts fall back when no privileged access
• === release checkpoint here ===
• Temporarily introduce a (hidden) setting to disable privileged access
• Use a setuid helper on macOS / Linux
• Hack up lima to not use sudo
• Remove setting, check setuid bit on helper instead