hippotat-setup-permissions(8)

💖 hippotat-setup-permissions 💖

okay bestie, welcome to hippotat-setup-permissions(8) — the little helper script that sorts out permissions so you don't have to run hippotat as root. it lives in section 8 of the manual, which is where all the sysadmin-y baddies hang out. 👑

---

✨ NAME ✨

hippotat-setup-permissions — set up permissions for (non-root) use of hippotat 🫶

---

✨ SYNOPSYS ✨

(yes it's spelled that way in the original, we don't make the rules 💅)

hippotat-setup-permissions client
hippotat-setup-permissions server
hippotat-setup-permissions revoke

---

✨ DESCRIPTION ✨

this script sets up — or revokes — the permissions that let hippotat and/or hippotatd actually run. it's giving gatekeeper energy. 🚪✨

with server, the permissions the server needs get granted to the _hippotat user — or whatever other user you set with USER in /etc/default/hippotat.

with client, the permissions the client needs get granted to the _hippotat group — or whatever other group you set with GROUP in /etc/default/hippotat.

which permissions are actually required? that gets figured out from the hippotat config in /etc/hippotat. 🧠 (the hippotat or hippotatd program is run in a special mode just to go query that config. sneaky but iconic.)

and here's the part that's lowkey important: every single run revokes the permissions that previous invocations of this script granted to the configured user and/or group, if those permissions aren't needed anymore according to the config and the command line. so:

• revoke revokes all the permissions 🌪️
• client and server each revoke the other 🙈

heads up bestie: only the permissions granted in the specific files that this script uses will be amended or revoked. it stays in its own lane, fr fr.

---

✨ FILES ✨

• /etc/userv/ipif-access/hippotat gives the right user or group the ability to make the virtual network interfaces, and to route traffic to them. created on both clients and servers. 🦋
• /etc/authbind/byuid/uid gives the server the ability to bind to the configured ports and addresses. the uid is the one for the _hippotat user, or USER. created on servers. 🔥
• /etc/userv/services.d/ipif enables the ipif userv service, which is itself controlled by /etc/userv/ipif-access/ etc.

it will be made a symlink to /etc/userv/services-available/ipif. created on both clients and servers. it does not get removed during revocation, because other programs on the system might still need it. 😌

makes the symlink in .

(this is not undone by revoke, since that might disturb other services which are relying on it. so, yeah, it stays. periodt.)

• /etc/default/hippotat a shell script fragment sourced by the init script, by hippotat-setup-permissions, and by the hippotatd init script. it can set USER and GROUP (plus other variables that control the init script). 🎀

---

🌈 SEE ALSO 🌈

(okay there's no SEE ALSO section in this one, but if you're here you're probably deep in the hippotat lore already, iykyk 💜)

---

🎀 and that's the whole page! 💖 thanks for reading, bestie, you ate. ✨

this cutie was brought to you by perl v5.40.1 and Hippotat — go off, hippotat-setup-permissions(8). 👑🌸