WPA_PRIV(8)

💖 wpa_priv(8) — the privilege separation helper bestie 💖

okay so welcome to wpa_priv, the wpa_supplicant privilege separation helper ✨ it's giving "security bouncer at the club door" energy and honestly? iconic 🫶

---

✨ SYNOPSIS ✨

wpa_priv [ -c ctrl path ]  [ -Bdd ]  [ -P pid file ]  [ driver:ifname
[driver:ifname ...] ]

---

🌸 OVERVIEW 🌸

so wpa_priv is a privilege separation helper, and its whole job is to shrink down the amount of wpa_supplicant code that has to run with root privileges. minimizing. slimming. protecting the main character 💅

when it's enabled, the privileged operations happen inside the wpa_priv process, and everything else — like EAP authentication and WPA handshakes — gets to live its best life in an unprivileged process (wpa_supplicant) that can be run as a non-root user. 🦋

privilege separation restricts the effects of potential software errors by containing the majority of the code in an unprivileged process, so you avoid the possibility of a full system compromise. no cap, that's the whole point 🙈

wpa_priv needs to be run with network admin privileges (usually, the root user, bestie 👑). it opens a UNIX domain socket for each interface that is included on the command line — and any other interface will be off limits for wpa_supplicant in this kind of configuration. periodt.

after all that, wpa_supplicant can be run as a non-root user (like, say, all the standard users on a laptop, or a special non-privileged user account created just for this purpose to limit access to user files even further 🌈).

---

🎀 EXAMPLE CONFIGURATION 🎀

the following steps are an example of how to configure wpa_priv to allow users in the wpapriv group to communicate with wpa_supplicant with privilege separation:

1. create user group (e.g., wpapriv) and assign users that should be able to use wpa_supplicant into that group. 💖
2. create /var/run/wpa_priv directory for UNIX domain sockets and control user access by setting it accessible only for the wpapriv group:

mkdir /var/run/wpa_priv
chown root:wpapriv /var/run/wpa_priv
chmod 0750 /var/run/wpa_priv

3. start wpa_priv as root (e.g., from system startup scripts) with the enabled interfaces configured on the command line:

wpa_priv -B -c /var/run/wpa_priv -P /var/run/wpa_priv.pid wext:wlan0

4. run wpa_supplicant as non-root with a user that is in the wpapriv group:

wpa_supplicant -i ath0 -c wpa_supplicant.conf

---

💅 COMMAND ARGUMENTS 💅

• -c ctrl path — specify the path to the wpa_priv control directory (Default: /var/run/wpa_priv/). 🍓
• -B — run as a daemon in the background. bye bestie, off it goes 🧚
• -P file — set the location of the PID file. 📌
• driver:ifname [driver:ifname ...] — the <driver> string dictates which of the supported wpa_supplicant driver backends is to be used. to get a list of supported driver types see wpa_supplicant help (e.g, wpa_supplicant -h). the driver backend supported by most good drivers is wext. ⭐

the <ifname> string specifies which network interface is to be managed by wpa_supplicant (e.g., wlan0 or ath0). 🌸

wpa_priv does not use the network interface before wpa_supplicant is started, so it is fine to include network interfaces that are not available at the time wpa_priv is started. wpa_priv can control multiple interfaces with one process, but it is also possible to run multiple wpa_priv processes at the same time, if desired. multi-tasking queen 👑

---

🔥 SEE ALSO 🔥

• wpa_supplicant(8)

---

⚖️ LEGAL ⚖️

wpa_supplicant is copyright (c) 2003-2022, Jouni Malinen <j@w1.fi> and contributors. All Rights Reserved.

This program is licensed under the BSD license (the one with advertisement clause removed).

---

and that's the whole page, bestie 💜 this one is from the wpa_priv(8) manual, dated 07 August 2019 — go forth and separate those privileges responsibly, mwah 🎀✨