Arch Linux User Repository

Hi @Nu4425, thanks a lot for your feedback!

Regarding your questions:

• The package source -- no particular reason, except that I simply used Ubuntu focal to source the .debs. As you may see in the comment history below, there were some issues with package signatures when it was done a bit more clever, which these specific URLs done have. I think that's related to the issue that you mention. As such, what I'm doing right now is simply copy the MD5 and url from Ubuntu Focal, and keep it simple.

• The systemd service -- the actual systemd service file comes from Cloudflare themselves, and I haven't done any modification to it. I believe this is in line with Arch's overall strategy to package maintenance.

As for your specific proposal, I think warp-svc needs to be able to do some pretty "root user" level stuff: among other things, creating new network devices for the wireguard tunnel. There's probably a way to harden this in order ways, though.

I would be interested in hearing the thoughts of other users of this package, as my assumptions may be wrong. Would be happy to make changes if this were the case.

@solatis @glitsj16 @sl1pkn07, after looking into it I found that it may be possible to harden warp-svc through systemd

See https://wiki.archlinux.org/title/Systemd#Sandboxing_application_environments for more information and man systemd.exec for the flags that can be applied

Basically, to force the service to run as a non-root user: 1) sudo systemctl edit warp-svc.service 2) add

[Service] 
User=USERNAME

where USERNAME is your user

@solatis is there any specific reason why you chose to reference https://pkg.cloudflareclient.com/pool/dists/focal/main/cloudflare_warp_2021_12_0_1_amd64_2dae41e61d_amd64.deb than https://pkg.cloudflareclient.com/uploads/cloudflare_warp_2021_12_0_1_amd64_2dae41e61d.deb?

The source for the latter is more tracable which makes it more transparent. Also, for some reason, the resulting digests are different despite both being for the same distribution release (focal).

@solatis same with sudo

i have summited a tiket with

sudo warp-diag
sudo warp-diag feedback

about w/o sudo. delete, register, settings and others options works with my user, so i think is not problem with the client or service iself

@solatis Indeed, this is not a regular user application and will need to be handled as such. Pretty much standard stuff for system daemons. AFAIK only upstream could change this, so I don't think you can do much more than adding another note to stress this in the cloudflare-warp-bin.install file.

Right, that makes sense; it’s also unlikely to be able add all the network interfaces, etc without root permissions.

Is there anything I can add to the package to improve this?

@solatis The second option you mention isn't going to work. systemd uses a strict seperation between system and user services (reflected in the filesystem). /usr/lib/systemd/system/warp-svc.service isn't accessible via systemctl --user start warp-svc. IMO all the warp binaries are designed to be run as root with sudo...

@sl1pkno07 I think what's going on is that warp-cli tries to access files in /var/lib/cloudflare-warp/ , which are owned by root.

Two options:

1. Run warp-cli as root.

2. Launch the systemd service using your normal user account, i.e. systemctl start --user warp-svc. I haven't tested this, but should work.

Could you check the permissions of your systemd service?

sudo systemctl status warp-svc

There's a chance that something changed upstream in the systemd unit that caused a regression.

Hello guys. I'm totally new to manjaro and linux and need help here. so I build the package and go to terminal and perform warp-cli register but the system keep telling me Unable to connect to CloudflareWARP daemon. Maybe the daemon is not running, or is connected to another process? what should I do? since I live in Iran I really need the warp for accessing free internet. any help would be highly appreciated