Arch Linux User Repository

Please remove replaces directive. Thank you. (No need to reply via comment; AUR now sends commit notifications.)

Please remove www. from the "hamachi" package URL That is, replace "https://www.vpn.net/installers /${pkgname}-${pkgver}-${filearch}.tgz" on "https://www.vpn.net/installers /${pkgname}-${pkgver}-${filearch}.tgz"

Having a www subdomain breaks SSL

I was a bit bothered by a closed source program running with full root priviledges and whole machine machine access, so I've improved the systemd service to significantly limit its capabilities to the necessary for it to function. This change should improve resilience against malicious functionality baked in the program, software bugs, and remote execution vulnerability attacks against it; of course due to its own nature the solution won't be bulletproof.

For the user that interfaces with it there should be no functionality changes and the program should behave as usual.

[Unit]
Description=LogMeIn Hamachi daemon
After=local-fs.target network.target

[Service]
ExecStart=/opt/logmein-hamachi/bin/hamachid
Type=forking

# unfortunately the program checks for UID instead of permissions
# so we cannot assign a non-root user
# User=logmein-hamachi
# DynamicUser=True

RuntimeDirectory=logmein-hamachi
StateDirectory=logmein-hamachi

# the program has /var/run hardcoded, we'll bind the path to make it happy
BindPaths=/var/run/logmein-hamachi
# this is necessary since the control socket is world RW
# and the program checks access rights by itself instead of relying on FS permissions
BindReadOnlyPaths=/etc/passwd

# necessary to create and control the virtual network card
CapabilityBoundingSet=CAP_NET_ADMIN
DeviceAllow=char-* rw

# minimum-ish set of operations to allow it to work on fs, network, ipc, etc
SystemCallFilter=@system-service
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6

# blacklist ALL the things!
NoNewPrivileges=True
LockPersonality=True
RestrictNamespaces=True
RemoveIPC=True
RestrictSUIDSGID=True
SystemCallArchitectures=native
# this is kinda dangerous if it really does it
# it's possible it uses it as some form of anti-reverse engineering
# needs further investigation
# MemoryDenyWriteExecute=True

PrivateTmp=True
PrivateMounts=True
ProtectSystem=strict
ProtectControlGroups=True
ProtectKernelLogs=True
ProtectKernelModules=True
ProtectKernelTunables=True
ProtectHome=True
ProtectProc=invisible
ProtectHostname=True
ProtectClock=True
RestrictRealtime=True

InaccessiblePaths=/home
InaccessiblePaths=/boot
InaccessiblePaths=/mnt
InaccessiblePaths=/srv
InaccessiblePaths=/dev/shm
TemporaryFileSystem=/etc:ro
TemporaryFileSystem=/run:ro
TemporaryFileSystem=/var:ro

[Install]
WantedBy=multi-user.target

I have occasional segfaults with this in glibc (2.31-2).

Stacktrace

I'm disowning the package because I no longer use Hamachi (switched to ZeroTier)

@panthar - No error, it's just not downloading. It could be a regional or an ISP problem - I connected to a VPN to try downloading it and it worked.

@linwer - I just tested and it installed fine with the current PKGBUILD. What error are you receiving?

Hi! Please update the PKGBUILD. https://www.vpn.net/installers/logmein-hamachi-2.1.0.198-x64.tgz no longer works, you have to use https://vpn.net/installers/logmein-hamachi-2.1.0.198-x64.tgz without www instead.

Thanks for doing that. Anyone else experiencing this problem should switch to the "logmein-hamachi-beta" package. If enough people are affected by it, we can look at updating this PKGBUILD as well.