Skip to content

Permissions

The following aspects of skywire require elevated or special permissions:

VPN Applications

Both VPN client and server require special permissions for network configuration.

VPN Client

The VPN client requires the CAP_NET_ADMIN capability to create and configure TUN/TAP network interfaces.

Method 1: Using setcap (Recommended) 

# Grant CAP_NET_ADMIN capability to the skywire binary
sudo setcap cap_net_admin+eip /path/to/skywire

# Verify the capability was set
getcap /path/to/skywire
# Should output: /path/to/skywire cap_net_admin=eip

Method 2: Running as root 

sudo skywire visor

SkyDNS

SkyDNS (the skydns app) lets every program on the computer open .dmsg and .skynet names. It answers those names on a tun of its own, so it needs CAP_NET_ADMIN too, and systemd-resolved sends it only the dmsg and skynet zones.

  • With CAP_NET_ADMIN (a root visor, or setcap as above) it creates its tun on each start and removes it on exit.
  • Without it it asks for a password once, through pkexec, and sets up a persistent tun named skydns0 owned by the visor's user. Later starts open that tun and do not ask again. Remove it with sudo ip link delete skydns0. This mode needs systemd-resolved.

The dev loop (scripts/dev-visor-loop.sh) reinstalls the binary on every start, which drops a setcap. Its header shows a sudoers rule that lets it put the capability back after each build.

VPN Server

The VPN server requires elevated privileges to execute iptables and sysctl commands for: - Configuring iptables FORWARD policy - Enabling IP masquerading (NAT) - Setting IP forwarding (IPv4/IPv6) - Managing firewall rules for client traffic

Method 1: Configure sudoers (Recommended for systemd services) 

# Add to /etc/sudoers.d/skywire-vpn
yourusername ALL=(ALL) NOPASSWD: /usr/sbin/iptables, /usr/sbin/ip6tables, /usr/sbin/sysctl

Method 2: Using setcap for network administration 

# Grant CAP_NET_ADMIN and CAP_NET_RAW capabilities
sudo setcap cap_net_admin,cap_net_raw+eip /path/to/skywire

Method 3: Running as root 

sudo skywire visor

Note for systemd services: When running skywire as a systemd service (non-interactive), pkexec cannot prompt for authentication. Use the sudoers method or run the service as root.

Other Permissions

  • File system access: Writing to the local folder path and default config paths generated by linux/macOS packages or windows .msi installer.
  • System survey: Some aspects require elevated access — only generated if a reward address is set.

See mainnet_rules.md for more details about the system survey and eligibility requirements for rewards.