Access to physical network interface as user, as non-root

Incus
1

That is executed by which user?

I’m asking because I can do

incus launch images:ubuntu/resolute/cloud u26

or

sudo incus launch images:ubuntu/resolute/cloud u26 --network eno1

without errors. The error I get:

$ incus launch images:ubuntu/resolute/cloud u26 --network eno1
Launching u26
Error: Failed loading network "eno1": Network not found
$

My actual question is probably How to allow user to access physical NIC? and might be an unreasonable question.

2

“–network” is for managed networks, not for physical ones.

I’m pretty sure “physical” is not what you want, routed or macvlan maybe?

Please describe your goals and I might be able to help you reach them.

3

Don’t focus too much on my example. My only goal was to explain the problem with DHCP in the clients.

What I didn’t explain in these examples is that I had switched the remote to another server.

$ incus remote switch myremote

So now I can run incus commands with full access on myremote. This basically comes down to doing a sudo incus on that server.

You can imagine that a regular (non-root) user cannot just get full access to a network device.

4

I’m not sure why you want to get full access to the network device as a regular user. What’s the Use Case?

5

Look at incus project list

The behavior you’re describing is consistent with your user being a member of the incus group but not the incus-admin group. In this scenario, your user gets access to a per-user project with limited access to the overall system, effectively to prevent an easy privilege escalation.

If that’s the case, you’ll see your user only seeing a user-1000 or similar project whereas doing the same incus project list as root will show you both the default and user-1000 projects.

If you intend for your user to have full Incus access, add them to the incus-admin group, logout and log back in, then check incus project list again, if the default project correctly shows up in there, you can switch to it as your default with incus project switch default.

6

Yes, “consider to add user account to the incus-admin group” was the clue I was hoping for.

Thanks.