OpenVPN cannot start in unprivileged mode via systemctl

shau-kote

Hello.

I set up OpenVPN on my VPS (Fedors 23) and I faced with problem starting OpenVPN via systemctl.
As long as I want to run my OpenVPN server unprivileged, I folllowed official howto: I created corresponding executable sctipt unpriv-ip, added iproute, user and group directives in server config and configured sudo accordingly.

All configuration works fine while I start and stop my OpenVPN server manually.
But when I try start OpenVPN server via systemctl it fails:

[shau-kote@myvps ~]$ sudo systemctl start openvpn@server.service 
[shau-kote@myvps ~]$ sudo systemctl status openvpn@server.service 
● openvpn@server.service - OpenVPN Robust And Highly Flexible Tunneling Application On myvps/tcp
   Loaded: loaded (/usr/lib/systemd/system/openvpn@.service; disabled; vendor preset: disabled)
   Active: failed (Result: exit-code) since Sat 2015-12-12 04:11:22 UTC; 9s ago
  Process: 943 ExecStart=/usr/sbin/openvpn --daemon --writepid /var/run/openvpn/%i.pid --cd /etc/openvpn/ --config %i.conf (code=exited, status=0/SUCCESS)
 Main PID: 944 (code=exited, status=1/FAILURE)

Dec 12 04:11:21 myvps openvpn[944]: ROUTE_GATEWAY 188.166.64.1/255.255.192.0 IFACE=eth0 HWADDR=04:01:8c:17:c3:01
Dec 12 04:11:22 myvps openvpn[944]: TUN/TAP device tun0 opened
Dec 12 04:11:22 myvps openvpn[944]: TUN/TAP TX queue length set to 100
Dec 12 04:11:22 myvps openvpn[944]: do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Dec 12 04:11:22 myvps openvpn[944]: /usr/local/sbin/unpriv-ip link set dev tun0 up mtu 1500
Dec 12 04:11:22 myvps openvpn[944]: Linux ip link set failed: could not execute external program
Dec 12 04:11:22 myvps openvpn[944]: Exiting due to fatal error
Dec 12 04:11:22 myvps systemd[1]: openvpn@server.service: Main process exited, code=exited, status=1/FAILURE
Dec 12 04:11:22 myvps systemd[1]: openvpn@server.service: Unit entered failed state.
Dec 12 04:11:22 myvps systemd[1]: openvpn@server.service: Failed with result 'exit-code'.
[shau-kote@myvps ~]$

I definitely do not see what the problem and I will be very grateful if someone expain me why it happens.

This is my openvpn@.service (default) and server config, if someone need it.

P.S.
While I googled about this problem I found bug report in Debian Bug tracking system with the same problem. There is no solution there alack.

P.P.S.
Also I asked a question on ServerFault. Some user offered me an ugly hack with sleep 5 in unpriv-ip script. It seemed like a solution, but later I found out that despite clean starting server service, client can not connect to server with "Connection refused". So that it is not solution.

Traffic

OpenvVPN provides --user and --group directives to drop privileges from within the openvpn process.

This is a much simpler solution.

Also, you may find that enabling --script-security within the server config will help.

See --script-security, --user and --group in The Manual v23x

shau-kote

Traffic, thank you for reply.

I thought --user and --group command-line directives and user and group config files directives are absolutely identical, aren't they?

The script-security in server config unfortunately changes nothing in failing at start:

[shau-kote@myvps ~]$ sudo grep script-security /etc/openvpn/server.conf 
script-security 2
[shau-kote@myvps ~]$ sudo systemctl start openvpn@server.service 
[shau-kote@myvps ~]$ sudo systemctl status openvpn@server.service 
● openvpn@server.service - OpenVPN Robust And Highly Flexible Tunneling Application On myvps/tcp
   Loaded: loaded (/usr/lib/systemd/system/openvpn@.service; disabled; vendor preset: disabled)
   Active: failed (Result: exit-code) since Sat 2015-12-12 22:19:05 UTC; 3s ago
  Process: 932 ExecStart=/usr/sbin/openvpn --daemon --writepid /var/run/openvpn/%i.pid --cd /etc/openvpn/ --config %i.conf (code=exited, status=0/SUCCESS)
 Main PID: 933 (code=exited, status=1/FAILURE)

Dec 12 22:19:05 myvps openvpn[933]: ROUTE_GATEWAY 188.166.64.1/255.255.192.0 IFACE=eth0 HWADDR=04:01:8c:17:c3:01
Dec 12 22:19:05 myvps openvpn[933]: TUN/TAP device tun0 opened
Dec 12 22:19:05 myvps openvpn[933]: TUN/TAP TX queue length set to 100
Dec 12 22:19:05 myvps openvpn[933]: do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Dec 12 22:19:05 myvps openvpn[933]: /usr/local/sbin/unpriv-ip link set dev tun0 up mtu 1500
Dec 12 22:19:05 myvps openvpn[933]: Linux ip link set failed: could not execute external program
Dec 12 22:19:05 myvps openvpn[933]: Exiting due to fatal error
Dec 12 22:19:05 myvps systemd[1]: openvpn@server.service: Main process exited, code=exited, status=1/FAILURE
Dec 12 22:19:05 myvps systemd[1]: openvpn@server.service: Unit entered failed state.
Dec 12 22:19:05 myvps systemd[1]: openvpn@server.service: Failed with result 'exit-code'.
[shau-kote@myvps ~]$

shau-kote

Traffic, thank you for reply.

I thought --user and --group command-line directives and user and group config file directives are identical, aren't they?

I had tried to add script-security 2 in server config, but unfortunately it changes nothing:

[shau-kote@myvps openvpn]$ sudo grep script-security server.conf
script-security 2
[shau-kote@myvps openvpn]$ sudo systemctl start openvpn@server.service
[shau-kote@myvps openvpn]$ sudo systemctl status openvpn@server.service
● openvpn@server.service - OpenVPN Robust And Highly Flexible Tunneling Application On myvps/tcp
Loaded: loaded (/usr/lib/systemd/system/openvpn@.service; disabled; vendor preset: disabled)
Active: failed (Result: exit-code) since Thu 2015-12-17 13:30:07 UTC; 5s ago
Process: 2939 ExecStart=/usr/sbin/openvpn --daemon --writepid /var/run/openvpn/%i.pid --cd /etc/openvpn/ --config %i.conf (code=exited, status=0/SUCCESS)
Main PID: 2940 (code=exited, status=1/FAILURE)

Dec 17 13:30:07 myvps openvpn[2940]: ROUTE_GATEWAY 188.166.64.1/255.255.192.0 IFACE=eth0 HWADDR=04:01:8c:17:c3:01
Dec 17 13:30:07 myvps openvpn[2940]: TUN/TAP device tun0 opened
Dec 17 13:30:07 myvps openvpn[2940]: TUN/TAP TX queue length set to 100
Dec 17 13:30:07 myvps openvpn[2940]: do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Dec 17 13:30:07 myvps openvpn[2940]: /usr/local/sbin/unpriv-ip link set dev tun0 up mtu 1500
Dec 17 13:30:07 myvps openvpn[2940]: Linux ip link set failed: could not execute external program
Dec 17 13:30:07 myvps openvpn[2940]: Exiting due to fatal error
Dec 17 13:30:07 myvps systemd[1]: openvpn@server.service: Main process exited, code=exited, status=1/FAILURE
Dec 17 13:30:07 myvps systemd[1]: openvpn@server.service: Unit entered failed state.
Dec 17 13:30:07 myvps systemd[1]: openvpn@server.service: Failed with result 'exit-code'.
[shau-kote@myvps openvpn]$

Unluckily I still don't see any solution.

Traffic

The Arch Wiki is good for systemd unit files:
https://wiki.archlinux.org/index.php/Systemd

but .. i don't think you can achieve your goal as openvpn requires root access to start
(and stop; and add routes and ip addresses etc)

shau-kote

Traffic wroteThe Arch Wiki is good for systemd unit files:
https://wiki.archlinux.org/index.php/Systemd

Yes, I've read it. But default OpenVPN systemd unit in Fedora is very direct and clear (I posted it in the first post). It should work as far as I see.

Traffic wrote but .. i don't think you can achieve your goal as openvpn requires root access to start
(and stop; and add routes and ip addresses etc)

Yes, but OpenVPN do this actions by ip. Therefore I've set it up to run ip via sudo.
Thus OpenVPN can start and stop while it is running as non-root.
And it works perfectly without systemd.
Sticking point is systemd but I don't see why.

Traffic

shau-kote wroteit works perfectly without systemd

can you post details of this ?

shau-kote

Yes, of course.

Here is my console output of OpenVPN when I start it manually.
I've started OpenVPN server, connected to it, disconnected from it and stopped it.
Just for clarity I've severed the output stream by comments.

# starting the server

[shau-kote@myvps openvpn]$ sudo openvpn server.conf 
Tue Dec 29 21:40:40 2015 OpenVPN 2.3.8 x86_64-redhat-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Aug  4 2015
Tue Dec 29 21:40:40 2015 library versions: OpenSSL 1.0.2e-fips 3 Dec 2015, LZO 2.08
Tue Dec 29 21:40:40 2015 Diffie-Hellman initialized with 2048 bit key
Tue Dec 29 21:40:40 2015 WARNING: file 'server.key' is group or others accessible
Tue Dec 29 21:40:40 2015 WARNING: file 'ta.key' is group or others accessible
Tue Dec 29 21:40:40 2015 Control Channel Authentication: using 'ta.key' as a OpenVPN static key file
Tue Dec 29 21:40:40 2015 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Dec 29 21:40:40 2015 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Dec 29 21:40:40 2015 Socket Buffers: R=[87380->131072] S=[16384->131072]
Tue Dec 29 21:40:40 2015 ROUTE_GATEWAY 188.166.64.1/255.255.192.0 IFACE=eth0 HWADDR=04:01:8c:17:c3:01
Tue Dec 29 21:40:40 2015 TUN/TAP device tun0 opened
Tue Dec 29 21:40:40 2015 TUN/TAP TX queue length set to 100
Tue Dec 29 21:40:40 2015 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Tue Dec 29 21:40:40 2015 /usr/local/sbin/unpriv-ip link set dev tun0 up mtu 1500
Tue Dec 29 21:40:40 2015 /usr/local/sbin/unpriv-ip addr add dev tun0 local 10.13.7.1 peer 10.13.7.2
Tue Dec 29 21:40:40 2015 /usr/local/sbin/unpriv-ip route add 10.13.7.0/24 via 10.13.7.2
Tue Dec 29 21:40:40 2015 GID set to openvpn
Tue Dec 29 21:40:40 2015 UID set to openvpn
Tue Dec 29 21:40:40 2015 Listening for incoming TCP connection on [undef]
Tue Dec 29 21:40:40 2015 TCPv4_SERVER link local (bound): [undef]
Tue Dec 29 21:40:40 2015 TCPv4_SERVER link remote: [undef]
Tue Dec 29 21:40:40 2015 MULTI: multi_init called, r=256 v=256
Tue Dec 29 21:40:40 2015 IFCONFIG POOL: base=10.13.7.4 size=62, ipv6=0
Tue Dec 29 21:40:40 2015 IFCONFIG POOL LIST
Tue Dec 29 21:40:40 2015 MULTI: TCP INIT maxclients=2 maxevents=6
Tue Dec 29 21:40:40 2015 Initialization Sequence Completed

# starting a connection

Tue Dec 29 21:40:40 2015 Initialization Sequence Completed
Tue Dec 29 21:41:02 2015 TCP connection established with [AF_INET]177.60.115.127:64843
Tue Dec 29 21:41:03 2015 177.60.115.127:64843 TLS: Initial packet from [AF_INET]177.60.115.127:64843, sid=3eee271f 7d199396
Tue Dec 29 21:41:07 2015 177.60.115.127:64843 VERIFY OK: depth=1, CN=Local CA
Tue Dec 29 21:41:07 2015 177.60.115.127:64843 VERIFY OK: depth=0, CN=shau-kote
Tue Dec 29 21:41:08 2015 177.60.115.127:64843 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Dec 29 21:41:08 2015 177.60.115.127:64843 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Dec 29 21:41:08 2015 177.60.115.127:64843 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Dec 29 21:41:08 2015 177.60.115.127:64843 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Dec 29 21:41:08 2015 177.60.115.127:64843 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
Tue Dec 29 21:41:08 2015 177.60.115.127:64843 [shau-kote] Peer Connection Initiated with [AF_INET]177.60.115.127:64843
Tue Dec 29 21:41:08 2015 shau-kote/177.60.115.127:64843 MULTI_sva: pool returned IPv4=10.13.7.6, IPv6=(Not enabled)
Tue Dec 29 21:41:08 2015 shau-kote/177.60.115.127:64843 MULTI: Learn: 10.13.7.6 -> shau-kote/177.60.115.127:64843
Tue Dec 29 21:41:08 2015 shau-kote/177.60.115.127:64843 MULTI: primary virtual IP for shau-kote/177.60.115.127:64843: 10.13.7.6
Tue Dec 29 21:41:10 2015 shau-kote/177.60.115.127:64843 PUSH: Received control message: 'PUSH_REQUEST'
Tue Dec 29 21:41:10 2015 shau-kote/177.60.115.127:64843 send_push_reply(): safe_cap=940
Tue Dec 29 21:41:10 2015 shau-kote/177.60.115.127:64843 SENT CONTROL [shau-kote]: 'PUSH_REPLY,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,redirect-gateway def1,route 10.13.7.1,topology net30,ping 10,ping-restart 240,ifconfig 10.13.7.6 10.13.7.5' (status=1)

# closing a connection

Tue Dec 29 21:43:41 2015 shau-kote/177.60.115.127:64843 Connection reset, restarting [0]
Tue Dec 29 21:43:41 2015 shau-kote/177.60.115.127:64843 SIGUSR1[soft,connection-reset] received, client-instance restarting

# stopping the server

Tue Dec 29 21:44:50 2015 /usr/local/sbin/unpriv-ip route del 10.13.7.0/24
^CTue Dec 29 21:44:50 2015 Closing TUN/TAP interface
Tue Dec 29 21:44:50 2015 /usr/local/sbin/unpriv-ip addr del dev tun0 local 10.13.7.1 peer 10.13.7.2
Tue Dec 29 21:44:50 2015 SIGINT[hard,] received, process exiting
[shau-kote@myvps openvpn]$

As you can see, all works perfectly.

The server config has user openvpn, group openvpn and iproute /usr/local/sbin/unpriv-ip directives and has not script-security 2 directive.

Traffic

Please post full details of:

# openvpn --version

shau-kote

Here is it:

[shau-kote@myvps ~]$ openvpn --version
OpenVPN 2.3.8 x86_64-redhat-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Aug  4 2015
library versions: OpenSSL 1.0.2e-fips 3 Dec 2015, LZO 2.08
Originally developed by James Yonan
Copyright (C) 2002-2010 OpenVPN Technologies, Inc. <sales@openvpn.net>
Compile time defines: enable_crypto=yes enable_crypto_ofb_cfb=yes enable_debug=yes enable_def_auth=yes enable_dependency_tracking=no enable_dlopen=unknown enable_dlopen_self=unknown enable_dlopen_self_static=unknown enable_fast_install=yes enable_fragment=yes enable_http_proxy=yes enable_iproute2=yes enable_libtool_lock=yes enable_lzo=yes enable_lzo_stub=no enable_management=yes enable_multi=yes enable_multihome=yes enable_pam_dlopen=no enable_password_save=yes enable_pedantic=no enable_pf=yes enable_pkcs11=yes enable_plugin_auth_pam=yes enable_plugin_down_root=yes enable_plugins=yes enable_port_share=yes enable_pthread=yes enable_selinux=no enable_server=yes enable_shared=yes enable_shared_with_static_runtimes=no enable_small=no enable_socks=yes enable_ssl=yes enable_static=yes enable_strict=no enable_strict_options=no enable_systemd=yes enable_win32_dll=yes enable_x509_alt_username=yes with_crypto_library=openssl with_gnu_ld=yes with_iproute_path=/sbin/ip with_mem_check=no with_plugindir='$(libdir)/openvpn/plugins' with_sysroot=no
[shau-kote@myvps ~]$

Traffic

I will try setting this up myself and get back to you soon ..

I have also posted this on the openvpn-users mailing list.

Traffic

Please post your own unpriv-ip script.

shau-kote

Sorry so much for the delay in answering
Unfortunately, I have no internet connection on holidays.

My own unpriv-ip script has not any difference from official howto's version:

[shau-kote@myvps ~]$ cat /usr/local/sbin/unpriv-ip 
#!/bin/sh
sudo /sbin/ip $*
[shau-kote@myvps ~]$

My sudoers was also set up according to official howto:

[shau-kote@myvps ~]$ sudo grep openvpn /etc/sudoers 
openvpn ALL=(ALL) NOPASSWD:/sbin/ip
[shau-kote@myvps ~]$

Traffic wroteI will try setting this up myself and get back to you soon ..

I have also posted this on the openvpn-users mailing list.

Thank you for your concern.
Please let me know if you'll find out anything.

Traffic

According to the details you have posted, you are running openvpn as user:shau-kote

shau-kote

Sorry, I dont't understand you.

I start OpenVPN server in one of the two ways:
1. manually:

sudo openvpn server.conf

2. via systemctl:

sudo systemctl start openvpn@server.service

Anyway initially OpenVPN starts by root.
It performs necessary initial actions and then drops down privileges to openvpn user (inasmuch as there is the user openvpn directive in config file).
From this time OpenVPN is running by openvpn user, isn't it?

Wherein am I wrong?

Traffic

shau-kote wroteWherein am I wrong?

Traffic wroteAccording to the details you have posted, you are running openvpn as user:shau-kote

Details:-

unit:

[Unit]
Description=OpenVPN Robust And Highly Flexible Tunneling Application On %I
After=network.target

[Service]
PrivateTmp=true
Type=forking
PIDFile=/var/run/openvpn/%i.pid
ExecStart=/usr/sbin/openvpn --daemon --writepid /var/run/openvpn/%i.pid --cd /etc/openvpn/ --config %i.conf

[Install]
WantedBy=multi-user.target

run as calling user.

OpenVPN config file:

port 443
proto tcp-server
dev tun0

ca /etc/openvpn/ca.crt
cert /etc/openvpn/server.crt
key /etc/openvpn/server.key
dh /etc/openvpn/dh2048.pem
tls-auth /etc/openvpn/ta.key 0
tls-server

server 10.13.7.0 255.255.255.0
comp-lzo
max-clients 2
keepalive 10 240

push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
push "redirect-gateway def1"

ifconfig-pool-persist iplist
persist-key
persist-tun

verb 3
mute 10

run as calling user.

No where have you specified user or group .. thus:

shau-kote wrote[shau-kote@myvps openvpn]$ sudo openvpn server.conf

which works ..

shau-kote wrote[shau-kote@myvps openvpn]$ sudo systemctl start openvpn@server.service

does not ..

I am not an expert in systemd, so I cannot specifically advise on this any further ..

However, I can offer you this diagnostic tool to help you:

Add to your server config:

up /etc/openvpn/up.sh

Create file /etc/openvpn/up.sh with the following:

echo "USER:" $(id)

Then check your log file.

Even without user/group in unit and/or openvpn config, systemd works properly for me, even via sudo:

Linux mypc 3.16.0-4-amd64 #1 SMP Debian 3.16.7-ckt20-1+deb8u1 (2015-12-14) x86_64 GNU/Linux

I can only suggest it has something to do with your VPS (Fedors 23) .. perhaps you can test this elsewhere ..

shau-kote

Traffic wrote No where have you specified user or group

Oops, sorry so much, it's my mistake.
I tried different configurations while wrote the topic and, apparently, I unintentionally posted slightly inaccurate config.
Of course I always have the directives:

[shau-kote@myvps ~]$ sudo grep 'user\|group' /etc/openvpn/server.conf 
user openvpn
group openvpn
[shau-kote@myvps ~]$

I mentioned this in topic:

shau-kote wrote added iproute, user and group directives in server config

shau-kote

I've tried your diagnostic tool:

[shau-kote@myvps ~]$ sudo tail -n 2 /etc/openvpn/server.conf 
up /etc/openvpn/up.sh
script-security 2
[shau-kote@myvps ~]$ sudo cat /etc/openvpn/up.sh 
#!/bin/sh
echo "USER:" $(id)
[shau-kote@myvps ~]$

In case of manual starting it seems fine:

[shau-kote@myvps openvpn]$ sudo openvpn server | grep USER:
USER: uid=0(root) gid=0(root) groups=0(root) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
^C
[shau-kote@myvps openvpn]$

But in case of starting via systemctl I fail to see output of up.sh in journalctl log (I've put it on gist because it's too big.)
However I noted these lines in journalctl log:

Jan 14 04:31:14 myvps openvpn[1169]: /usr/local/sbin/unpriv-ip link set dev tun0 up mtu 1500
Jan 14 04:31:14 myvps audit[1172]: AVC avc:  denied  { getattr } for  pid=1172 comm="unpriv-ip" path="/usr/bin/sudo" dev="vda1" ino=3701 scontext=system_u:system_r:openvpn_t:s0 tcontext=system_u:object_r:sudo_exec_t:s0 tclass=file permissive=0
Jan 14 04:31:14 myvps openvpn[1169]: Linux ip link set failed: could not execute external program
Jan 14 04:31:14 myvps openvpn[1169]: Exiting due to fatal error

Maybe SELinux prohibit OpenVPN to call unpriv-ip? But why it does not prohibit this while I start OpenVPN manually?

shau-kote

Of course I restored SELinux context of unpriv-ip by restorecon:

[shau-kote@myvps ~]$ ls -Zd /usr/local/sbin/
system_u:object_r:bin_t:s0 /usr/local/sbin/
[shau-kote@myvps ~]$ ls -Z /usr/local/sbin/unpriv-ip 
unconfined_u:object_r:bin_t:s0 /usr/local/sbin/unpriv-ip
[shau-kote@myvps ~]$ sudo restorecon -v /usr/local/sbin/unpriv-ip 
[shau-kote@myvps ~]$ ls -Z /usr/local/sbin/unpriv-ip 
unconfined_u:object_r:bin_t:s0 /usr/local/sbin/unpriv-ip
[shau-kote@myvps ~]$

shau-kote

Traffic wroteperhaps you can test this elsewhere

On my laptop's Ubuntu 15.10 I see the same problem though there is not enabled SELinux in it.
From journalctl log after starting OpenVPN via systemctl:

Jan 14 08:00:22 my-ubuntu sudo[3721]:     root : TTY=unknown ; PWD=/etc/openvpn ; USER=root ; COMMAND=/sbin/ip link set dev tun0 up mtu 1500
Jan 14 08:00:22 my-ubuntu ovpn-matroskin-tcp[3717]: Linux ip link set failed: external program exited with error status: 1
Jan 14 08:00:22 my-ubuntu ovpn-matroskin-tcp[3717]: Exiting due to fatal error
Jan 14 08:00:22 my-ubuntu polkitd(authority=local)[885]: Unregistered Authentication Agent for unix-process:3710:823570 (system bus name :1.113, object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale en_US.UTF-8) (disconnected from bus)

The OpenVPN configuration is the same:

shau-kote@my-ubuntu:~$ sudo grep 'user\|group' /etc/openvpn/server.conf 
user openvpn
group openvpn
shau-kote@my-ubuntu:~$ sudo grep openvpn /etc/sudoers
openvpn ALL=(ALL:ALL) NOPASSWD: /sbin/ip
shau-kote@my-ubuntu:~$ cat /usr/local/sbin/unpriv-ip 
#!/bin/sh 
sudo /sbin/ip $*

shau-kote@my-ubuntu:~$ ls -l /usr/local/sbin/unpriv-ip 
-rwxr-xr-x 1 root root 29 Dec 10 04:31 /usr/local/sbin/unpriv-ip
shau-kote@my-ubuntu:~$