D01-YG: Yes
Rationale
Yggdrasil v0.5.12 on Linux initializes its TUN interface before the explicit -user privilege drop. chuser_unix.go clears supplementary groups and calls setgid/setuid; the running endpoint then retains the opened interface while using ordinary TCP/TLS sockets. Thus supported setup can be privileged while routine endpoint traffic runs as an ordinary user.
Assessment method
Documentary classification; no new runtime, interoperability or security experiment
Source context
Primary documents, published reports and versioned source review, 2026-10-15
Outstanding qualification
Choose a non-root account, readable user configuration and nonprivileged peer ports; do not set keep-capabilities or retain a privileged helper. This is a documentary code path, not a measured capability trace or proof of every service-unit default.