NetworkManager/src/nm-sudo/nm-sudo.conf

<!DOCTYPE busconfig PUBLIC
 "-//freedesktop//DTD D-BUS Bus Configuration 1.0//EN"
 "http://www.freedesktop.org/standards/dbus/1.0/busconfig.dtd">
<busconfig>
    <policy user="root">
        <allow own="org.freedesktop.nm.sudo"/>
        <allow send_destination="org.freedesktop.nm.sudo"/>
    </policy>
    <policy context="default">
        <deny own="org.freedesktop.nm.sudo"/>
        <deny send_destination="org.freedesktop.nm.sudo"/>
    </policy>
</busconfig>
sudo: introduce nm-sudo D-Bus service NetworkManager runs as root and has lots of capabilities. We want to reduce the attach surface by dropping capabilities, but there is a genuine need to do certain things. For example, we currently require dac_override capability, to open the unix socket of ovsdb. Most users wouldn't use OVS, so we should find a way to not require that dac_override capability. The solution is to have a separate, D-Bus activate service (nm-sudo), which has the capability to open and provide the file descriptor. For authentication, we only rely on D-Bus. We watch the name owner of NetworkManager, and only accept requests from that service. We trust D-Bus to get it right a request from that name owner is really coming from NetworkManager. If we couldn't trust that, how could PolicyKit or any authentication via D-Bus work? For testing, the user can set NM_SUDO_NO_AUTH_FOR_TESTING=1. https://bugzilla.redhat.com/show_bug.cgi?id=1921826 2021-07-18 08:53:43 +02:00			`<!DOCTYPE busconfig PUBLIC`
			`"-//freedesktop//DTD D-BUS Bus Configuration 1.0//EN"`
			`"http://www.freedesktop.org/standards/dbus/1.0/busconfig.dtd">`
			`<busconfig>`
			`<policy user="root">`
			`<allow own="org.freedesktop.nm.sudo"/>`
			`<allow send_destination="org.freedesktop.nm.sudo"/>`
			`</policy>`
			`<policy context="default">`
			`<deny own="org.freedesktop.nm.sudo"/>`
			`<deny send_destination="org.freedesktop.nm.sudo"/>`
			`</policy>`
			`</busconfig>`