fdo-mirrors/NetworkManager
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/NetworkManager/NetworkManager.git synced 2025-12-28 15:40:10 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

core: ensure activation does not disconnect private connections

Browse source 
If two users had the ability to control networking, and user1 started
a private connection which user2 cannot see, user2 could start their
own connection and disconnect user1's connection.  This is not
consistent with device disconnection.  A user who cannot see a
connection should not be able to start/stop it, even if they are
allowed to control networking in general.
This commit is contained in:
Dan Williams 2014-03-31 18:02:11 -05:00
parent 4209f170da
commit 1bf2ffb61e
1 changed files with 25 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

25
src/nm-manager.c
View file

@ -2669,6 +2669,31 @@ _internal_activate_device (NMManager *self, NMActiveConnection *active, GError *
NM_DEVICE_STATE_DISCONNECTED,
NM_DEVICE_STATE_REASON_NONE);
}
} else {
NMConnection *existing_connection = NULL;
NMAuthSubject *subject;
char *error_desc = NULL;
/* If the device is active and its connection is not visible to the
* user that's requesting this new activation, fail, since other users
* should not be allowed to implicitly deactivate private connections
* by activating a connection of their own.
*/
existing_connection = nm_device_get_connection (device);
subject = nm_active_connection_get_subject (active);
if (existing_connection &&
!nm_auth_uid_in_acl (existing_connection,
nm_session_monitor_get (),
nm_auth_subject_get_uid (subject),
&error_desc)) {
g_set_error (error,
NM_MANAGER_ERROR,
NM_MANAGER_ERROR_PERMISSION_DENIED,
"Private connection already active on the device: %s",
error_desc);
g_free (error_desc);
return FALSE;
}
}
/* Final connection must be available on device */