fdo-mirrors/NetworkManager
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/NetworkManager/NetworkManager.git synced 2026-03-02 05:00:34 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions
NetworkManager/src/nm-helpers
History
Beniamino Galvani 022b992846 daemon-helper: add read-file-as-user 
Add a new command to read the content of a file after switching to the
given user. This command can be used to enforce Unix filesystem
permissions when accessing a file on behalf of a user.

(cherry picked from commit 285457a5f8)
2025-12-10 09:45:14 +01:00
..
meson.build helpers: move helper programs to the same directory 2025-12-10 09:45:14 +01:00
nm-daemon-helper.c daemon-helper: add read-file-as-user 2025-12-10 09:45:14 +01:00
nm-priv-helper.c helpers: move helper programs to the same directory 2025-12-10 09:45:14 +01:00
nm-priv-helper.conf helpers: move helper programs to the same directory 2025-12-10 09:45:14 +01:00
org.freedesktop.nm_priv_helper.service.in helpers: move helper programs to the same directory 2025-12-10 09:45:14 +01:00
README.md daemon-helper: add read-file-as-user 2025-12-10 09:45:14 +01:00

README.md

nm-helpers

This directory contains stand-alone helper programs used by various components.

nm-daemon-helper

A internal helper application that is spawned by NetworkManager to perform certain actions which can't be done in the daemon.

Currently it's used to do a reverse DNS lookup after reconfiguring the libc resolver (which is a process-wide operation), and to read files on behalf of unprivileged users (which requires a seteuid that affects all the threads of the process).

This is not directly useful to the user.

nm-priv-helper

This is a D-Bus activatable, exit-on-idle service, which provides an internal API to NetworkManager daemon.

This has no purpose for the user, it is an implementation detail of the daemon.

The purpose is that nm-priv-helper can execute certain privileged operations which NetworkManager process is not allowed to. We want to sandbox NetworkManager as much as possible, and nm-priv-helper provides a controlled way to perform some very specific operations.

As such, nm-priv-helper should still be sandboxed too to only being able to execute the operations that are necessary for NetworkManager.

nm-priv-helper will reject all D-Bus requests that are not originating from the current name owner of "org.freedesktop.NetworkManager". That is, it is supposed to only reply to NetworkManager daemon and as such is not useful to the user directly.