fdo-mirrors/NetworkManager
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/NetworkManager/NetworkManager.git synced 2025-12-20 05:50:06 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions
NetworkManager/contrib/fedora/rpm
History
Íñigo Huguet 0b75d905e5 polkit: remove the modify_system build option 
This build option allowed non-admin users to create system-wide
connections. Generally, this is not a good idea as system-wide changes
should be done by administrators.

However, the main reason for the change is that this can be used to
bypass filesystem permissions, among possibly other attacks. As the
daemon runs as root, a user can create a system-wide connection that
uses a certificate from a different user to authenticate in a WiFi
network protected with 802.1X or a VPN, because as root user the daemon
can access to the file.

This patch does not completely fix the issue, as users can still create
private connections specifying a path to another user's connection. This
will be addressed in other patch. However, this patch is needed too,
because in system-wide connections we don't store which user created the
connection, so there woudn't be any way to check his/her permissions.

This is part of the fix for CVE-2025-9615

See: https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/issues/1809
2025-12-12 12:38:48 +01:00
..
00-server.conf contrib/rpm: update comment in 00-server.conf 2016-02-03 16:25:19 +01:00
20-connectivity-fedora.conf contrib/rpm: add "enabled=true" key to "20-connectivity-{fedora,redhat}.conf" 2021-02-02 14:02:31 +01:00
20-connectivity-redhat.conf contrib/rpm: add "enabled=true" key to "20-connectivity-{fedora,redhat}.conf" 2021-02-02 14:02:31 +01:00
22-wifi-mac-addr.conf contrib/rpm: rename section in "22-wifi-mac-addr.conf" 2024-06-19 11:02:55 +00:00
70-nm-connectivity.conf contrib/rpm: disable rp_filter in config-connectivity-redhat 2019-07-15 20:16:31 +02:00
build.sh spec: add git_tag_version 2025-07-07 09:27:05 +02:00
build_clean.sh build: add path definition for ip6tables 2025-04-01 08:08:52 +00:00
configure-for-system.sh polkit: remove the modify_system build option 2025-12-12 12:38:48 +01:00
mockbuild.sh contrib/fedora: Add mockbuild.sh 2017-10-30 11:04:20 +01:00
NetworkManager.conf contrib/rpm: update comments in default NetworkManager.conf 2021-06-01 09:35:07 +02:00
NetworkManager.spec polkit: remove the modify_system build option 2025-12-12 12:38:48 +01:00
README contrib: make "contrib/fedora/REQUIRED_PACKAGES" executable script 2018-10-22 13:19:15 +02:00
readme-ifcfg-rh-migrated.txt contrib/rpm: add note about interface renaming with ifcfg vs keyfile 2023-10-03 14:09:21 +02:00
readme-ifcfg-rh.txt contrib/rpm: add note about interface renaming with ifcfg vs keyfile 2023-10-03 14:09:21 +02:00
release.sh release: fix validation of gitlab token 2025-03-25 14:35:55 +01:00

README 

# To build RPM packages for Fedora derivates directly from git, just do:


#
# preparation:
#
git clone https://gitlab.freedesktop.org/NetworkManager/NetworkManager.git
cd NetworkManager
git checkout $WHATEVER
./contrib/fedora/REQUIRED_PACKAGES


#
# build the packages. Pass --help for usage help.
#
./contrib/fedora/rpm/build_clean.sh


#
# install
#
sudo dnf install ./contrib/fedora/rpm/latest/RPMS/x86_64/*rpm



# To generate a clean build from git using mock, run:
./contrib/fedora/rpm/mockbuild.sh