mirror of
https://gitlab.freedesktop.org/NetworkManager/NetworkManager.git
synced 2025-12-20 02:20:06 +01:00
0b75d905e5
This build option allowed non-admin users to create system-wide connections. Generally, this is not a good idea as system-wide changes should be done by administrators. However, the main reason for the change is that this can be used to bypass filesystem permissions, among possibly other attacks. As the daemon runs as root, a user can create a system-wide connection that uses a certificate from a different user to authenticate in a WiFi network protected with 802.1X or a VPN, because as root user the daemon can access to the file. This patch does not completely fix the issue, as users can still create private connections specifying a path to another user's connection. This will be addressed in other patch. However, this patch is needed too, because in system-wide connections we don't store which user created the connection, so there woudn't be any way to check his/her permissions. This is part of the fix for CVE-2025-9615 See: https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/issues/1809
72 lines
1.6 KiB
Meson
72 lines
1.6 KiB
Meson
# SPDX-License-Identifier: LGPL-2.1-or-later
|
|
|
|
configure_file(
|
|
input: 'server.conf.in',
|
|
output: '@BASENAME@',
|
|
install_dir: join_paths(nm_datadir, 'doc', nm_name, 'examples'),
|
|
configuration: data_conf,
|
|
)
|
|
|
|
if install_systemdunitdir
|
|
services = [
|
|
'NetworkManager-dispatcher.service',
|
|
'NetworkManager.service',
|
|
'nm-priv-helper.service',
|
|
'NetworkManager-wait-online.service',
|
|
'NetworkManager-config-initrd.service',
|
|
'NetworkManager-initrd.service',
|
|
'NetworkManager-wait-online-initrd.service',
|
|
]
|
|
|
|
foreach service: services
|
|
configure_file(
|
|
input: service + '.in',
|
|
output: service,
|
|
install_dir: systemd_systemdsystemunitdir,
|
|
configuration: data_conf,
|
|
)
|
|
|
|
test(
|
|
'check-' + service,
|
|
find_program(join_paths(source_root, 'src/tests/check-systemd-unit.sh')),
|
|
args: [ join_paths(meson.current_build_dir(), service) ],
|
|
)
|
|
endforeach
|
|
|
|
if enable_ovs
|
|
install_data(
|
|
'NetworkManager-ovs.conf',
|
|
install_dir: join_paths(systemd_systemdsystemunitdir, 'NetworkManager.service.d'),
|
|
)
|
|
endif
|
|
endif
|
|
|
|
if install_udevdir
|
|
data = files(
|
|
'84-nm-drivers.rules',
|
|
'85-nm-unmanaged.rules',
|
|
'90-nm-thunderbolt.rules',
|
|
)
|
|
|
|
install_data(
|
|
data,
|
|
install_dir: join_paths(udev_udevdir, 'rules.d'),
|
|
)
|
|
endif
|
|
|
|
if enable_polkit
|
|
i18n.merge_file(
|
|
input: 'org.freedesktop.NetworkManager.policy.in',
|
|
output: '@BASENAME@',
|
|
po_dir: po_dir,
|
|
install: true,
|
|
install_dir: polkit_gobject_policydir,
|
|
)
|
|
endif
|
|
|
|
if enable_firewalld_zone
|
|
install_data(
|
|
'nm-shared.xml',
|
|
install_dir: join_paths(nm_prefix, 'lib', 'firewalld', 'zones')
|
|
)
|
|
endif
|