mirror of
https://gitlab.freedesktop.org/NetworkManager/NetworkManager.git
synced 2025-12-20 04:40:04 +01:00
39143f8bdd
Add a build option to allow installing a Polkit rule that will grant permissions for admin users without asking for their password if they're in a local console. This shouldn't be encouraged, though. It's common practice that admin users has to introduce their password to make system-wide changes. The standard polkit policy, without this rule, is auth_admin_keep. This policy will ask for the password once and won't ask for it again for ~5 minutes, so it is not too unconvenient. Different distros use different group names for users with admin rights, typically 'sudo' or 'wheel'. The build option allows to define the desired group, or to leave it empty to not install the rule. However, until the previous commit it was allowed that local users (even non-admin) could do system-wide changes without introducing a password. This option allows to maintain the same behavior for admin users, keeping backwards compatibility so we avoid breaking existing scripts, for example. We cannot achieve the same for non-admin users because allowing them to create system-wide connection causes security vulnerabilities that cannot be fixed in any other way.
17 lines
724 B
Text
17 lines
724 B
Text
// NetworkManager authorizations/policy for the @NM_POLKIT_NOAUTH_GROUP@ group.
|
|
//
|
|
// DO NOT EDIT THIS FILE, it will be overwritten on update.
|
|
//
|
|
// Allow users in the @NM_POLKIT_NOAUTH_GROUP@ group to create system-wide connections without being
|
|
// prompted for a password if they are in a local console.
|
|
// This is optional and is only recommended to maintain backwards compatibility
|
|
// in systems where it was already working in this way. It is discouraged
|
|
// otherwise.
|
|
|
|
polkit.addRule(function(action, subject) {
|
|
if (action.id == "org.freedesktop.NetworkManager.settings.modify.system" &&
|
|
subject.isInGroup("@NM_POLKIT_NOAUTH_GROUP@") &&
|
|
subject.local) {
|
|
return polkit.Result.YES;
|
|
}
|
|
});
|