mirror of
https://gitlab.freedesktop.org/NetworkManager/NetworkManager.git
synced 2026-01-03 16:20:14 +01:00
b635b4d419
By setting "connection.permissions", a profile is restricted to a
particular user.
That means for example, that another user cannot see, modify, delete,
activate or deactivate the profile. It also means, that the profile
will only autoconnect when the user is logged in (has a session).
Note that root is always able to activate the profile. Likewise, the
user is also allowed to manually activate the own profile, even if no
session currently exists (which can easily happen with `sudo`).
When the user logs out (the session goes away), we want do disconnect
the profile, however there are conflicting goals here:
1) if the profile was activate by root user, then logging out the user
should not disconnect the profile. The patch fixes that by not
binding the activation to the connection, if the activation is done
by the root user.
2) if the profile was activated by the owner when it had no session,
then it should stay alive until the user logs in (once) and logs
out again. This is already handled by the previous commit.
Yes, this point is odd. If you first do
$ sudo -u $OTHER_USER nmcli connection up $PROFILE
the profile activates despite not having a session. If you then
$ ssh guest@localhost nmcli device
you'll still see the profile active. However, the moment the SSH session
ends, a session closes and the profile disconnects. It's unclear, how to
solve that any better. I think, a user who cares about this, should not
activate the profile without having a session in the first place.
There are quite some special cases, in particular with internal
activations. In those cases we need to decide whether to bind the
activation to the profile's visibility.
Also, expose the "bind" setting in the D-Bus API. Note, that in the future
this flag may be modified via D-Bus API. Like we may also add related API
that allows to tweak the lifetime of the activation.
Also, I think we broke handling of connection visiblity with 37e8c53eee
"core: Introduce helper class to track connection keep alive". This
should be fixed now too, with improved behavior.
Fixes: 37e8c53eee
https://bugzilla.redhat.com/show_bug.cgi?id=1530977
80 lines
3.9 KiB
C
80 lines
3.9 KiB
C
/* -*- Mode: C; tab-width: 4; indent-tabs-mode: t; c-basic-offset: 4 -*- */
|
|
/* NetworkManager -- Network link manager
|
|
*
|
|
* This program is free software; you can redistribute it and/or modify
|
|
* it under the terms of the GNU General Public License as published by
|
|
* the Free Software Foundation; either version 2 of the License, or
|
|
* (at your option) any later version.
|
|
*
|
|
* This program is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
* GNU General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU General Public License along
|
|
* with this program; if not, write to the Free Software Foundation, Inc.,
|
|
* 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
|
*
|
|
* (C) Copyright 2005 - 2012 Red Hat, Inc.
|
|
*/
|
|
|
|
#ifndef __NM_ACT_REQUEST_H__
|
|
#define __NM_ACT_REQUEST_H__
|
|
|
|
#include "nm-connection.h"
|
|
#include "nm-active-connection.h"
|
|
|
|
#define NM_TYPE_ACT_REQUEST (nm_act_request_get_type ())
|
|
#define NM_ACT_REQUEST(obj) (G_TYPE_CHECK_INSTANCE_CAST ((obj), NM_TYPE_ACT_REQUEST, NMActRequest))
|
|
#define NM_ACT_REQUEST_CLASS(klass) (G_TYPE_CHECK_CLASS_CAST ((klass), NM_TYPE_ACT_REQUEST, NMActRequestClass))
|
|
#define NM_IS_ACT_REQUEST(obj) (G_TYPE_CHECK_INSTANCE_TYPE ((obj), NM_TYPE_ACT_REQUEST))
|
|
#define NM_IS_ACT_REQUEST_CLASS(klass) (G_TYPE_CHECK_CLASS_TYPE ((klass), NM_TYPE_ACT_REQUEST))
|
|
#define NM_ACT_REQUEST_GET_CLASS(obj) (G_TYPE_INSTANCE_GET_CLASS ((obj), NM_TYPE_ACT_REQUEST, NMActRequestClass))
|
|
|
|
struct _NMActRequestGetSecretsCallId;
|
|
typedef struct _NMActRequestGetSecretsCallId NMActRequestGetSecretsCallId;
|
|
|
|
GType nm_act_request_get_type (void);
|
|
|
|
NMActRequest *nm_act_request_new (NMSettingsConnection *settings_connection,
|
|
NMConnection *applied_connection,
|
|
const char *specific_object,
|
|
NMAuthSubject *subject,
|
|
NMActivationType activation_type,
|
|
NMActivationReason activation_reason,
|
|
NMActivationStateFlags initial_state_flags,
|
|
NMDevice *device);
|
|
|
|
NMSettingsConnection *nm_act_request_get_settings_connection (NMActRequest *req);
|
|
|
|
NMConnection *nm_act_request_get_applied_connection (NMActRequest *req);
|
|
|
|
gboolean nm_act_request_get_shared (NMActRequest *req);
|
|
|
|
void nm_act_request_set_shared (NMActRequest *req, gboolean shared);
|
|
|
|
void nm_act_request_add_share_rule (NMActRequest *req,
|
|
const char *table,
|
|
const char *rule);
|
|
|
|
/* Secrets handling */
|
|
|
|
typedef void (*NMActRequestSecretsFunc) (NMActRequest *req,
|
|
NMActRequestGetSecretsCallId *call_id,
|
|
NMSettingsConnection *connection,
|
|
GError *error,
|
|
gpointer user_data);
|
|
|
|
NMActRequestGetSecretsCallId *nm_act_request_get_secrets (NMActRequest *req,
|
|
gboolean take_ref,
|
|
const char *setting_name,
|
|
NMSecretAgentGetSecretsFlags flags,
|
|
const char *hint,
|
|
NMActRequestSecretsFunc callback,
|
|
gpointer callback_data);
|
|
|
|
void nm_act_request_cancel_secrets (NMActRequest *req, NMActRequestGetSecretsCallId *call_id);
|
|
void nm_act_request_clear_secrets (NMActRequest *self);
|
|
|
|
#endif /* __NM_ACT_REQUEST_H__ */
|
|
|