mirror of
https://gitlab.freedesktop.org/NetworkManager/NetworkManager.git
synced 2025-12-26 10:00:07 +01:00
f137b32d31
NetworkManager runs as root and has lots of capabilities. We want to reduce the attach surface by dropping capabilities, but there is a genuine need to do certain things. For example, we currently require dac_override capability, to open the unix socket of ovsdb. Most users wouldn't use OVS, so we should find a way to not require that dac_override capability. The solution is to have a separate, D-Bus activate service (nm-sudo), which has the capability to open and provide the file descriptor. For authentication, we only rely on D-Bus. We watch the name owner of NetworkManager, and only accept requests from that service. We trust D-Bus to get it right a request from that name owner is really coming from NetworkManager. If we couldn't trust that, how could PolicyKit or any authentication via D-Bus work? For testing, the user can set NM_SUDO_NO_AUTH_FOR_TESTING=1. https://bugzilla.redhat.com/show_bug.cgi?id=1921826
77 lines
1.6 KiB
Meson
77 lines
1.6 KiB
Meson
# SPDX-License-Identifier: LGPL-2.1-or-later
|
|
|
|
configure_file(
|
|
input: 'server.conf.in',
|
|
output: '@BASENAME@',
|
|
install_dir: join_paths(nm_datadir, 'doc', nm_name, 'examples'),
|
|
configuration: data_conf,
|
|
)
|
|
|
|
if install_systemdunitdir
|
|
services = [
|
|
'NetworkManager-dispatcher.service.in',
|
|
'NetworkManager.service.in',
|
|
'nm-sudo.service.in',
|
|
]
|
|
|
|
if have_systemd_200
|
|
services += ['NetworkManager-wait-online.service.in']
|
|
else
|
|
services += ['NetworkManager-wait-online-systemd-pre200.service.in']
|
|
endif
|
|
|
|
foreach service: services
|
|
configure_file(
|
|
input: service,
|
|
output: '@BASENAME@',
|
|
install_dir: systemd_systemdsystemunitdir,
|
|
configuration: data_conf,
|
|
)
|
|
endforeach
|
|
|
|
if enable_ovs
|
|
install_data(
|
|
'NetworkManager-ovs.conf',
|
|
install_dir: join_paths(systemd_systemdsystemunitdir, 'NetworkManager.service.d'),
|
|
)
|
|
endif
|
|
endif
|
|
|
|
if install_udevdir
|
|
data = files(
|
|
'84-nm-drivers.rules',
|
|
'85-nm-unmanaged.rules',
|
|
'90-nm-thunderbolt.rules',
|
|
)
|
|
|
|
install_data(
|
|
data,
|
|
install_dir: join_paths(udev_udevdir, 'rules.d'),
|
|
)
|
|
endif
|
|
|
|
if enable_polkit
|
|
policy = 'org.freedesktop.NetworkManager.policy'
|
|
|
|
policy_in = configure_file(
|
|
input: policy + '.in.in',
|
|
output: '@BASENAME@',
|
|
configuration: data_conf,
|
|
)
|
|
|
|
custom_target(
|
|
policy,
|
|
input: policy_in,
|
|
output: '@BASENAME@',
|
|
command: intltool_xml_cmd,
|
|
install: true,
|
|
install_dir: polkit_gobject_policydir,
|
|
)
|
|
endif
|
|
|
|
if enable_firewalld_zone
|
|
install_data(
|
|
'nm-shared.xml',
|
|
install_dir: join_paths(nm_prefix, 'lib', 'firewalld', 'zones')
|
|
)
|
|
endif
|