I'm using Network Manager to connect to a secure wireless network on a publicly accessible kiosk machine.

The problem is, if the user manages to get to the desktop, the nm-applet is accessible by a non-root user. So a user can simply right click on a tray icon, edit connection settings and see the credentials for the wireless network in plain text.

What I would like is for the applet to start on login (as a non-root user) and connect to the internet. But when a user clicks the tray icon it prompts for the root password.

I haven't used Network Manager in a while but on previous RedHat systems I remember the password prompt showing up upon clicking the tray icon. I did check for gksu and beesu programs on the Centos repositories but I don't see them. However, there is some program that does the equivalent because when I click an administration program a password prompt shows up.

So how can I force a password prompt upon clicking the nm-applet tray icon?

If that is not possible, can I have Network Manager login to the wireless with out having nm-applet start up?


Managed to lock some settings down using polkit /usr/share/polkit-1/actions/. Pretty much everything except the Edit Connections window seems to be listed in the relevant NetworkManager files. So I just need to find out what DBus message is linked to that window. I figured it would be org.freedesktop.network-manager-settings.system.modify which is in /usr/share/polkit-1/actions/org.freedesktop.network-manager-settings.system.policy but changing that seems to have no effect. Any ideas?

As a workaround I just changed the permissions of the nm-connection-editor app to 700. So a normal user can't edit their own saved connections.

Further Update

The above workaround prevents the user from accessing the network credentials from right clicking the icon, but when the connection times out the window will pop up displaying network credentials.

So still no proper solution.

Workaround Solution 2

As I was unable to prevent network manager from displaying the credentials. I ditched it entirely in favor of a mixture of dhclient and wpa_supplicant. The wireless network uses PEAP with no certificate so I had to list it as LEAP in wpa_supplicant.conf.



With wpa_supplicant configured, I simply:

#bring interface down
ifconfig wlan0 down 
#start wpa_supplicant
wpa_supplicant -c /etc/wpa_supplicant/wpa_supplicant.conf -i wlan0 -Dwext -B
#associate network name with interface
iwconfig wlan0 essid "mynetworkname"
#bring interface back up
ifconfig wlan0 up
#request IP
dhclient -r 
dhclient -timeout 1000 wlan0

1 Answer 1


My explanation is more wicd related (since i had the opposite problem some time ago) but a quick search yields that communication between nm-applet and network-manager is based on the same principle. So it is likely that it works in this case, too!

nm-applet communicates with the related daemon via dbus. Probably you have a specific configuration in the dbus-config dir for the communication between those two. On debian related systems those application related config files are located at /etc/dbus-1/system.d/.

You have to adjust the config-file for the dbus-daemon which provides the connection between the participating processe. The config file is named after the application and is plain xml. The element of interest in your case is <policy>. In this section you can adjust which users/group is allowed to communicate and who is not. Since xml has the advantage to be easily legible it is likely that you locate those entries you want to delete quickly.

Certainly there are better explanations, but now you have the keywords you need to find them.

  • Cool this seems like the right direction. I've messed around with the nm-applet.conf file a bit but don't know how I can allow non-root user to "own" the process so it can start it up but prevent it from editing/viewing settings. Is there anywhere I can find out what the send_destination and send_interface, etc mean? The man page has example but doesn't clarify.
    – jmathew
    Commented Sep 7, 2012 at 18:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .