0

What is the correct way, with a single command or a small polkit addition, to limit all unprivileged users to read-only usage of nmcli?

Edit: Allowing only a privileged unix group, in addition to root, such as 'netadmins', would also be nice. The main issue, however, is blocking all non-read-only changes by general unprivileged users.

Background

Like most sysadmins I know, for server deployments I generally disabled NetworkManager and ran the 'network' service, instead using configuration files and network scripts to configure interfaces, bridges, bonds, etc., This was simple, reproducible, reliable, and very un-black-boxy even for advanced configurations.

With EL 8, legacy network configuration is deprecated in favor of NetworkManager. At the same time, EL distributions (currently EL 7.5) now ship allowing non-root users to create, modify, and delete interfaces and make almost unlimited changes to existing configuration. For servers acting as compute head nodes, this allows one user to interfere with the effective operation of the entire machine. For servers offering border services, this increases the potential severity and security implications of unprivileged compromises.

I have read some of the documentation regarding changing polkit configuration for NetworkManager, but most of it is geared toward getting around some wireless issue on a laptop.

  • Hi, what is a compute head? Have you tested the new default? I ask because there's often supposed to be a difference between the permission granted to "local" and "remote" users by polkit. E.g. my Debian 9 server doesn't let me mount SDcards with udisks/polkit when I log in over ssh. – sourcejedi Apr 25 at 19:20
  • A compute "head node" is a machine, often with generously apportioned CPU and memory, for the purpose of serving as a testing, high-memory, and submission node in a cluster computing or grid computing environment, grid-in-a-rack environment or other compute-heavy application. The current default as of NetworkManager and polkit in CentOS 7.5 (an EL variant that works to exactly mimic upstream) is to permit regular users all the permissions I mentioned in the question above. Yes, on an enterprise Linux OS, unprivileged users can create, modify, and delete interfaces by default! :-( – rg6 Apr 25 at 19:41
  • Ahh. And, yes. You're exactly right. Local users and remote users have different privileges. Remote users do not have these capabilities. Nonetheless, I would like to make the change. – rg6 Apr 25 at 19:57
0

Apparently we get to write Javascript. Isn't that fun?

I think this will work:

# /etc/polkit-1/rules.d/10-disable-networkmanager.rules

polkit.addRule(function(action, subject) {
    if (action.id.indexOf("org.freedesktop.NetworkManager.") == 0)
    {
        return polkit.Result.NO;
    }
});

https://doc.opensuse.org/documentation/leap/security/html/book.security/cha.security.policykit.html

https://wiki.archlinux.org/index.php/Polkit#Examples

https://blog.christophersmart.com/2014/01/06/policykit-javascript-rules-with-catchall/

A quick rpm -q --dump NetworkManager | grep -i pol shows the policy file is /usr/share/polkit-1/actions/org.freedesktop.NetworkManager.policy. Searching it for <allow_inactive>yes will point out the actions allowed for known remote login users. E.g. on Fedora Workstation 29, these appear to be

  • org.freedesktop.NetworkManager.network-control
  • org.freedesktop.NetworkManager.settings.modify.own
  • org.freedesktop.NetworkManager.settings.modify.system

<allow_active> corresponds roughly to users who are logged in locally. <allow_any> corresponds to users who are not logged in. "logged in" means pam_systemd. Basically "logged in" will mean GUI or shell logins, but probably not when you configure PAM logins for something else like Apache :-).

  • 1
    This is the solution I had roughly put together as an amateur user of NetworkManager and polkit. Searches online suggested configuring custom rules this way. I just couldn't believe that the correct way to perform a configuration task like this would involve writing boilerplate code. Wow! Thanks for your help, your excellent citations, and the context. I'll test soon and answer if it works. – rg6 Apr 26 at 19:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.