What is the correct way, with a single command or a small polkit addition, to limit all unprivileged users to read-only usage of nmcli?
Edit: Allowing only a privileged unix group, in addition to root, such as 'netadmins', would also be nice. The main issue, however, is blocking all non-read-only changes by general unprivileged users.
Like most sysadmins I know, for server deployments I generally disabled NetworkManager and ran the 'network' service, instead using configuration files and network scripts to configure interfaces, bridges, bonds, etc., This was simple, reproducible, reliable, and very un-black-boxy even for advanced configurations.
With EL 8, legacy network configuration is deprecated in favor of NetworkManager. At the same time, EL distributions (currently EL 7.5) now ship allowing non-root users to create, modify, and delete interfaces and make almost unlimited changes to existing configuration. For servers acting as compute head nodes, this allows one user to interfere with the effective operation of the entire machine. For servers offering border services, this increases the potential severity and security implications of unprivileged compromises.
I have read some of the documentation regarding changing polkit configuration for NetworkManager, but most of it is geared toward getting around some wireless issue on a laptop.