3

I'm currently working on an Archlinux system and I try to configure rules used by polkit so users inside network group are able to run nmcli commands.

I've create a polkit rule as follow :

polkit.addRule(function(action, subject) {
  if (action.id.indexOf("org.freedesktop.NetworkManager.") == 0 && subject.isInGroup("network")) {
    return polkit.Result.YES;
  }
}); 

When I run commands like :

  • nmcli connection show
  • nmcli connection up enp11s0f0

Everything works fine.

But for a weird reason it fails with commands like :

  • nmcli connection reload
  • nmcli connection load enp11s0f0

I've added some logs to the rule and the reload command doesn't generate any logs.

The load command show those logs :

10:04:38.658: /etc/polkit-1/rules.d/50-org.freedesktop.NetworkManager.rules:2: action=[Action id='org.freedesktop.NetworkManager.enable-disable-network']
10:04:38.659: /etc/polkit-1/rules.d/50-org.freedesktop.NetworkManager.rules:3: subject=[Subject pid=15410 user='test' groups=test,network seat=null session='3' local=false active=true]
10:04:38.661: /etc/polkit-1/rules.d/50-org.freedesktop.NetworkManager.rules:2: action=[Action id='org.freedesktop.NetworkManager.sleep-wake']
10:04:38.662: /etc/polkit-1/rules.d/50-org.freedesktop.NetworkManager.rules:3: subject=[Subject pid=15410 user='test' groups=test,network seat=null session='3' local=false active=true]
10:04:38.665: /etc/polkit-1/rules.d/50-org.freedesktop.NetworkManager.rules:2: action=[Action id='org.freedesktop.NetworkManager.enable-disable-wifi']
10:04:38.665: /etc/polkit-1/rules.d/50-org.freedesktop.NetworkManager.rules:3: subject=[Subject pid=15410 user='test' groups=test,network seat=null session='3' local=false active=true]
10:04:38.668: /etc/polkit-1/rules.d/50-org.freedesktop.NetworkManager.rules:2: action=[Action id='org.freedesktop.NetworkManager.enable-disable-wwan']
10:04:38.668: /etc/polkit-1/rules.d/50-org.freedesktop.NetworkManager.rules:3: subject=[Subject pid=15410 user='test' groups=test,network seat=null session='3' local=false active=true]
10:04:38.671: /etc/polkit-1/rules.d/50-org.freedesktop.NetworkManager.rules:2: action=[Action id='org.freedesktop.NetworkManager.enable-disable-wimax']
10:04:38.671: /etc/polkit-1/rules.d/50-org.freedesktop.NetworkManager.rules:3: subject=[Subject pid=15410 user='test' groups=test,network seat=null session='3' local=false active=true]
10:04:38.674: /etc/polkit-1/rules.d/50-org.freedesktop.NetworkManager.rules:2: action=[Action id='org.freedesktop.NetworkManager.network-control']
10:04:38.674: /etc/polkit-1/rules.d/50-org.freedesktop.NetworkManager.rules:3: subject=[Subject pid=15410 user='test' groups=test,network seat=null session='3' local=false active=true]
10:04:38.677: /etc/polkit-1/rules.d/50-org.freedesktop.NetworkManager.rules:2: action=[Action id='org.freedesktop.NetworkManager.wifi.share.protected']
10:04:38.677: /etc/polkit-1/rules.d/50-org.freedesktop.NetworkManager.rules:3: subject=[Subject pid=15410 user='test' groups=test,network seat=null session='3' local=false active=true]

But fails with Error: failed to load connection: access denied.

If I check the nmcli permissions :

$ nmcli general permissions
PERMISSION                                                        VALUE   
org.freedesktop.NetworkManager.enable-disable-network             yes     
org.freedesktop.NetworkManager.enable-disable-wifi                yes     
org.freedesktop.NetworkManager.enable-disable-wwan                yes     
org.freedesktop.NetworkManager.enable-disable-wimax               yes     
org.freedesktop.NetworkManager.sleep-wake                         yes     
org.freedesktop.NetworkManager.network-control                    yes     
org.freedesktop.NetworkManager.wifi.share.protected               yes     
org.freedesktop.NetworkManager.wifi.share.open                    yes     
org.freedesktop.NetworkManager.settings.modify.system             yes     
org.freedesktop.NetworkManager.settings.modify.own                yes     
org.freedesktop.NetworkManager.settings.modify.hostname           yes     
org.freedesktop.NetworkManager.settings.modify.global-dns         yes     
org.freedesktop.NetworkManager.reload                             yes     
org.freedesktop.NetworkManager.checkpoint-rollback                yes     
org.freedesktop.NetworkManager.enable-disable-statistics          yes     
org.freedesktop.NetworkManager.enable-disable-connectivity-check  yes     
org.freedesktop.NetworkManager.wifi.scan                          unknown 

Any clues on how to fix it?

1 Answer 1

0

This is not possible by policy.

See https://bugzilla.redhat.com/show_bug.cgi?id=1921082, which was closed as not a bug.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .