1

I am remote on an ubuntu 16.04 system via ssh.

I added the following content to /etc/polkit-1/localauthority/90-mandatory.d/99-network.pkla

[Allow netdev users to modify all network states and settings]
Identity=unix-group:netdev
Action=org.freedesktop.NetworkManager.*
ResultAny=yes
ResultInactive=yes
ResultActive=yes

I also added my ssh user to netdev:

user@host:~$ groups
[...] netdev [...]

I restarted the system.

When I try to connect a new wifi connection I get the following error

nmcli device wifi connect 'name' password 'psk' ifname 'wlan0' name 'inet'
Error: Failed to add/activate new connection: Insufficient privileges.

So I thought that the permissions might not be set correctly, but:

nmcli general permissions
PERMISSION                                                 VALUE   
org.freedesktop.NetworkManager.enable-disable-network      yes     
org.freedesktop.NetworkManager.enable-disable-wifi         yes     
org.freedesktop.NetworkManager.enable-disable-wwan         yes     
org.freedesktop.NetworkManager.enable-disable-wimax        yes     
org.freedesktop.NetworkManager.sleep-wake                  yes     
org.freedesktop.NetworkManager.network-control             yes     
org.freedesktop.NetworkManager.wifi.share.protected        yes     
org.freedesktop.NetworkManager.wifi.share.open             yes     
org.freedesktop.NetworkManager.settings.modify.system      no      
org.freedesktop.NetworkManager.settings.modify.own         yes     
org.freedesktop.NetworkManager.settings.modify.hostname    yes     
org.freedesktop.NetworkManager.settings.modify.global-dns  unknown 
org.freedesktop.NetworkManager.reload                      yes 

The only permission I do not have is org.freedesktop.NetworkManager.settings.modify.system.

Is this the cause? And if, how do I get it?

1 Answer 1

1

The problem was that /var/lib/polkit-1/localauthority/10-vendor.d/org.freedesktop.NetworkManager.pkla was somehow overriding my rule in /etc/polkit-1/localauthority/90-mandatory.d/99-network.pkla.

I don't yet know why, but I will update this answer as soon as I understood.

2
  • How did you solve it? I'm seeing the same behavior on Debian Bookworm (the setting on Debian Bullseye worked fine)
    – zenlord
    Commented Nov 25, 2023 at 14:39
  • In Debian Bookworm, one must install polkitd-pkla to allow polkit to load pkla files again. These localauthority files appear to be the legacy way of configuring polkit - the modern way is to use 'rules'. I still haven't solved everything, as it is very hard to debug polkit, and I still have not figured out which files override the others
    – zenlord
    Commented Nov 26, 2023 at 11:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .