On 2020-07-02 22:26, Ed Greshko wrote:
On 2020-07-03 12:32, ToddAndMargo via users wrote:
> On 2020-06-30 21:47, Ed Greshko wrote:
>> On 2020-07-01 12:42, ToddAndMargo via users wrote:
>>> Thank you!
>>>
>>> $ nmcli connection show eno2 | grep perm
>>> connection.permissions: --
>>>
>>>
>>> What does "--" mean?
>>
>> It means "no user restrictions". It means any user can up/down the
connection via nmcli.
>>
>
> Huh.
>
> Works:
> $ /usr/bin/nmcli c up eno2
>
> Does not work:
> $ /usr/sbin/ifup eno2
> $ /usr/libexec/nm-ifup eno2
>
> I know that is what you said, but was it intended
> to be restricted to nmcli?
The answer to why nmcli works for a user while the other 2 shell scripts fails was
alluded to by "Tom H".
(Of course there really is only 1 shell script).
The answer is polkit. If you were to enable logging/debugging for polkit you'd get
Jul 03 13:03:19
f32k.greshko.com dbus-broker[678]: A security policy denied :1.70 to send
method call
/org/freedesktop/NetworkManager/Settings:org.freedesktop.NetworkManager.Settings.LoadConnections
to :1.13.
which coincides with the first command (nmcli connection load) in the shell scripts.
Hi Ed,
Interesting.
All last week
sudo /usr/libexec/nm-ifdown eno2
would trigger a xfce pol kit prompt for the root's password.
Now the command just dies in silence when run in the
background.
In the foreground
$ sudo /usr/libexec/nm-ifdown eno2
Error: '/etc/sysconfig/network-scripts/ifcfg-eno2' is not an active
connection.
Error: no active connection provided.
And I am up and surfing the Internet
I will switch everything over to
/usr/bin/nmcli c down eno2
$ StartStopEth1 stop
Connection 'eno2' successfully deactivated (D-Bus active path:
/org/freedesktop/NetworkManager/ActiveConnection/7)
$ StartStopEth1 start
Connection successfully activated (D-Bus active path:
/org/freedesktop/NetworkManager/ActiveConnection/8)
Oh of interest, Xfce Pol kit has a YUGE security hole that I
reported a while back that has yet to be addressed:
xfce pol kit lets others sneak in
https://github.com/ncopa/xfce-polkit/issues/5
Thank you for all the gracious help on this. Tom
and Sam as well.
-T
--
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
When you say, "I wrote a program that
crashed Windows," people just stare at
you blankly and say, "Hey, I got those
with the system, for free."
-- Linus Torvalds
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~