On 2020-07-02 22:26, Ed Greshko wrote:
On 2020-07-03 12:32, ToddAndMargo via users wrote:
On 2020-06-30 21:47, Ed Greshko wrote:
On 2020-07-01 12:42, ToddAndMargo via users wrote:
Thank you!
$ nmcli connection show eno2 | grep perm
connection.permissions: --
What does "--" mean?
It means "no user restrictions". It means any user can up/down the connection via nmcli.
Huh.
Works:
$ /usr/bin/nmcli c up eno2
Does not work:
$ /usr/sbin/ifup eno2
$ /usr/libexec/nm-ifup eno2
I know that is what you said, but was it intended
to be restricted to nmcli?
The answer to why nmcli works for a user while the other 2 shell scripts fails was alluded to by "Tom H".
(Of course there really is only 1 shell script).
The answer is polkit. If you were to enable logging/debugging for polkit you'd get
Jul 03 13:03:19 f32k.greshko.com dbus-broker[678]: A security policy denied :1.70 to send method call /org/freedesktop/NetworkManager/Settings:org.freedesktop.NetworkManager.Settings.LoadConnections to :1.13.
which coincides with the first command (nmcli connection load) in the shell scripts.
Hi Ed,
Interesting.
All last week
sudo /usr/libexec/nm-ifdown eno2
would trigger a xfce pol kit prompt for the root's password.
Now the command just dies in silence when run in the
background.
In the foreground
$ sudo /usr/libexec/nm-ifdown eno2
Error: '/etc/sysconfig/network-scripts/ifcfg-eno2' is not an active
connection.
Error: no active connection provided.
And I am up and surfing the Internet
I will switch everything over to
/usr/bin/nmcli c down eno2
$ StartStopEth1 stop
Connection 'eno2' successfully deactivated (D-Bus active path:
/org/freedesktop/NetworkManager/ActiveConnection/7)
$ StartStopEth1 start
Connection successfully activated (D-Bus active path:
/org/freedesktop/NetworkManager/ActiveConnection/8)
Oh of interest, Xfce Pol kit has a YUGE security hole that I
reported a while back that has yet to be addressed:
xfce pol kit lets others sneak in
https://github.com/ncopa/xfce-polkit/issues/5
Thank you for all the gracious help on this. Tom
and Sam as well.
-T
--
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
When you say, "I wrote a program that
crashed Windows," people just stare at
you blankly and say, "Hey, I got those
with the system, for free."
-- Linus Torvalds
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
_______________________________________________
users mailing list -- users@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to users-leave@xxxxxxxxxxxxxxxxxxxxxxx
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/users@xxxxxxxxxxxxxxxxxxxxxxx
