polkit: add owner annotations to all actions

this allows one to (optionally) run NetworkManager as a user named "networkmanager" instead of root without breaking NM-initiated polkit queries. dbus interactions for an operation like `nmcli device wifi rescan` look like this: ``` nmcli device wifi rescan (sent from pid=1234, uid=1000) | v org.freedesktop.NetworkManager.Device.Wireless.RequestScan { } (fielded by NetworkManager.service) | v org.freedesktop.PolicyKit1.Authority.CheckAuthorization { pid = 1234 start-time = ...; uid = 1000; "org.freedesktop.NetworkManager.wifi.scan" } (fielded by polkit.service) ``` ordinarily, polkit will check the details of whoever invoked `nmcli` against its database and tell NetworkManager whether the request is authorized or not. however if NetworkManager isn't running as root then polkit will instead reply with: > ErrorName=org.freedesktop.PolicyKit1.Error.NotAuthorized > "Only trusted callers (e.g. uid 0 or an action owner) can use > CheckAuthorization() for subjects belonging to other identities" to solve this we encode the action owner into the policy so that when polkit sees the CheckAuthorization message, it knows the caller is allowed to ask for that. running NetworkManager as root is unaffected by this patch.
release: bump version to 1.48.0
2024-06-03 12:02:39 +00:00 · 2024-05-31 13:23:57 +02:00 · 2024-05-31 13:06:01 +02:00 · 2024-05-31 13:06:01 +02:00 · 2024-05-31 13:04:20 +02:00 · 2024-05-31 12:59:28 +02:00
11 changed files with 97 additions and 70 deletions
--- a/10
+++ b/10
@@ -3,11 +3,6 @@ NetworkManager-1.48
 Overview of changes since NetworkManager-1.46
 =============================================

-This is a snapshot of NetworkManager development. The API is
-subject to change and not guaranteed to be compatible with
-the later release.
-USE AT YOUR OWN RISK.  NOT RECOMMENDED FOR PRODUCTION USE!
-
 * Building with autotools is now deprecated and will be completely removed
  in the next development cycle. We recommend using meson to build
  NetworkManager -- for basic setup, see the CONTRIBUTING.md file.
@@ -27,6 +22,11 @@ USE AT YOUR OWN RISK.  NOT RECOMMENDED FOR PRODUCTION USE!
  when IPv6 device address was not explicitly passed on by ModemManager
 * Fix a performance issue that was leading to 100% CPU usage by NetworkManager
  if external programs were doing a big amount of routes updates.
+* Patch-level development releases (i.e. 1.48.1-dev) won't be used anymore.
+  From now on, all the patch releases whithin a stable branch will be normal
+  releases, like 1.48.0, 1.48.1, 1.48.2, 1.48.3 and so on.
+  Odd numbers in the minor version number still indicates if it's a development
+  branch like 1.49 or a stable one like 1.48.

 =============================================
 NetworkManager-1.46
--- a/configure.ac
+++ b/configure.ac
@@ -7,8 +7,8 @@ dnl  - add corresponding NM_VERSION_x_y_z macros in
 dnl    "shared/nm-version-macros.h.in"
 dnl  - update number in meson.build
 m4_define([nm_major_version], [1])
-m4_define([nm_minor_version], [47])
-m4_define([nm_micro_version], [91])
+m4_define([nm_minor_version], [48])
+m4_define([nm_micro_version], [0])
 m4_define([nm_version],
          [nm_major_version.nm_minor_version.nm_micro_version])

--- a/contrib/fedora/rpm/release.sh
+++ b/contrib/fedora/rpm/release.sh
@@ -14,12 +14,11 @@
 #  - "rc"    : further release candidates on RC branch (e.g. from "nm-1-26" branch
 #              tag "1.26-rc2" with version number 1.25.91).
 #  - "major" : on stable branch do a major release (e.g. on "nm-1-26" branch
-#              release "1.26.0", followed by "1.26.1-dev").
+#              release "1.26.0").
 #              You should do a "major-post" release right a "major" release.
 #  - "major-post": after a "major" release, merge the release branch with main and
 #              do another devel snapshot on main (e.g. do "1.27.1-dev" release).
-#  - "minor" : on a stable branch do a minor release (e.g. "1.26.4" on "nm-1-26"
-#              branch and bump to "1.26.5-dev").
+#  - "minor" : on a stable branch do a minor release (e.g. "1.26.4" on "nm-1-26").
 #
 # Requisites:
 #
@@ -296,8 +295,7 @@ RC_VERSION=
 RELEASE_BRANCH=
 case "$RELEASE_MODE" in
    minor)
-        number_is_even "${VERSION_ARR[1]}" &&
-        number_is_odd  "${VERSION_ARR[2]}" || die "cannot do minor release on top of version $VERSION_STR"
+        number_is_even "${VERSION_ARR[1]}" || die "cannot do minor release on top of version $VERSION_STR"
        [ "$CUR_BRANCH" != main ] || die "cannot do a minor release on main"
        ;;
    devel)
@@ -431,19 +429,13 @@ case "$RELEASE_MODE" in
    minor)
        set_version_number "${VERSION_ARR[0]}" "${VERSION_ARR[1]}" $(("${VERSION_ARR[2]}" + 1))
        git commit -m "release: bump version to ${VERSION_ARR[0]}.${VERSION_ARR[1]}.$(("${VERSION_ARR[2]}" + 1))" -a || die "failed to commit release"
-        set_version_number "${VERSION_ARR[0]}" "${VERSION_ARR[1]}" $(("${VERSION_ARR[2]}" + 2))
-        git commit -m "release: bump version to ${VERSION_ARR[0]}.${VERSION_ARR[1]}.$(("${VERSION_ARR[2]}" + 2)) (development)" -a || die "failed to commit devel version bump"

        b="${VERSION_ARR[0]}.${VERSION_ARR[1]}.$(("${VERSION_ARR[2]}" + 1))"
-        git tag -s -a -m "Tag $b" "$b" HEAD~ || die "failed to tag release"
+        git tag -s -a -m "Tag $b" "$b" HEAD || die "failed to tag release"
        BRANCHES+=("$b")
        CLEANUP_REFS+=("refs/tags/$b")
        BUILD_TAG="$b"
-        b="${VERSION_ARR[0]}.${VERSION_ARR[1]}.$(("${VERSION_ARR[2]}" + 2))"
-        git tag -s -a -m "Tag $b (development)" "$b-dev" HEAD || die "failed to tag devel version"
-        BRANCHES+=("$b-dev")
-        CLEANUP_REFS+=("refs/tags/$b-dev")
-        TAR_VERSION="$BUILD_TAG"
+        TAR_VERSION="$b"
        ;;
    devel)
        set_version_number "${VERSION_ARR[0]}" "${VERSION_ARR[1]}" $(("${VERSION_ARR[2]}" + 1))
@@ -482,20 +474,12 @@ case "$RELEASE_MODE" in
        ;;
    major)
        b="${VERSION_ARR[0]}.$((${VERSION_ARR[1]} + 1)).0"
-        b2="${VERSION_ARR[0]}.$((${VERSION_ARR[1]} + 1)).1"
-
        set_version_number "${VERSION_ARR[0]}" "$((${VERSION_ARR[1]} + 1))" 0
        git commit -m "release: bump version to $b" -a || die "failed to commit major version bump"
+
        git tag -s -a -m "Tag $b" "$b" HEAD || die "failed to tag release"
        BRANCHES+=("$b")
        CLEANUP_REFS+=("refs/tags/$b")
-
-        set_version_number "${VERSION_ARR[0]}" "$((${VERSION_ARR[1]} + 1))" 1
-        git commit -m "release: bump version to $b2 (development)" -a || die "failed to commit another bump after major version bump"
-        git tag -s -a -m "Tag $b (development)" "$b2-dev" HEAD || die "failed to tag release"
-        BRANCHES+=("$b2-dev")
-        CLEANUP_REFS+=("refs/tags/$b2-dev")
-
        BUILD_TAG="$b"
        TAR_VERSION="$b"
        ;;
--- a/data/org.freedesktop.NetworkManager.policy.in.in
+++ b/data/org.freedesktop.NetworkManager.policy.in.in
@@ -16,6 +16,7 @@
      <allow_inactive>no</allow_inactive>
      <allow_active>yes</allow_active>
    </defaults>
+    <annotate key="org.freedesktop.policykit.owner">unix-user:networkmanager</annotate>
  </action>

  <action id="org.freedesktop.NetworkManager.reload">
@@ -26,6 +27,7 @@
      <allow_inactive>auth_admin_keep</allow_inactive>
      <allow_active>auth_admin_keep</allow_active>
    </defaults>
+    <annotate key="org.freedesktop.policykit.owner">unix-user:networkmanager</annotate>
  </action>

  <action id="org.freedesktop.NetworkManager.sleep-wake">
@@ -35,6 +37,7 @@
      <allow_inactive>no</allow_inactive>
      <allow_active>no</allow_active>
    </defaults>
+    <annotate key="org.freedesktop.policykit.owner">unix-user:networkmanager</annotate>
  </action>

  <action id="org.freedesktop.NetworkManager.enable-disable-wifi">
@@ -44,6 +47,7 @@
      <allow_inactive>no</allow_inactive>
      <allow_active>yes</allow_active>
    </defaults>
+    <annotate key="org.freedesktop.policykit.owner">unix-user:networkmanager</annotate>
  </action>

  <action id="org.freedesktop.NetworkManager.enable-disable-wwan">
@@ -53,6 +57,7 @@
      <allow_inactive>no</allow_inactive>
      <allow_active>yes</allow_active>
    </defaults>
+    <annotate key="org.freedesktop.policykit.owner">unix-user:networkmanager</annotate>
  </action>

  <action id="org.freedesktop.NetworkManager.enable-disable-wimax">
@@ -62,6 +67,7 @@
      <allow_inactive>no</allow_inactive>
      <allow_active>yes</allow_active>
    </defaults>
+    <annotate key="org.freedesktop.policykit.owner">unix-user:networkmanager</annotate>
  </action>

  <action id="org.freedesktop.NetworkManager.network-control">
@@ -72,6 +78,7 @@
      <allow_inactive>yes</allow_inactive>
      <allow_active>yes</allow_active>
    </defaults>
+    <annotate key="org.freedesktop.policykit.owner">unix-user:networkmanager</annotate>
  </action>

  <action id="org.freedesktop.NetworkManager.wifi.scan">
@@ -82,6 +89,7 @@
      <allow_inactive>yes</allow_inactive>
      <allow_active>yes</allow_active>
    </defaults>
+    <annotate key="org.freedesktop.policykit.owner">unix-user:networkmanager</annotate>
  </action>

  <action id="org.freedesktop.NetworkManager.wifi.share.protected">
@@ -91,6 +99,7 @@
      <allow_inactive>no</allow_inactive>
      <allow_active>yes</allow_active>
    </defaults>
+    <annotate key="org.freedesktop.policykit.owner">unix-user:networkmanager</annotate>
  </action>

  <action id="org.freedesktop.NetworkManager.wifi.share.open">
@@ -100,6 +109,7 @@
      <allow_inactive>no</allow_inactive>
      <allow_active>yes</allow_active>
    </defaults>
+    <annotate key="org.freedesktop.policykit.owner">unix-user:networkmanager</annotate>
  </action>

  <action id="org.freedesktop.NetworkManager.settings.modify.own">
@@ -110,6 +120,7 @@
      <allow_inactive>yes</allow_inactive>
      <allow_active>yes</allow_active>
    </defaults>
+    <annotate key="org.freedesktop.policykit.owner">unix-user:networkmanager</annotate>
  </action>

  <action id="org.freedesktop.NetworkManager.settings.modify.system">
@@ -120,6 +131,7 @@
      <allow_inactive>@NM_MODIFY_SYSTEM_POLICY@</allow_inactive>
      <allow_active>@NM_MODIFY_SYSTEM_POLICY@</allow_active>
    </defaults>
+    <annotate key="org.freedesktop.policykit.owner">unix-user:networkmanager</annotate>
  </action>

  <action id="org.freedesktop.NetworkManager.settings.modify.hostname">
@@ -130,6 +142,7 @@
      <allow_inactive>auth_admin_keep</allow_inactive>
      <allow_active>auth_admin_keep</allow_active>
    </defaults>
+    <annotate key="org.freedesktop.policykit.owner">unix-user:networkmanager</annotate>
  </action>

  <action id="org.freedesktop.NetworkManager.settings.modify.global-dns">
@@ -140,6 +153,7 @@
      <allow_inactive>auth_admin_keep</allow_inactive>
      <allow_active>auth_admin_keep</allow_active>
    </defaults>
+    <annotate key="org.freedesktop.policykit.owner">unix-user:networkmanager</annotate>
  </action>

  <action id="org.freedesktop.NetworkManager.checkpoint-rollback">
@@ -150,6 +164,7 @@
      <allow_inactive>auth_admin_keep</allow_inactive>
      <allow_active>auth_admin_keep</allow_active>
    </defaults>
+    <annotate key="org.freedesktop.policykit.owner">unix-user:networkmanager</annotate>
  </action>

  <action id="org.freedesktop.NetworkManager.enable-disable-statistics">
@@ -159,6 +174,7 @@
      <allow_inactive>no</allow_inactive>
      <allow_active>yes</allow_active>
    </defaults>
+    <annotate key="org.freedesktop.policykit.owner">unix-user:networkmanager</annotate>
  </action>

  <action id="org.freedesktop.NetworkManager.enable-disable-connectivity-check">
@@ -168,6 +184,7 @@
      <allow_inactive>no</allow_inactive>
      <allow_active>yes</allow_active>
    </defaults>
+    <annotate key="org.freedesktop.policykit.owner">unix-user:networkmanager</annotate>
  </action>

 </policyconfig>
--- a/meson.build
+++ b/meson.build
@@ -6,7 +6,7 @@ project(
 #  - add corresponding NM_VERSION_x_y_z macros in
 #    "src/libnm-core-public/nm-version-macros.h.in"
 #  - update number in configure.ac
-  version: '1.47.91',
+  version: '1.48.0',
  license: 'GPL2+',
  default_options: [
    'buildtype=debugoptimized',
--- a/po/POTFILES.in
+++ b/po/POTFILES.in
@@ -89,6 +89,7 @@ src/libnm-core-impl/nm-setting-cdma.c
 src/libnm-core-impl/nm-setting-connection.c
 src/libnm-core-impl/nm-setting-dcb.c
 src/libnm-core-impl/nm-setting-ethtool.c
+src/libnm-core-impl/nm-setting-generic.c
 src/libnm-core-impl/nm-setting-gsm.c
 src/libnm-core-impl/nm-setting-hsr.c
 src/libnm-core-impl/nm-setting-infiniband.c
--- a/src/core/nm-config-data.c
+++ b/src/core/nm-config-data.c
@@ -849,7 +849,7 @@ nm_config_data_log(const NMConfigData  *self,
                    /* We require that the default values are grouped by their "group".
                     * That is, all default values for a certain "group" are close to
                     * each other in the list. Assert for that. */
-                    for (g2 = g + 1; g2 < groups_full->len; g2++) {
+                    for (g2 = g + 1; g2 < G_N_ELEMENTS(default_values); g2++) {
                        nm_assert(!nm_streq(default_values[g - 1].group, default_values[g2].group));
                    }
                }
--- a/src/core/nm-l3-config-data.c
+++ b/src/core/nm-l3-config-data.c
@@ -157,8 +157,8 @@ struct _NML3ConfigData {
    bool has_routes_with_type_local_6_set : 1;
    bool has_routes_with_type_local_4_val : 1;
    bool has_routes_with_type_local_6_val : 1;
-    bool dhcp_enabled_4 : 1;
-    bool dhcp_enabled_6 : 1;
+    bool allow_routes_without_address_4 : 1;
+    bool allow_routes_without_address_6 : 1;

    bool ndisc_hop_limit_set : 1;
    bool ndisc_reachable_time_msec_set : 1;
@@ -678,26 +678,28 @@ nm_l3_config_data_new(NMDedupMultiIndex *multi_idx, int ifindex, NMIPConfigSourc

    self  = g_slice_new(NML3ConfigData);
    *self = (NML3ConfigData){
-        .ref_count                     = 1,
-        .ifindex                       = ifindex,
-        .multi_idx                     = nm_dedup_multi_index_ref(multi_idx),
-        .mdns                          = NM_SETTING_CONNECTION_MDNS_DEFAULT,
-        .llmnr                         = NM_SETTING_CONNECTION_LLMNR_DEFAULT,
-        .dns_over_tls                  = NM_SETTING_CONNECTION_DNS_OVER_TLS_DEFAULT,
-        .flags                         = NM_L3_CONFIG_DAT_FLAGS_NONE,
-        .metered                       = NM_TERNARY_DEFAULT,
-        .proxy_browser_only            = NM_TERNARY_DEFAULT,
-        .proxy_method                  = NM_PROXY_CONFIG_METHOD_UNKNOWN,
-        .route_table_sync_4            = NM_IP_ROUTE_TABLE_SYNC_MODE_NONE,
-        .route_table_sync_6            = NM_IP_ROUTE_TABLE_SYNC_MODE_NONE,
-        .never_default_6               = NM_OPTION_BOOL_DEFAULT,
-        .never_default_4               = NM_OPTION_BOOL_DEFAULT,
-        .source                        = source,
-        .ip6_privacy                   = NM_SETTING_IP6_CONFIG_PRIVACY_UNKNOWN,
-        .mptcp_flags                   = NM_MPTCP_FLAGS_NONE,
-        .ndisc_hop_limit_set           = FALSE,
-        .ndisc_reachable_time_msec_set = FALSE,
-        .ndisc_retrans_timer_msec_set  = FALSE,
+        .ref_count                      = 1,
+        .ifindex                        = ifindex,
+        .multi_idx                      = nm_dedup_multi_index_ref(multi_idx),
+        .mdns                           = NM_SETTING_CONNECTION_MDNS_DEFAULT,
+        .llmnr                          = NM_SETTING_CONNECTION_LLMNR_DEFAULT,
+        .dns_over_tls                   = NM_SETTING_CONNECTION_DNS_OVER_TLS_DEFAULT,
+        .flags                          = NM_L3_CONFIG_DAT_FLAGS_NONE,
+        .metered                        = NM_TERNARY_DEFAULT,
+        .proxy_browser_only             = NM_TERNARY_DEFAULT,
+        .proxy_method                   = NM_PROXY_CONFIG_METHOD_UNKNOWN,
+        .route_table_sync_4             = NM_IP_ROUTE_TABLE_SYNC_MODE_NONE,
+        .route_table_sync_6             = NM_IP_ROUTE_TABLE_SYNC_MODE_NONE,
+        .never_default_6                = NM_OPTION_BOOL_DEFAULT,
+        .never_default_4                = NM_OPTION_BOOL_DEFAULT,
+        .source                         = source,
+        .ip6_privacy                    = NM_SETTING_IP6_CONFIG_PRIVACY_UNKNOWN,
+        .mptcp_flags                    = NM_MPTCP_FLAGS_NONE,
+        .ndisc_hop_limit_set            = FALSE,
+        .ndisc_reachable_time_msec_set  = FALSE,
+        .ndisc_retrans_timer_msec_set   = FALSE,
+        .allow_routes_without_address_4 = TRUE,
+        .allow_routes_without_address_6 = TRUE,
    };

    _idx_type_init(&self->idx_addresses_4, NMP_OBJECT_TYPE_IP4_ADDRESS);
@@ -1936,15 +1938,30 @@ nm_l3_config_data_set_mptcp_flags(NML3ConfigData *self, NMMptcpFlags mptcp_flags
 }

 gboolean
-nm_l3_config_data_get_dhcp_enabled(const NML3ConfigData *self, int addr_family)
+nm_l3_config_data_get_allow_routes_without_address(const NML3ConfigData *self, int addr_family)
 {
    const int IS_IPv4 = NM_IS_IPv4(addr_family);

    nm_assert(_NM_IS_L3_CONFIG_DATA(self, TRUE));
    if (IS_IPv4) {
-        return self->dhcp_enabled_4;
+        return self->allow_routes_without_address_4;
    } else {
-        return self->dhcp_enabled_6;
+        return self->allow_routes_without_address_6;
+    }
+}
+
+void
+nm_l3_config_data_set_allow_routes_without_address(NML3ConfigData *self,
+                                                   int             addr_family,
+                                                   gboolean        value)
+{
+    const int IS_IPv4 = NM_IS_IPv4(addr_family);
+
+    nm_assert(_NM_IS_L3_CONFIG_DATA(self, FALSE));
+    if (IS_IPv4) {
+        self->allow_routes_without_address_4 = value;
+    } else {
+        self->allow_routes_without_address_6 = value;
    }
 }

@@ -2758,18 +2775,18 @@ _init_from_connection_ip(NML3ConfigData *self, int addr_family, NMConnection *co
    method = nm_setting_ip_config_get_method(s_ip);
    if (IS_IPv4) {
        if (nm_streq(method, NM_SETTING_IP4_CONFIG_METHOD_AUTO)) {
-            self->dhcp_enabled_4 = TRUE;
+            self->allow_routes_without_address_4 = FALSE;
        } else {
-            self->dhcp_enabled_4 = FALSE;
+            self->allow_routes_without_address_4 = TRUE;
        }
    } else {
        method = nm_setting_ip_config_get_method(s_ip);
        if (NM_IN_STRSET(method,
                         NM_SETTING_IP6_CONFIG_METHOD_AUTO,
                         NM_SETTING_IP6_CONFIG_METHOD_DHCP)) {
-            self->dhcp_enabled_6 = TRUE;
+            self->allow_routes_without_address_6 = FALSE;
        } else {
-            self->dhcp_enabled_6 = FALSE;
+            self->allow_routes_without_address_6 = TRUE;
        }
    }

@@ -3456,11 +3473,11 @@ nm_l3_config_data_merge(NML3ConfigData       *self,
        self->dhcp_lease_x[0] = nm_dhcp_lease_ref(self->dhcp_lease_x[0]);
        self->dhcp_lease_x[1] = nm_dhcp_lease_ref(self->dhcp_lease_x[1]);
    }
-    if (src->dhcp_enabled_4)
-        self->dhcp_enabled_4 = TRUE;
+    if (!src->allow_routes_without_address_4)
+        self->allow_routes_without_address_4 = FALSE;

-    if (src->dhcp_enabled_6)
-        self->dhcp_enabled_6 = TRUE;
+    if (!src->allow_routes_without_address_6)
+        self->allow_routes_without_address_6 = FALSE;
 }

 NML3ConfigData *
--- a/src/core/nm-l3-config-data.h
+++ b/src/core/nm-l3-config-data.h
@@ -554,7 +554,12 @@ NMSettingIP6ConfigPrivacy nm_l3_config_data_get_ip6_privacy(const NML3ConfigData
 gboolean nm_l3_config_data_set_ip6_privacy(NML3ConfigData           *self,
                                           NMSettingIP6ConfigPrivacy ip6_privacy);

-gboolean nm_l3_config_data_get_dhcp_enabled(const NML3ConfigData *self, int addr_family);
+gboolean nm_l3_config_data_get_allow_routes_without_address(const NML3ConfigData *self,
+                                                            int                   addr_family);
+
+void nm_l3_config_data_set_allow_routes_without_address(NML3ConfigData *self,
+                                                        int             addr_family,
+                                                        gboolean        value);

 NMProxyConfigMethod nm_l3_config_data_get_proxy_method(const NML3ConfigData *self);

--- a/src/core/nm-l3cfg.c
+++ b/src/core/nm-l3cfg.c
@@ -1301,7 +1301,6 @@ _commit_collect_routes(NML3Cfg          *self,
    const int                    IS_IPv4 = NM_IS_IPv4(addr_family);
    const NMDedupMultiHeadEntry *head_entry;
    const NMDedupMultiEntry     *entry;
-    gboolean                     is_dhcp_enabled;

    nm_assert(routes && !*routes);
    nm_assert(routes_nodev && !*routes_nodev);
@@ -1321,10 +1320,10 @@ _commit_collect_routes(NML3Cfg          *self,
        else {
            nm_assert(NMP_OBJECT_CAST_IP_ROUTE(obj)->ifindex == self->priv.ifindex);

-            is_dhcp_enabled =
-                nm_l3_config_data_get_dhcp_enabled(self->priv.p->combined_l3cd_commited,
-                                                   addr_family);
-            if (!any_addrs && is_dhcp_enabled) {
+            if (!any_addrs
+                && !nm_l3_config_data_get_allow_routes_without_address(
+                    self->priv.p->combined_l3cd_commited,
+                    addr_family)) {
                /* This is a unicast route (or a similar route, which has an
                 * ifindex).
                 *
--- a/src/core/vpn/nm-vpn-connection.c
+++ b/src/core/vpn/nm-vpn-connection.c
@@ -1433,6 +1433,10 @@ _check_complete(NMVpnConnection *self, gboolean success)
    l3cd = nm_l3_config_data_new_from_connection(nm_netns_get_multi_idx(priv->netns),
                                                 nm_vpn_connection_get_ip_ifindex(self, TRUE),
                                                 connection);
+
+    nm_l3_config_data_set_allow_routes_without_address(l3cd, AF_INET, TRUE);
+    nm_l3_config_data_set_allow_routes_without_address(l3cd, AF_INET6, TRUE);
+
    _l3cfg_l3cd_set(self, L3CD_TYPE_STATIC, l3cd);

    _l3cfg_l3cd_gw_extern_update(self);
Author	SHA1	Message	Date
Colin	a01293861f	polkit: add owner annotations to all actions this allows one to (optionally) run NetworkManager as a user named "networkmanager" instead of root without breaking NM-initiated polkit queries. dbus interactions for an operation like `nmcli device wifi rescan` look like this: ``` nmcli device wifi rescan (sent from pid=1234, uid=1000) \| v org.freedesktop.NetworkManager.Device.Wireless.RequestScan { } (fielded by NetworkManager.service) \| v org.freedesktop.PolicyKit1.Authority.CheckAuthorization { pid = 1234 start-time = ...; uid = 1000; "org.freedesktop.NetworkManager.wifi.scan" } (fielded by polkit.service) ``` ordinarily, polkit will check the details of whoever invoked `nmcli` against its database and tell NetworkManager whether the request is authorized or not. however if NetworkManager isn't running as root then polkit will instead reply with: > ErrorName=org.freedesktop.PolicyKit1.Error.NotAuthorized > "Only trusted callers (e.g. uid 0 or an action owner) can use > CheckAuthorization() for subjects belonging to other identities" to solve this we encode the action owner into the policy so that when polkit sees the CheckAuthorization message, it knows the caller is allowed to ask for that. running NetworkManager as root is unaffected by this patch.	2024-06-03 12:02:39 +00:00
Lubomir Rintel	1852557a67	release: bump version to 1.48.0	2024-05-31 13:23:57 +02:00
Thomas Haller	41a5cb5308	config: fix crash in assertion during `NetworkManager --print-config` Fixes: `f6345180b1` ('core/config: fix duplicate entires in `NetworkManager --print-config` output') (cherry picked from commit `5472f28a40`)	2024-05-31 13:06:01 +02:00
Íñigo Huguet	19247325bc	po: add nm-setting-generic.c for translation Translatable strings were added to nm-setting-generic.c. Add this file to POTFILES.in. Fixes: `9322c3e9db` ('libnm: add generic.device-handler property') (cherry picked from commit `f84282a880`)	2024-05-31 13:06:01 +02:00
Íñigo Huguet	de5cce5972	release.sh: stop doing "-dev" releases on stable branches Note: here I refer to the numbers in a version as MAJOR.MINOR.MICRO. Having stable and development releases do make sense for the MINOR version, because we maintain separate branches for them and they evolve separately. We have 1.47.z where we put all the changes so anyone can pick the latest development release and test it. At the same time, we have 1.46.z with the latest stable released version. However, it does not make sense to have 1.46.2 and 1.46.3-dev because the latter is not a development version. It is identical to 1.46.2, only the version number has been bumped, there are no changes to test. When we add commits, we will be actually testing 1.46.3-dev + some commits, which is exactly the same as testing 1.46.2 + some commits. So, basically, someone can use the releases of a development BRANCH, like 1.47.4, to test the development version of NM. But using a development MICRO version is exactly the same as using a non-development one. From now on, we will just increment the MICRO version each time we do a release on a stable branch and won't create the '-dev' tag. Update release.sh to do it this way. (cherry picked from commit `8eb00c0991`)	2024-05-31 13:04:20 +02:00
Lubomir Rintel	017ae2b58a	NEWS: not a release candidate any more	2024-05-31 12:59:28 +02:00
Beniamino Galvani	e26b5b06af	merge: branch 'bg/vpn' https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/1938 Resolves: https://issues.redhat.com/browse/RHEL-21875 (cherry picked from commit `b8061dd4f6`)	2024-05-28 09:50:10 +02:00
Beniamino Galvani	5b4ed809cc	vpn: allow IP configurations with routes and without addresses Usually, when the method is "auto" we want to avoid configuring routes until the automatic method completes. To achieve that, we clear the "allow_routes_without_address" flag of l3cds when the method is "auto". For VPNs, IP configurations with only routes are perfectly valid, therefore set the flag. (cherry picked from commit `d1ffdb28eb`)	2024-05-28 09:50:10 +02:00
Beniamino Galvani	5fa063f90d	core: add nm_l3_config_data_set_allow_routes_without_address() Add a function to set the allow-routes-without-address flag for l3cds. It will be used in the next commit. (cherry picked from commit `a3ce13c947`)	2024-05-28 09:50:10 +02:00
Beniamino Galvani	6897b6ecfd	core: rename l3cd's "dhcp_enabled" to "allow_routes_without_address" The name "dhcp_enabled" is misleading because the flag is set for method=auto, which doesn't necessarily imply DHCP. Also, it doesn't convey what the flag is used for. Rename it to "allow_routes_without_address". (cherry picked from commit `b31febea22`)	2024-05-28 09:50:09 +02:00