nm-secret-agent-old: allow dbus requests from "networkmanager" user

this allows one to (optionally) run NetworkManager as a user named
"networkmanager" instead of root without breaking NM-initiated polkit
queries. dbus interactions for an operation like
`nmcli device wifi rescan` look like this:

```
nmcli device wifi rescan
(sent from pid=1234, uid=1000)
  |
  v
org.freedesktop.NetworkManager.Device.Wireless.RequestScan { }
(fielded by NetworkManager.service)
  |
  v
org.freedesktop.PolicyKit1.Authority.CheckAuthorization {
  pid = 1234
  start-time = ...;
  uid = 1000;
  "org.freedesktop.NetworkManager.wifi.scan"
}
(fielded by polkit.service)
```

ordinarily, polkit will check the details of whoever invoked `nmcli`
against its database and tell NetworkManager whether the request is
authorized or not. however if NetworkManager isn't running as root then
polkit will instead reply with:

> ErrorName=org.freedesktop.PolicyKit1.Error.NotAuthorized
> "Only trusted callers (e.g. uid 0 or an action owner) can use
> CheckAuthorization() for subjects belonging to other identities"

to solve this we encode the action owner into the policy so that when
polkit sees the CheckAuthorization message, it knows the caller is
allowed to ask for that.

running NetworkManager as root is unaffected by this patch.

data/org.freedesktop.NetworkManager.policy.in.in

@@ -16,6 +16,7 @@
       <allow_inactive>no</allow_inactive>
       <allow_active>yes</allow_active>
     </defaults>
+    <annotate key="org.freedesktop.policykit.owner">unix-user:networkmanager</annotate>
   </action>
 
   <action id="org.freedesktop.NetworkManager.reload">
@@ -26,6 +27,7 @@
       <allow_inactive>auth_admin_keep</allow_inactive>
       <allow_active>auth_admin_keep</allow_active>
     </defaults>
+    <annotate key="org.freedesktop.policykit.owner">unix-user:networkmanager</annotate>
   </action>
 
   <action id="org.freedesktop.NetworkManager.sleep-wake">
@@ -35,6 +37,7 @@
       <allow_inactive>no</allow_inactive>
       <allow_active>no</allow_active>
     </defaults>
+    <annotate key="org.freedesktop.policykit.owner">unix-user:networkmanager</annotate>
   </action>
 
   <action id="org.freedesktop.NetworkManager.enable-disable-wifi">
@@ -44,6 +47,7 @@
       <allow_inactive>no</allow_inactive>
       <allow_active>yes</allow_active>
     </defaults>
+    <annotate key="org.freedesktop.policykit.owner">unix-user:networkmanager</annotate>
   </action>
 
   <action id="org.freedesktop.NetworkManager.enable-disable-wwan">
@@ -53,6 +57,7 @@
       <allow_inactive>no</allow_inactive>
       <allow_active>yes</allow_active>
     </defaults>
+    <annotate key="org.freedesktop.policykit.owner">unix-user:networkmanager</annotate>
   </action>
 
   <action id="org.freedesktop.NetworkManager.enable-disable-wimax">
@@ -62,6 +67,7 @@
       <allow_inactive>no</allow_inactive>
       <allow_active>yes</allow_active>
     </defaults>
+    <annotate key="org.freedesktop.policykit.owner">unix-user:networkmanager</annotate>
   </action>
 
   <action id="org.freedesktop.NetworkManager.network-control">
@@ -72,6 +78,7 @@
       <allow_inactive>yes</allow_inactive>
       <allow_active>yes</allow_active>
     </defaults>
+    <annotate key="org.freedesktop.policykit.owner">unix-user:networkmanager</annotate>
   </action>
 
   <action id="org.freedesktop.NetworkManager.wifi.scan">
@@ -82,6 +89,7 @@
       <allow_inactive>yes</allow_inactive>
       <allow_active>yes</allow_active>
     </defaults>
+    <annotate key="org.freedesktop.policykit.owner">unix-user:networkmanager</annotate>
   </action>
 
   <action id="org.freedesktop.NetworkManager.wifi.share.protected">
@@ -91,6 +99,7 @@
       <allow_inactive>no</allow_inactive>
       <allow_active>yes</allow_active>
     </defaults>
+    <annotate key="org.freedesktop.policykit.owner">unix-user:networkmanager</annotate>
   </action>
 
   <action id="org.freedesktop.NetworkManager.wifi.share.open">
@@ -100,6 +109,7 @@
       <allow_inactive>no</allow_inactive>
       <allow_active>yes</allow_active>
     </defaults>
+    <annotate key="org.freedesktop.policykit.owner">unix-user:networkmanager</annotate>
   </action>
 
   <action id="org.freedesktop.NetworkManager.settings.modify.own">
@@ -110,6 +120,7 @@
       <allow_inactive>yes</allow_inactive>
       <allow_active>yes</allow_active>
     </defaults>
+    <annotate key="org.freedesktop.policykit.owner">unix-user:networkmanager</annotate>
   </action>
 
   <action id="org.freedesktop.NetworkManager.settings.modify.system">
@@ -120,6 +131,7 @@
       <allow_inactive>@NM_MODIFY_SYSTEM_POLICY@</allow_inactive>
       <allow_active>@NM_MODIFY_SYSTEM_POLICY@</allow_active>
     </defaults>
+    <annotate key="org.freedesktop.policykit.owner">unix-user:networkmanager</annotate>
   </action>
 
   <action id="org.freedesktop.NetworkManager.settings.modify.hostname">
@@ -130,6 +142,7 @@
       <allow_inactive>auth_admin_keep</allow_inactive>
       <allow_active>auth_admin_keep</allow_active>
     </defaults>
+    <annotate key="org.freedesktop.policykit.owner">unix-user:networkmanager</annotate>
   </action>
 
   <action id="org.freedesktop.NetworkManager.settings.modify.global-dns">
@@ -140,6 +153,7 @@
       <allow_inactive>auth_admin_keep</allow_inactive>
       <allow_active>auth_admin_keep</allow_active>
     </defaults>
+    <annotate key="org.freedesktop.policykit.owner">unix-user:networkmanager</annotate>
   </action>
 
   <action id="org.freedesktop.NetworkManager.checkpoint-rollback">
@@ -150,6 +164,7 @@
       <allow_inactive>auth_admin_keep</allow_inactive>
       <allow_active>auth_admin_keep</allow_active>
     </defaults>
+    <annotate key="org.freedesktop.policykit.owner">unix-user:networkmanager</annotate>
   </action>
 
   <action id="org.freedesktop.NetworkManager.enable-disable-statistics">
@@ -159,6 +174,7 @@
       <allow_inactive>no</allow_inactive>
       <allow_active>yes</allow_active>
     </defaults>
+    <annotate key="org.freedesktop.policykit.owner">unix-user:networkmanager</annotate>
   </action>
 
   <action id="org.freedesktop.NetworkManager.enable-disable-connectivity-check">
@@ -168,6 +184,7 @@
       <allow_inactive>no</allow_inactive>
       <allow_active>yes</allow_active>
     </defaults>
+    <annotate key="org.freedesktop.policykit.owner">unix-user:networkmanager</annotate>
   </action>
 
 </policyconfig>

src/libnm-client-impl/nm-secret-agent-old.c

@@ -1214,17 +1214,24 @@ _get_connection_unix_user_cb(GObject *source, GAsyncResult *result, gpointer use
             "register: peer %s is owned by user %d for session bus. Validated to accept requests.",
             priv->name_owner_curr->str,
             sender_uid);
-    } else {
-        /* the peer is not validated. We don't actually register. */
-        if (ret)
+    } else if (ret) {
+        gs_free char *name = nm_utils_uid_to_name(sender_uid);
+        if (nm_streq0(name, "networkmanager"))
+            _LOGT("register: peer %s is owned by user %u. Validated to accept requests.",
+                  priv->name_owner_curr->str,
+                  sender_uid);
+        else {
             _LOGT("register: peer %s is owned by user %u. Not validated as NetworkManager service.",
                   priv->name_owner_curr->str,
                   sender_uid);
-        else
-            _LOGT("register: failed to get user id for peer %s: %s. Not validated as "
-                  "NetworkManager service.",
-                  priv->name_owner_curr->str,
-                  error->message);
+            return;
+        }
+    } else {
+        /* the peer is not validated. We don't actually register. */
+        _LOGT("register: failed to get user id for peer %s: %s. Not validated as "
+              "NetworkManager service.",
+              priv->name_owner_curr->str,
+              error->message);
 
         /* we actually don't do anything and keep the agent unregistered.
          *