summary refs log tree commit diff
path: root/src/core/settings/nm-agent-manager.c
diff options
context:
space:
mode:
Diffstat (limited to 'src/core/settings/nm-agent-manager.c')
-rw-r--r--src/core/settings/nm-agent-manager.c1618
1 files changed, 1618 insertions, 0 deletions
diff --git a/src/core/settings/nm-agent-manager.c b/src/core/settings/nm-agent-manager.c
new file mode 100644
index 00000000..7e617909
--- /dev/null
+++ b/src/core/settings/nm-agent-manager.c
@@ -0,0 +1,1618 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ * Copyright (C) 2010 - 2013 Red Hat, Inc.
+ */
+
+#include "src/core/nm-default-daemon.h"
+
+#include "nm-agent-manager.h"
+
+#include <pwd.h>
+
+#include "nm-libnm-core-intern/nm-common-macros.h"
+#include "nm-dbus-interface.h"
+#include "nm-secret-agent.h"
+#include "nm-auth-utils.h"
+#include "nm-setting-vpn.h"
+#include "nm-auth-manager.h"
+#include "nm-dbus-manager.h"
+#include "nm-session-monitor.h"
+#include "nm-simple-connection.h"
+#include "NetworkManagerUtils.h"
+#include "nm-core-internal.h"
+#include "c-list/src/c-list.h"
+
+/*****************************************************************************/
+
+enum {
+    AGENT_REGISTERED,
+    LAST_SIGNAL,
+};
+
+static guint signals[LAST_SIGNAL] = {0};
+
+typedef struct {
+    NMAuthManager *   auth_mgr;
+    NMSessionMonitor *session_monitor;
+
+    CList agent_lst_head;
+
+    CList request_lst_head;
+
+    guint64 agent_version_id;
+} NMAgentManagerPrivate;
+
+struct _NMAgentManager {
+    NMDBusObject          parent;
+    NMAgentManagerPrivate _priv;
+};
+
+struct _NMAgentManagerClass {
+    NMDBusObjectClass parent;
+};
+
+G_DEFINE_TYPE(NMAgentManager, nm_agent_manager, NM_TYPE_DBUS_OBJECT)
+
+#define NM_AGENT_MANAGER_GET_PRIVATE(self) \
+    _NM_GET_PRIVATE(self, NMAgentManager, NM_IS_AGENT_MANAGER)
+
+/*****************************************************************************/
+
+NM_DEFINE_SINGLETON_GETTER(NMAgentManager, nm_agent_manager_get, NM_TYPE_AGENT_MANAGER);
+
+/*****************************************************************************/
+
+#define _NMLOG_PREFIX_NAME "agent-manager"
+#define _NMLOG_DOMAIN      LOGD_AGENTS
+#define _NMLOG(level, agent, ...)                                            \
+    G_STMT_START                                                             \
+    {                                                                        \
+        if (nm_logging_enabled((level), (_NMLOG_DOMAIN))) {                  \
+            char           __prefix1[32];                                    \
+            char           __prefix2[128];                                   \
+            NMSecretAgent *__agent = (agent);                                \
+                                                                             \
+            if (!(self))                                                     \
+                g_snprintf(__prefix1,                                        \
+                           sizeof(__prefix1),                                \
+                           "%s%s",                                           \
+                           ""_NMLOG_PREFIX_NAME                              \
+                           "",                                               \
+                           "[]");                                            \
+            else if ((self) != singleton_instance)                           \
+                g_snprintf(__prefix1,                                        \
+                           sizeof(__prefix1),                                \
+                           "%s[" NM_HASH_OBFUSCATE_PTR_FMT "]",              \
+                           ""_NMLOG_PREFIX_NAME                              \
+                           "",                                               \
+                           NM_HASH_OBFUSCATE_PTR(self));                     \
+            else                                                             \
+                g_strlcpy(__prefix1, _NMLOG_PREFIX_NAME, sizeof(__prefix1)); \
+            if (__agent) {                                                   \
+                g_snprintf(__prefix2,                                        \
+                           sizeof(__prefix2),                                \
+                           ": agent[" NM_HASH_OBFUSCATE_PTR_FMT ",%s]",      \
+                           NM_HASH_OBFUSCATE_PTR(__agent),                   \
+                           nm_secret_agent_get_description(__agent));        \
+            } else                                                           \
+                __prefix2[0] = '\0';                                         \
+            _nm_log((level),                                                 \
+                    (_NMLOG_DOMAIN),                                         \
+                    0,                                                       \
+                    NULL,                                                    \
+                    NULL,                                                    \
+                    "%s%s: " _NM_UTILS_MACRO_FIRST(__VA_ARGS__),             \
+                    __prefix1,                                               \
+                    __prefix2 _NM_UTILS_MACRO_REST(__VA_ARGS__));            \
+        }                                                                    \
+    }                                                                        \
+    G_STMT_END
+
+#define LOG_REQ_FMT "[" NM_HASH_OBFUSCATE_PTR_FMT "/%s%s%s%s%s%s]"
+#define LOG_REQ_ARG(req)                                                  \
+    NM_HASH_OBFUSCATE_PTR(req), NM_PRINT_FMT_QUOTE_STRING((req)->detail), \
+        NM_PRINT_FMT_QUOTED(((req)->request_type == REQUEST_TYPE_CON_GET) \
+                                && (req)->con.get.setting_name,           \
+                            "/\"",                                        \
+                            (req)->con.get.setting_name,                  \
+                            "\"",                                         \
+                            ((req)->request_type == REQUEST_TYPE_CON_GET  \
+                                 ? "/(none)"                              \
+                                 : _request_type_to_string((req)->request_type, FALSE)))
+
+/*****************************************************************************/
+
+typedef struct _NMAgentManagerCallId Request;
+
+static void request_add_agent(Request *req, NMSecretAgent *agent);
+
+static void request_remove_agent(Request *req, NMSecretAgent *agent);
+
+static void request_next_agent(Request *req);
+
+static void _con_get_request_start(Request *req);
+static void _con_save_request_start(Request *req);
+static void _con_del_request_start(Request *req);
+
+static gboolean _con_get_try_complete_early(Request *req);
+
+static void agent_disconnected_cb(NMSecretAgent *agent, gpointer user_data);
+
+/*****************************************************************************/
+
+guint64
+nm_agent_manager_get_agent_version_id(NMAgentManager *self)
+{
+    g_return_val_if_fail(NM_IS_AGENT_MANAGER(self), 0);
+
+    return NM_AGENT_MANAGER_GET_PRIVATE(self)->agent_version_id;
+}
+
+/*****************************************************************************/
+
+typedef enum {
+    REQUEST_TYPE_INVALID,
+    REQUEST_TYPE_CON_GET,
+    REQUEST_TYPE_CON_SAVE,
+    REQUEST_TYPE_CON_DEL,
+} RequestType;
+
+static const char *
+_request_type_to_string(RequestType request_type, gboolean verbose)
+{
+    switch (request_type) {
+    case REQUEST_TYPE_CON_GET:
+        return verbose ? "getting" : "get";
+    case REQUEST_TYPE_CON_SAVE:
+        return verbose ? "saving" : "sav";
+    case REQUEST_TYPE_CON_DEL:
+        return verbose ? "deleting" : "del";
+    default:
+        return "??";
+    }
+}
+
+/*****************************************************************************/
+
+struct _NMAgentManagerCallId {
+    CList request_lst;
+
+    NMAgentManager *self;
+
+    RequestType request_type;
+
+    char *detail;
+
+    NMAuthSubject *subject;
+
+    /* Current agent being asked for secrets */
+    NMSecretAgent *      current;
+    NMSecretAgentCallId *current_call_id;
+
+    /* Stores the sorted list of NMSecretAgents which will be asked for secrets */
+    GSList *pending;
+
+    guint idle_id;
+
+    union {
+        struct {
+            char *        path;
+            NMConnection *connection;
+
+            NMAuthChain *chain;
+
+            /* Whether the agent currently being asked for secrets
+             * has the system.modify privilege.
+             */
+            gboolean current_has_modify;
+
+            union {
+                struct {
+                    NMSecretAgentGetSecretsFlags flags;
+                    char *                       setting_name;
+                    char **                      hints;
+
+                    GVariant *existing_secrets;
+
+                    NMAgentSecretsResultFunc callback;
+                    gpointer                 callback_data;
+                } get;
+            };
+        } con;
+    };
+};
+
+/*****************************************************************************/
+
+static NMSecretAgent *
+_agent_find_by_owner(NMAgentManagerPrivate *priv, const char *owner)
+{
+    NMSecretAgent *agent;
+
+    c_list_for_each_entry (agent, &priv->agent_lst_head, agent_lst) {
+        if (nm_streq(nm_secret_agent_get_dbus_owner(agent), owner))
+            return agent;
+    }
+    return NULL;
+}
+
+static NMSecretAgent *
+_agent_find_by_identifier_and_uid(NMAgentManagerPrivate *priv,
+                                  const char *           identifier,
+                                  gulong                 sender_uid)
+{
+    NMSecretAgent *agent;
+
+    c_list_for_each_entry (agent, &priv->agent_lst_head, agent_lst) {
+        if (nm_streq0(nm_secret_agent_get_identifier(agent), identifier)
+            && sender_uid == nm_secret_agent_get_owner_uid(agent))
+            return agent;
+    }
+    return NULL;
+}
+
+/*****************************************************************************/
+
+static void
+_agent_remove(NMAgentManager *self, NMSecretAgent *agent)
+{
+    NMAgentManagerPrivate *priv = NM_AGENT_MANAGER_GET_PRIVATE(self);
+    CList *                iter, *safe;
+
+    nm_assert(NM_IS_SECRET_AGENT(agent));
+    nm_assert(c_list_contains(&priv->agent_lst_head, &agent->agent_lst));
+
+    _LOGD(agent, "agent unregistered or disappeared");
+
+    nm_clear_pointer(&agent->auth_chain, nm_auth_chain_destroy);
+
+    c_list_unlink(&agent->agent_lst);
+
+    g_signal_handlers_disconnect_by_func(agent, G_CALLBACK(agent_disconnected_cb), self);
+
+    /* Remove this agent from any in-progress secrets requests */
+    c_list_for_each_safe (iter, safe, &priv->request_lst_head)
+        request_remove_agent(c_list_entry(iter, Request, request_lst), agent);
+
+    g_object_unref(agent);
+}
+
+/* Call this *after* calling request_next_agent() */
+static void
+maybe_remove_agent_on_error(NMAgentManager *self, NMSecretAgent *agent, GError *error)
+{
+    if (!g_error_matches(error, G_IO_ERROR, G_IO_ERROR_CLOSED)
+        && !g_error_matches(error, G_DBUS_ERROR, G_DBUS_ERROR_DISCONNECTED)
+        && !g_error_matches(error, G_DBUS_ERROR, G_DBUS_ERROR_NAME_HAS_NO_OWNER))
+        return;
+
+    if (!c_list_is_empty(&agent->agent_lst))
+        _agent_remove(self, agent);
+}
+
+/*****************************************************************************/
+
+static gboolean
+validate_identifier(const char *identifier, GError **error)
+{
+    const char *p = identifier;
+    size_t      id_len;
+
+    if (!identifier) {
+        g_set_error_literal(error,
+                            NM_AGENT_MANAGER_ERROR,
+                            NM_AGENT_MANAGER_ERROR_INVALID_IDENTIFIER,
+                            "No identifier was given");
+        return FALSE;
+    }
+
+    /* Length between 3 and 255 characters inclusive */
+    id_len = strlen(identifier);
+    if (id_len < 3 || id_len > 255) {
+        g_set_error_literal(error,
+                            NM_AGENT_MANAGER_ERROR,
+                            NM_AGENT_MANAGER_ERROR_INVALID_IDENTIFIER,
+                            "Identifier length not between 3 and 255 characters (inclusive)");
+        return FALSE;
+    }
+
+    if ((identifier[0] == '.') || (identifier[id_len - 1] == '.')) {
+        g_set_error_literal(error,
+                            NM_AGENT_MANAGER_ERROR,
+                            NM_AGENT_MANAGER_ERROR_INVALID_IDENTIFIER,
+                            "Identifier must not start or end with '.'");
+        return FALSE;
+    }
+
+    /* FIXME: do complete validation here */
+    while (p && *p) {
+        if (!g_ascii_isalnum(*p) && (*p != '_') && (*p != '-') && (*p != '.')) {
+            g_set_error(error,
+                        NM_AGENT_MANAGER_ERROR,
+                        NM_AGENT_MANAGER_ERROR_INVALID_IDENTIFIER,
+                        "Identifier contains invalid character '%c'",
+                        *p);
+            return FALSE;
+        }
+
+        if ((*p == '.') && (*(p + 1) == '.')) {
+            g_set_error_literal(error,
+                                NM_AGENT_MANAGER_ERROR,
+                                NM_AGENT_MANAGER_ERROR_INVALID_IDENTIFIER,
+                                "Identifier contains two '.' characters in sequence");
+            return FALSE;
+        }
+        p++;
+    }
+
+    return TRUE;
+}
+
+static void
+_agent_permissions_check_done(NMAuthChain *          chain,
+                              GDBusMethodInvocation *context,
+                              gpointer               user_data)
+{
+    NMAgentManager *       self = NM_AGENT_MANAGER(user_data);
+    NMAgentManagerPrivate *priv = NM_AGENT_MANAGER_GET_PRIVATE(self);
+    NMSecretAgent *        agent;
+    Request *              request;
+
+    nm_assert(!context || G_IS_DBUS_METHOD_INVOCATION(context));
+
+    agent = nm_auth_chain_steal_data(chain, "agent");
+
+    nm_assert(NM_IS_SECRET_AGENT(agent));
+    nm_assert(agent->auth_chain == chain);
+    nm_assert(agent->fully_registered == (!context));
+    nm_assert(c_list_contains(&priv->agent_lst_head, &agent->agent_lst));
+
+    agent->auth_chain = NULL;
+
+    nm_secret_agent_add_permission(
+        agent,
+        NM_AUTH_PERMISSION_WIFI_SHARE_PROTECTED,
+        (nm_auth_chain_get_result(chain, NM_AUTH_PERMISSION_WIFI_SHARE_PROTECTED)
+         == NM_AUTH_CALL_RESULT_YES));
+    nm_secret_agent_add_permission(
+        agent,
+        NM_AUTH_PERMISSION_WIFI_SHARE_OPEN,
+        (nm_auth_chain_get_result(chain, NM_AUTH_PERMISSION_WIFI_SHARE_OPEN)
+         == NM_AUTH_CALL_RESULT_YES));
+
+    if (agent->fully_registered) {
+        _LOGD(agent, "updated agent permissions");
+        return;
+    }
+
+    _LOGI(agent, "agent registered");
+
+    agent->fully_registered = TRUE;
+
+    priv->agent_version_id += 1;
+
+    g_dbus_method_invocation_return_value(context, NULL);
+
+    c_list_for_each_entry (request, &priv->request_lst_head, request_lst)
+        request_add_agent(request, agent);
+
+    g_signal_emit(self, signals[AGENT_REGISTERED], 0, agent);
+}
+
+static NMAuthChain *
+_agent_create_auth_chain(NMAgentManager *self, NMSecretAgent *agent, GDBusMethodInvocation *context)
+{
+    NMAuthChain *chain;
+
+    _LOGD(agent, "requesting permissions");
+
+    nm_assert(!agent->auth_chain
+              || (agent->fully_registered == (!nm_auth_chain_get_context(agent->auth_chain))));
+
+    if (agent->auth_chain && !context && !agent->fully_registered) {
+        /* we restart the authorization check (without a @context), but the currently
+         * pending auth-chain carries a context. We need to pass it on as we replace
+         * the auth-chain. */
+        context = nm_auth_chain_get_context(agent->auth_chain);
+        nm_assert(context);
+    }
+
+    chain = nm_auth_chain_new_subject(nm_secret_agent_get_subject(agent),
+                                      context,
+                                      _agent_permissions_check_done,
+                                      self);
+
+    nm_auth_chain_set_data(chain, "agent", agent, NULL);
+    nm_auth_chain_add_call(chain, NM_AUTH_PERMISSION_WIFI_SHARE_PROTECTED, FALSE);
+    nm_auth_chain_add_call(chain, NM_AUTH_PERMISSION_WIFI_SHARE_OPEN, FALSE);
+
+    nm_clear_pointer(&agent->auth_chain, nm_auth_chain_destroy);
+    agent->auth_chain = chain;
+    return chain;
+}
+
+static void
+agent_disconnected_cb(NMSecretAgent *agent, gpointer user_data)
+{
+    _agent_remove(NM_AGENT_MANAGER(user_data), agent);
+}
+
+static void
+agent_manager_register_with_capabilities(NMAgentManager *       self,
+                                         GDBusMethodInvocation *context,
+                                         const char *           identifier,
+                                         guint32                capabilities)
+{
+    NMAgentManagerPrivate *priv               = NM_AGENT_MANAGER_GET_PRIVATE(self);
+    gs_unref_object NMAuthSubject *subject    = NULL;
+    gulong                         sender_uid = G_MAXULONG;
+    GError *                       error      = NULL;
+    NMSecretAgent *                agent;
+
+    subject = nm_dbus_manager_new_auth_subject_from_context(context);
+    if (!subject) {
+        error = g_error_new_literal(NM_AGENT_MANAGER_ERROR,
+                                    NM_AGENT_MANAGER_ERROR_PERMISSION_DENIED,
+                                    NM_UTILS_ERROR_MSG_REQ_UID_UKNOWN);
+        g_dbus_method_invocation_take_error(context, error);
+        return;
+    }
+    sender_uid = nm_auth_subject_get_unix_process_uid(subject);
+
+    /* Validate the identifier */
+    if (!validate_identifier(identifier, &error)) {
+        g_dbus_method_invocation_take_error(context, error);
+        return;
+    }
+
+    /* Only one agent for each identifier is allowed per user */
+    if (_agent_find_by_identifier_and_uid(priv, identifier, sender_uid)) {
+        error = g_error_new_literal(NM_AGENT_MANAGER_ERROR,
+                                    NM_AGENT_MANAGER_ERROR_PERMISSION_DENIED,
+                                    "An agent with this ID is already registered for this user.");
+        g_dbus_method_invocation_take_error(context, error);
+        return;
+    }
+
+    agent = nm_secret_agent_new(context, subject, identifier, capabilities);
+
+    g_signal_connect(agent, NM_SECRET_AGENT_DISCONNECTED, G_CALLBACK(agent_disconnected_cb), self);
+
+    c_list_link_tail(&priv->agent_lst_head, &agent->agent_lst);
+
+    _agent_create_auth_chain(self, agent, context);
+}
+
+static void
+impl_agent_manager_register(NMDBusObject *                     obj,
+                            const NMDBusInterfaceInfoExtended *interface_info,
+                            const NMDBusMethodInfoExtended *   method_info,
+                            GDBusConnection *                  connection,
+                            const char *                       sender,
+                            GDBusMethodInvocation *            invocation,
+                            GVariant *                         parameters)
+{
+    const char *identifier;
+
+    g_variant_get(parameters, "(&s)", &identifier);
+    agent_manager_register_with_capabilities(NM_AGENT_MANAGER(obj), invocation, identifier, 0);
+}
+
+static void
+impl_agent_manager_register_with_capabilities(NMDBusObject *                     obj,
+                                              const NMDBusInterfaceInfoExtended *interface_info,
+                                              const NMDBusMethodInfoExtended *   method_info,
+                                              GDBusConnection *                  connection,
+                                              const char *                       sender,
+                                              GDBusMethodInvocation *            invocation,
+                                              GVariant *                         parameters)
+{
+    const char *identifier;
+    guint32     capabilities;
+
+    g_variant_get(parameters, "(&su)", &identifier, &capabilities);
+    agent_manager_register_with_capabilities(NM_AGENT_MANAGER(obj),
+                                             invocation,
+                                             identifier,
+                                             capabilities);
+}
+
+static void
+impl_agent_manager_unregister(NMDBusObject *                     obj,
+                              const NMDBusInterfaceInfoExtended *interface_info,
+                              const NMDBusMethodInfoExtended *   method_info,
+                              GDBusConnection *                  connection,
+                              const char *                       sender,
+                              GDBusMethodInvocation *            invocation,
+                              GVariant *                         parameters)
+{
+    NMAgentManager *       self = NM_AGENT_MANAGER(obj);
+    NMAgentManagerPrivate *priv = NM_AGENT_MANAGER_GET_PRIVATE(self);
+    NMSecretAgent *        agent;
+
+    agent = _agent_find_by_owner(priv, sender);
+    if (!agent) {
+        g_dbus_method_invocation_return_error_literal(invocation,
+                                                      NM_AGENT_MANAGER_ERROR,
+                                                      NM_AGENT_MANAGER_ERROR_NOT_REGISTERED,
+                                                      "Caller is not registered as an Agent");
+        return;
+    }
+
+    _agent_remove(self, agent);
+
+    g_dbus_method_invocation_return_value(invocation, NULL);
+}
+
+/*****************************************************************************/
+
+static Request *
+request_new(NMAgentManager *self,
+            RequestType     request_type,
+            const char *    detail,
+            NMAuthSubject * subject)
+{
+    Request *req;
+
+    req               = g_slice_new0(Request);
+    req->self         = g_object_ref(self);
+    req->request_type = request_type;
+    req->detail       = g_strdup(detail);
+    req->subject      = g_object_ref(subject);
+    c_list_link_tail(&NM_AGENT_MANAGER_GET_PRIVATE(self)->request_lst_head, &req->request_lst);
+    return req;
+}
+
+static void
+request_free(Request *req)
+{
+    switch (req->request_type) {
+    case REQUEST_TYPE_CON_GET:
+    case REQUEST_TYPE_CON_SAVE:
+    case REQUEST_TYPE_CON_DEL:
+        g_object_unref(req->con.connection);
+        g_free(req->con.path);
+        nm_clear_pointer(&req->con.chain, nm_auth_chain_destroy);
+        if (req->request_type == REQUEST_TYPE_CON_GET) {
+            g_free(req->con.get.setting_name);
+            g_strfreev(req->con.get.hints);
+            if (req->con.get.existing_secrets)
+                g_variant_unref(req->con.get.existing_secrets);
+        }
+        break;
+    default:
+        g_assert_not_reached();
+    }
+
+    if (req->idle_id)
+        g_source_remove(req->idle_id);
+
+    /* cancel-secrets invokes the done-callback synchronously -- in which case
+     * the handler just return.
+     * Hence, we can proceed to free @req... */
+    nm_secret_agent_cancel_call(req->current, req->current_call_id);
+
+    g_object_unref(req->subject);
+
+    g_free(req->detail);
+    g_slist_free_full(req->pending, g_object_unref);
+
+    g_object_unref(req->self);
+
+    if (req->current)
+        g_object_unref(req->current);
+
+    memset(req, 0, sizeof(Request));
+    g_slice_free(Request, req);
+}
+
+static void
+req_complete_release(Request *   req,
+                     GVariant *  secrets,
+                     const char *agent_dbus_owner,
+                     const char *agent_username,
+                     GError *    error)
+{
+    NMAgentManager *self = req->self;
+
+    switch (req->request_type) {
+    case REQUEST_TYPE_CON_GET:
+        req->con.get.callback(self,
+                              req,
+                              agent_dbus_owner,
+                              agent_username,
+                              req->con.current_has_modify,
+                              req->con.get.setting_name,
+                              req->con.get.flags,
+                              error ? NULL : secrets,
+                              error,
+                              req->con.get.callback_data);
+
+        break;
+    case REQUEST_TYPE_CON_SAVE:
+    case REQUEST_TYPE_CON_DEL:
+        break;
+    default:
+        g_return_if_reached();
+    }
+
+    request_free(req);
+}
+
+static void
+req_complete_cancel(Request *req, gboolean is_disposing)
+{
+    gs_free_error GError *error = NULL;
+
+    nm_assert(req && req->self);
+    nm_assert(!c_list_contains(&NM_AGENT_MANAGER_GET_PRIVATE(req->self)->request_lst_head,
+                               &req->request_lst));
+
+    nm_utils_error_set_cancelled(&error, is_disposing, "NMAgentManager");
+    req_complete_release(req, NULL, NULL, NULL, error);
+}
+
+static void
+req_complete(Request *   req,
+             GVariant *  secrets,
+             const char *agent_dbus_owner,
+             const char *agent_username,
+             GError *    error)
+{
+    NMAgentManager *self = req->self;
+
+    nm_assert(
+        c_list_contains(&NM_AGENT_MANAGER_GET_PRIVATE(self)->request_lst_head, &req->request_lst));
+
+    c_list_unlink(&req->request_lst);
+
+    req_complete_release(req, secrets, agent_dbus_owner, agent_username, error);
+}
+
+static void
+req_complete_error(Request *req, GError *error)
+{
+    req_complete(req, NULL, NULL, NULL, error);
+}
+
+static int
+agent_compare_func(gconstpointer aa, gconstpointer bb, gpointer user_data)
+{
+    NMSecretAgent *   a   = (NMSecretAgent *) aa;
+    NMSecretAgent *   b   = (NMSecretAgent *) bb;
+    Request *         req = user_data;
+    NMSessionMonitor *sm;
+    gboolean          a_active, b_active;
+    gulong            a_pid, b_pid, requester;
+    guint64           a_start, b_start;
+
+    a_pid = nm_secret_agent_get_pid(a);
+    b_pid = nm_secret_agent_get_pid(b);
+
+    /* Prefer agents in the process the request came from */
+    if (nm_auth_subject_get_subject_type(req->subject) == NM_AUTH_SUBJECT_TYPE_UNIX_PROCESS) {
+        requester = nm_auth_subject_get_unix_process_pid(req->subject);
+
+        if (a_pid != b_pid) {
+            if (a_pid == requester)
+                return -1;
+            else if (b_pid == requester)
+                return 1;
+        }
+    }
+
+    /* Prefer agents in active sessions */
+    sm       = NM_AGENT_MANAGER_GET_PRIVATE(req->self)->session_monitor;
+    a_active = nm_session_monitor_session_exists(sm, nm_secret_agent_get_owner_uid(a), TRUE);
+    b_active = nm_session_monitor_session_exists(sm, nm_secret_agent_get_owner_uid(b), TRUE);
+    if (a_active && !b_active)
+        return -1;
+    else if (!a_active && b_active)
+        return 1;
+
+    /* Prefer agents launched later (this is essentially to ease agent debugging) */
+    a_start = nm_utils_get_start_time_for_pid(a_pid, NULL, NULL);
+    b_start = nm_utils_get_start_time_for_pid(b_pid, NULL, NULL);
+    if (a_start > b_start)
+        return -1;
+    else if (a_start < b_start)
+        return 1;
+
+    return 0;
+}
+
+static void
+request_add_agent(Request *req, NMSecretAgent *agent)
+{
+    NMAgentManager *self;
+
+    g_return_if_fail(req != NULL);
+    g_return_if_fail(agent != NULL);
+
+    self = req->self;
+
+    if (req->request_type == REQUEST_TYPE_CON_GET) {
+        NMAuthSubject *subject = nm_secret_agent_get_subject(agent);
+
+        /* Ensure the caller's username exists in the connection's permissions,
+         * or that the permissions is empty (ie, visible by everyone).
+         */
+        if (!nm_auth_is_subject_in_acl(req->con.connection, subject, NULL)) {
+            _LOGD(agent,
+                  "agent ignored for secrets request " LOG_REQ_FMT " (not in ACL)",
+                  LOG_REQ_ARG(req));
+            /* Connection not visible to this agent's user */
+            return;
+        }
+    }
+
+    /* If the request should filter agents by UID, do that now */
+    if (nm_auth_subject_get_subject_type(req->subject) == NM_AUTH_SUBJECT_TYPE_UNIX_PROCESS) {
+        uid_t agent_uid, subject_uid;
+
+        agent_uid   = nm_secret_agent_get_owner_uid(agent);
+        subject_uid = nm_auth_subject_get_unix_process_uid(req->subject);
+        if (agent_uid != subject_uid) {
+            _LOGD(agent,
+                  "agent ignored for secrets request " LOG_REQ_FMT " "
+                  "(uid %ld not required %ld)",
+                  LOG_REQ_ARG(req),
+                  (long) agent_uid,
+                  (long) subject_uid);
+            return;
+        }
+    }
+
+    _LOGD(agent, "agent allowed for secrets request " LOG_REQ_FMT, LOG_REQ_ARG(req));
+
+    /* Add this agent to the list, sorted appropriately */
+    req->pending =
+        g_slist_insert_sorted_with_data(req->pending, g_object_ref(agent), agent_compare_func, req);
+}
+
+static void
+request_add_agents(NMAgentManager *self, Request *req)
+{
+    NMAgentManagerPrivate *priv = NM_AGENT_MANAGER_GET_PRIVATE(self);
+    NMSecretAgent *        agent;
+
+    c_list_for_each_entry (agent, &priv->agent_lst_head, agent_lst) {
+        if (agent->fully_registered)
+            request_add_agent(req, agent);
+    }
+}
+
+static void
+request_next_agent(Request *req)
+{
+    NMAgentManager *self;
+    GError *        error = NULL;
+
+    self = req->self;
+
+    nm_secret_agent_cancel_call(req->current, req->current_call_id);
+    nm_assert(!req->current_call_id);
+    g_clear_object(&req->current);
+
+    if (req->pending) {
+        /* Send the request to the next agent */
+        req->current = req->pending->data;
+        req->pending = g_slist_remove(req->pending, req->current);
+
+        _LOGD(req->current,
+              "agent %s secrets for request " LOG_REQ_FMT,
+              _request_type_to_string(req->request_type, TRUE),
+              LOG_REQ_ARG(req));
+
+        switch (req->request_type) {
+        case REQUEST_TYPE_CON_GET:
+            _con_get_request_start(req);
+            break;
+        case REQUEST_TYPE_CON_SAVE:
+            _con_save_request_start(req);
+            break;
+        case REQUEST_TYPE_CON_DEL:
+            _con_del_request_start(req);
+            break;
+        default:
+            g_assert_not_reached();
+        }
+    } else {
+        /* No more secret agents are available to fulfill this secrets request */
+        error = g_error_new_literal(NM_AGENT_MANAGER_ERROR,
+                                    NM_AGENT_MANAGER_ERROR_NO_SECRETS,
+                                    "No agents were available for this request.");
+        req_complete_error(req, error);
+        g_error_free(error);
+    }
+}
+
+static void
+request_remove_agent(Request *req, NMSecretAgent *agent)
+{
+    NMAgentManager *self;
+
+    g_return_if_fail(req != NULL);
+    g_return_if_fail(agent != NULL);
+
+    self = req->self;
+
+    if (agent == req->current) {
+        nm_assert(!g_slist_find(req->pending, agent));
+
+        _LOGD(agent, "current agent removed from secrets request " LOG_REQ_FMT, LOG_REQ_ARG(req));
+
+        switch (req->request_type) {
+        case REQUEST_TYPE_CON_GET:
+        case REQUEST_TYPE_CON_SAVE:
+        case REQUEST_TYPE_CON_DEL:
+            /* This cancels the pending authorization requests. */
+            nm_clear_pointer(&req->con.chain, nm_auth_chain_destroy);
+            break;
+        default:
+            g_assert_not_reached();
+        }
+
+        request_next_agent(req);
+    } else if (g_slist_find(req->pending, agent)) {
+        req->pending = g_slist_remove(req->pending, agent);
+
+        _LOGD(agent, "agent removed from secrets request " LOG_REQ_FMT, LOG_REQ_ARG(req));
+
+        g_object_unref(agent);
+    }
+}
+
+static gboolean
+request_start(gpointer user_data)
+{
+    Request *req = user_data;
+
+    req->idle_id = 0;
+
+    switch (req->request_type) {
+    case REQUEST_TYPE_CON_GET:
+        if (_con_get_try_complete_early(req))
+            goto out;
+        break;
+    default:
+        break;
+    }
+    request_next_agent(req);
+
+out:
+    return FALSE;
+}
+
+/*****************************************************************************/
+
+static void
+_con_get_request_done(NMSecretAgent *      agent,
+                      NMSecretAgentCallId *call_id,
+                      GVariant *           secrets,
+                      GError *             error,
+                      gpointer             user_data)
+{
+    NMAgentManager *self;
+    Request *       req = user_data;
+    GVariant *      setting_secrets;
+    const char *    agent_dbus_owner;
+    gs_free char *  agent_name = NULL;
+
+    g_return_if_fail(call_id == req->current_call_id);
+    g_return_if_fail(agent == req->current);
+    g_return_if_fail(req->request_type == REQUEST_TYPE_CON_GET);
+
+    self = req->self;
+
+    req->current_call_id = NULL;
+
+    if (error) {
+        if (g_error_matches(error, G_IO_ERROR, G_IO_ERROR_CANCELLED)) {
+            _LOGD(agent, "get secrets request cancelled: " LOG_REQ_FMT, LOG_REQ_ARG(req));
+            return;
+        }
+
+        _LOGD(agent,
+              "agent failed secrets request " LOG_REQ_FMT ": %s",
+              LOG_REQ_ARG(req),
+              error->message);
+
+        if (g_error_matches(error, NM_SECRET_AGENT_ERROR, NM_SECRET_AGENT_ERROR_USER_CANCELED)) {
+            error = g_error_new_literal(NM_AGENT_MANAGER_ERROR,
+                                        NM_AGENT_MANAGER_ERROR_USER_CANCELED,
+                                        "User canceled the secrets request.");
+            req_complete_error(req, error);
+            g_error_free(error);
+        } else {
+            /* Tell the failed agent we're no longer interested. */
+            nm_secret_agent_cancel_call(req->current, req->current_call_id);
+
+            /* Try the next agent */
+            request_next_agent(req);
+            maybe_remove_agent_on_error(self, agent, error);
+        }
+        return;
+    }
+
+    /* Ensure the setting we wanted secrets for got returned and has something in it */
+    setting_secrets =
+        g_variant_lookup_value(secrets, req->con.get.setting_name, NM_VARIANT_TYPE_SETTING);
+    if (!setting_secrets || !g_variant_n_children(setting_secrets)) {
+        _LOGD(agent, "agent returned no secrets for request " LOG_REQ_FMT, LOG_REQ_ARG(req));
+        /* Try the next agent */
+        request_next_agent(req);
+        return;
+    }
+
+    _LOGD(agent, "agent returned secrets for request " LOG_REQ_FMT, LOG_REQ_ARG(req));
+
+    agent_name = nm_utils_uid_to_name(nm_secret_agent_get_owner_uid(agent));
+    if (agent_name && !g_utf8_validate(agent_name, -1, NULL)) {
+        /* Needs to be UTF-8 valid since it may be pushed through D-Bus */
+        nm_clear_g_free(&agent_name);
+    }
+
+    agent_dbus_owner = nm_secret_agent_get_dbus_owner(agent);
+
+    req_complete(req, secrets, agent_dbus_owner, agent_name, NULL);
+}
+
+static void
+set_secrets_not_required(NMConnection *connection, GVariant *dict)
+{
+    GVariantIter iter, setting_iter;
+    const char * setting_name = NULL;
+    GVariant *   setting_dict = NULL;
+
+    /* Iterate through the settings dicts */
+    g_variant_iter_init(&iter, dict);
+    while (g_variant_iter_next(&iter, "{&s@a{sv}}", &setting_name, &setting_dict)) {
+        const char *key_name = NULL;
+        NMSetting * setting;
+        GVariant *  val;
+
+        setting = nm_connection_get_setting_by_name(connection, setting_name);
+        if (setting) {
+            /* Now through each secret in the setting and mark it as not required */
+            g_variant_iter_init(&setting_iter, setting_dict);
+            while (g_variant_iter_next(&setting_iter, "{&sv}", &key_name, &val)) {
+                /* For each secret, set the flag that it's not required; VPN
+                 * secrets need slightly different treatment here since the
+                 * "secrets" property is actually a dictionary of secrets.
+                 */
+                if (strcmp(setting_name, NM_SETTING_VPN_SETTING_NAME) == 0
+                    && strcmp(key_name, NM_SETTING_VPN_SECRETS) == 0
+                    && g_variant_is_of_type(val, G_VARIANT_TYPE("a{ss}"))) {
+                    GVariantIter vpn_secret_iter;
+                    const char * secret_name, *secret;
+
+                    g_variant_iter_init(&vpn_secret_iter, val);
+                    while (g_variant_iter_next(&vpn_secret_iter, "{&s&s}", &secret_name, &secret))
+                        nm_setting_set_secret_flags(setting,
+                                                    secret_name,
+                                                    NM_SETTING_SECRET_FLAG_NOT_REQUIRED,
+                                                    NULL);
+                } else
+                    nm_setting_set_secret_flags(setting,
+                                                key_name,
+                                                NM_SETTING_SECRET_FLAG_NOT_REQUIRED,
+                                                NULL);
+                g_variant_unref(val);
+            }
+        }
+        g_variant_unref(setting_dict);
+    }
+}
+
+static void
+_con_get_request_start_proceed(Request *req, gboolean include_system_secrets)
+{
+    NMConnection *tmp;
+
+    g_return_if_fail(req->request_type == REQUEST_TYPE_CON_GET);
+
+    tmp = nm_simple_connection_new_clone(req->con.connection);
+    nm_connection_clear_secrets(tmp);
+    if (include_system_secrets) {
+        if (req->con.get.existing_secrets)
+            (void) nm_connection_update_secrets(tmp,
+                                                req->con.get.setting_name,
+                                                req->con.get.existing_secrets,
+                                                NULL);
+    } else {
+        /* Update secret flags in the temporary connection to indicate that
+         * the system secrets we're not sending to the agent aren't required,
+         * so the agent can properly validate UI controls and such.
+         */
+        if (req->con.get.existing_secrets)
+            set_secrets_not_required(tmp, req->con.get.existing_secrets);
+    }
+
+    req->current_call_id = nm_secret_agent_get_secrets(req->current,
+                                                       req->con.path,
+                                                       tmp,
+                                                       req->con.get.setting_name,
+                                                       (const char **) req->con.get.hints,
+                                                       req->con.get.flags,
+                                                       _con_get_request_done,
+                                                       req);
+    if (!req->current_call_id) {
+        g_warn_if_reached();
+        request_next_agent(req);
+    }
+
+    g_object_unref(tmp);
+}
+
+static void
+_con_get_request_start_validated(NMAuthChain *          chain,
+                                 GDBusMethodInvocation *context,
+                                 gpointer               user_data)
+{
+    NMAgentManager *self;
+    Request *       req = user_data;
+    const char *    perm;
+
+    g_return_if_fail(req->request_type == REQUEST_TYPE_CON_GET);
+
+    self = req->self;
+
+    req->con.chain = NULL;
+
+    /* If the agent obtained the 'modify' permission, we send all system secrets
+     * to it.  If it didn't, we still ask it for secrets, but we don't send
+     * any system secrets.
+     */
+    perm = nm_auth_chain_get_data(chain, "perm");
+    g_assert(perm);
+    if (nm_auth_chain_get_result(chain, perm) == NM_AUTH_CALL_RESULT_YES)
+        req->con.current_has_modify = TRUE;
+
+    _LOGD(req->current,
+          "agent " LOG_REQ_FMT " MODIFY check result %s",
+          LOG_REQ_ARG(req),
+          req->con.current_has_modify ? "YES" : "NO");
+
+    _con_get_request_start_proceed(req, req->con.current_has_modify);
+}
+
+static void
+_con_get_request_start(Request *req)
+{
+    NMAgentManager *     self;
+    NMSettingConnection *s_con;
+    const char *         agent_dbus_owner, *perm;
+
+    self = req->self;
+
+    req->con.current_has_modify = FALSE;
+
+    agent_dbus_owner = nm_secret_agent_get_dbus_owner(req->current);
+
+    /* If the request flags allow user interaction, and there are existing
+     * system secrets (or blank secrets that are supposed to be system-owned),
+     * check whether the agent has the 'modify' permission before sending those
+     * secrets to the agent.  We shouldn't leak system-owned secrets to
+     * unprivileged users.
+     */
+    if ((req->con.get.flags != NM_SECRET_AGENT_GET_SECRETS_FLAG_NONE)
+        && (req->con.get.existing_secrets
+            || _nm_connection_aggregate(req->con.connection,
+                                        NM_CONNECTION_AGGREGATE_ANY_SYSTEM_SECRET_FLAGS,
+                                        NULL))) {
+        _LOGD(NULL,
+              "(" LOG_REQ_FMT ") request has system secrets; checking agent %s for MODIFY",
+              LOG_REQ_ARG(req),
+              agent_dbus_owner);
+
+        req->con.chain = nm_auth_chain_new_subject(nm_secret_agent_get_subject(req->current),
+                                                   NULL,
+                                                   _con_get_request_start_validated,
+                                                   req);
+        nm_assert(req->con.chain);
+
+        /* If the caller is the only user in the connection's permissions, then
+         * we use the 'modify.own' permission instead of 'modify.system'.  If the
+         * request affects more than just the caller, require 'modify.system'.
+         */
+        s_con = nm_connection_get_setting_connection(req->con.connection);
+        g_assert(s_con);
+        if (nm_setting_connection_get_num_permissions(s_con) == 1)
+            perm = NM_AUTH_PERMISSION_SETTINGS_MODIFY_OWN;
+        else
+            perm = NM_AUTH_PERMISSION_SETTINGS_MODIFY_SYSTEM;
+        nm_auth_chain_set_data(req->con.chain, "perm", (gpointer) perm, NULL);
+
+        nm_auth_chain_add_call_unsafe(req->con.chain, perm, TRUE);
+    } else {
+        _LOGD(NULL,
+              "(" LOG_REQ_FMT ") requesting user-owned secrets from agent %s",
+              LOG_REQ_ARG(req),
+              agent_dbus_owner);
+
+        _con_get_request_start_proceed(req, FALSE);
+    }
+}
+
+static gboolean
+_con_get_try_complete_early(Request *req)
+{
+    NMAgentManager * self;
+    gs_unref_variant GVariant *setting_secrets = NULL;
+    gs_unref_object NMConnection *tmp          = NULL;
+    GError *                      error        = NULL;
+
+    self = req->self;
+
+    /* Check if there are any existing secrets */
+    if (req->con.get.existing_secrets)
+        setting_secrets = g_variant_lookup_value(req->con.get.existing_secrets,
+                                                 req->con.get.setting_name,
+                                                 NM_VARIANT_TYPE_SETTING);
+
+    if (!setting_secrets || !g_variant_n_children(setting_secrets))
+        return FALSE;
+
+    /* The connection already had secrets; check if any more are required.
+     * If no more are required, we're done.  If secrets are still needed,
+     * ask a secret agent for more.  This allows admins to provide generic
+     * secrets but allow additional user-specific ones as well.
+     */
+    tmp = nm_simple_connection_new_clone(req->con.connection);
+    g_assert(tmp);
+
+    if (!nm_connection_update_secrets(tmp,
+                                      req->con.get.setting_name,
+                                      req->con.get.existing_secrets,
+                                      &error)) {
+        req_complete_error(req, error);
+        g_clear_error(&error);
+        return TRUE;
+    }
+    /* Do we have everything we need? */
+    if (NM_FLAGS_HAS(req->con.get.flags, NM_SECRET_AGENT_GET_SECRETS_FLAG_ONLY_SYSTEM)
+        || ((nm_connection_need_secrets(tmp, NULL) == NULL)
+            && !NM_FLAGS_HAS(req->con.get.flags, NM_SECRET_AGENT_GET_SECRETS_FLAG_REQUEST_NEW))) {
+        _LOGD(NULL, "(" LOG_REQ_FMT ") system settings secrets sufficient", LOG_REQ_ARG(req));
+
+        /* Got everything, we're done */
+        req_complete(req, req->con.get.existing_secrets, NULL, NULL, NULL);
+        return TRUE;
+    }
+
+    _LOGD(NULL,
+          "(" LOG_REQ_FMT ") system settings secrets insufficient, asking agents",
+          LOG_REQ_ARG(req));
+
+    /* We don't, so ask some agents for additional secrets */
+    if (req->con.get.flags & NM_SECRET_AGENT_GET_SECRETS_FLAG_NO_ERRORS && !req->pending) {
+        /* The request initiated from GetSecrets() via DBus,
+         * don't error out if any secrets are missing. */
+        req_complete(req, req->con.get.existing_secrets, NULL, NULL, NULL);
+        return TRUE;
+    }
+
+    /* Couldn't get secrets from system settings, so now we ask the
+     * agents for secrets.  Let the Agent Manager handle which agents
+     * we'll ask and in which order.
+     */
+    return FALSE;
+}
+
+/**
+ * nm_agent_manager_get_secrets:
+ * @self:
+ * @path:
+ * @connection:
+ * @subject:
+ * @existing_secrets:
+ * @flags:
+ * @hints:
+ * @callback:
+ * @callback_data:
+ *
+ * Requests secrets for a connection.
+ *
+ * This function cannot fail. The callback will be invoked
+ * asynchronously, but it will always be invoked exactly once.
+ * Even for cancellation and disposing of @self. In those latter
+ * cases, the callback is invoked synchronously during the cancellation/
+ * disposal.
+ *
+ * Returns: a call-id to cancel the call.
+ */
+NMAgentManagerCallId
+nm_agent_manager_get_secrets(NMAgentManager *             self,
+                             const char *                 path,
+                             NMConnection *               connection,
+                             NMAuthSubject *              subject,
+                             GVariant *                   existing_secrets,
+                             const char *                 setting_name,
+                             NMSecretAgentGetSecretsFlags flags,
+                             const char *const *          hints,
+                             NMAgentSecretsResultFunc     callback,
+                             gpointer                     callback_data)
+{
+    Request *req;
+
+    g_return_val_if_fail(self != NULL, NULL);
+    g_return_val_if_fail(path && *path, NULL);
+    g_return_val_if_fail(NM_IS_CONNECTION(connection), NULL);
+    g_return_val_if_fail(callback != NULL, NULL);
+
+    nm_log_dbg(LOGD_SETTINGS,
+               "Secrets requested for connection %s (%s/%s)",
+               path,
+               nm_connection_get_id(connection),
+               setting_name);
+
+    /* NOTE: a few things in the Request handling depend on existing_secrets
+     * being NULL if there aren't any system-owned secrets for this connection.
+     * This in turn depends on nm_connection_to_dbus() and nm_setting_to_hash()
+     * both returning NULL if they didn't hash anything.
+     */
+    req = request_new(self, REQUEST_TYPE_CON_GET, nm_connection_get_id(connection), subject);
+
+    req->con.path       = g_strdup(path);
+    req->con.connection = g_object_ref(connection);
+    if (existing_secrets)
+        req->con.get.existing_secrets = g_variant_ref(existing_secrets);
+    req->con.get.setting_name  = g_strdup(setting_name);
+    req->con.get.hints         = g_strdupv((char **) hints);
+    req->con.get.flags         = flags;
+    req->con.get.callback      = callback;
+    req->con.get.callback_data = callback_data;
+
+    if (!(req->con.get.flags & NM_SECRET_AGENT_GET_SECRETS_FLAG_ONLY_SYSTEM))
+        request_add_agents(self, req);
+    req->idle_id = g_idle_add(request_start, req);
+    return req;
+}
+
+void
+nm_agent_manager_cancel_secrets(NMAgentManager *self, NMAgentManagerCallId request_id)
+{
+    g_return_if_fail(self != NULL);
+    g_return_if_fail(request_id);
+    g_return_if_fail(request_id->request_type == REQUEST_TYPE_CON_GET);
+
+    nm_assert(c_list_contains(&NM_AGENT_MANAGER_GET_PRIVATE(self)->request_lst_head,
+                              &request_id->request_lst));
+
+    c_list_unlink(&request_id->request_lst);
+
+    req_complete_cancel(request_id, FALSE);
+}
+
+/*****************************************************************************/
+
+static void
+_con_save_request_done(NMSecretAgent *      agent,
+                       NMSecretAgentCallId *call_id,
+                       GVariant *           secrets,
+                       GError *             error,
+                       gpointer             user_data)
+{
+    NMAgentManager *self;
+    Request *       req = user_data;
+    const char *    agent_dbus_owner;
+
+    g_return_if_fail(call_id == req->current_call_id);
+    g_return_if_fail(agent == req->current);
+    g_return_if_fail(req->request_type == REQUEST_TYPE_CON_SAVE);
+
+    self = req->self;
+
+    req->current_call_id = NULL;
+
+    if (error) {
+        if (g_error_matches(error, G_IO_ERROR, G_IO_ERROR_CANCELLED)) {
+            _LOGD(agent, "save secrets request cancelled: " LOG_REQ_FMT, LOG_REQ_ARG(req));
+            return;
+        }
+
+        _LOGD(agent,
+              "agent failed save secrets request " LOG_REQ_FMT ": %s",
+              LOG_REQ_ARG(req),
+              error->message);
+        /* Try the next agent */
+        request_next_agent(req);
+        maybe_remove_agent_on_error(self, agent, error);
+        return;
+    }
+
+    _LOGD(agent, "agent saved secrets for request " LOG_REQ_FMT, LOG_REQ_ARG(req));
+
+    agent_dbus_owner = nm_secret_agent_get_dbus_owner(agent);
+    req_complete(req, NULL, NULL, agent_dbus_owner, NULL);
+}
+
+static void
+_con_save_request_start(Request *req)
+{
+    req->current_call_id = nm_secret_agent_save_secrets(req->current,
+                                                        req->con.path,
+                                                        req->con.connection,
+                                                        _con_save_request_done,
+                                                        req);
+    if (!req->current_call_id) {
+        g_warn_if_reached();
+        request_next_agent(req);
+    }
+}
+
+void
+nm_agent_manager_save_secrets(NMAgentManager *self,
+                              const char *    path,
+                              NMConnection *  connection,
+                              NMAuthSubject * subject)
+{
+    Request *req;
+
+    g_return_if_fail(self);
+    g_return_if_fail(path && *path);
+    g_return_if_fail(NM_IS_CONNECTION(connection));
+
+    nm_log_dbg(LOGD_SETTINGS,
+               "Saving secrets for connection %s (%s)",
+               path,
+               nm_connection_get_id(connection));
+
+    req = request_new(self, REQUEST_TYPE_CON_SAVE, nm_connection_get_id(connection), subject);
+    req->con.path       = g_strdup(path);
+    req->con.connection = g_object_ref(connection);
+
+    request_add_agents(self, req);
+    req->idle_id = g_idle_add(request_start, req);
+}
+
+/*****************************************************************************/
+
+static void
+_con_del_request_done(NMSecretAgent *      agent,
+                      NMSecretAgentCallId *call_id,
+                      GVariant *           secrets,
+                      GError *             error,
+                      gpointer             user_data)
+{
+    NMAgentManager *self;
+    Request *       req = user_data;
+
+    g_return_if_fail(call_id == req->current_call_id);
+    g_return_if_fail(agent == req->current);
+    g_return_if_fail(req->request_type == REQUEST_TYPE_CON_DEL);
+
+    self = req->self;
+
+    req->current_call_id = NULL;
+
+    if (error) {
+        if (g_error_matches(error, G_IO_ERROR, G_IO_ERROR_CANCELLED)) {
+            _LOGD(agent, "delete secrets request cancelled: " LOG_REQ_FMT, LOG_REQ_ARG(req));
+            return;
+        }
+
+        _LOGD(agent,
+              "agent failed delete secrets request " LOG_REQ_FMT ": %s",
+              LOG_REQ_ARG(req),
+              error->message);
+    } else {
+        _LOGD(agent, "agent deleted secrets for request " LOG_REQ_FMT, LOG_REQ_ARG(req));
+    }
+
+    /* Tell the next agent to delete secrets */
+    request_next_agent(req);
+    if (error)
+        maybe_remove_agent_on_error(self, agent, error);
+}
+
+static void
+_con_del_request_start(Request *req)
+{
+    req->current_call_id = nm_secret_agent_delete_secrets(req->current,
+                                                          req->con.path,
+                                                          req->con.connection,
+                                                          _con_del_request_done,
+                                                          req);
+    if (!req->current_call_id) {
+        g_warn_if_reached();
+        request_next_agent(req);
+    }
+}
+
+void
+nm_agent_manager_delete_secrets(NMAgentManager *self, const char *path, NMConnection *connection)
+{
+    NMAuthSubject *subject;
+    Request *      req;
+
+    g_return_if_fail(self != NULL);
+    g_return_if_fail(path && *path);
+    g_return_if_fail(NM_IS_CONNECTION(connection));
+
+    nm_log_dbg(LOGD_SETTINGS,
+               "Deleting secrets for connection %s (%s)",
+               path,
+               nm_connection_get_id(connection));
+
+    subject = nm_auth_subject_new_internal();
+    req     = request_new(self, REQUEST_TYPE_CON_DEL, nm_connection_get_id(connection), subject);
+    req->con.path       = g_strdup(path);
+    req->con.connection = g_object_ref(connection);
+    g_object_unref(subject);
+
+    request_add_agents(self, req);
+    req->idle_id = g_idle_add(request_start, req);
+}
+
+/*****************************************************************************/
+
+gboolean
+nm_agent_manager_has_agent_with_permission(NMAgentManager *self,
+                                           const char *    username,
+                                           const char *    permission)
+{
+    NMAgentManagerPrivate *priv;
+    NMSecretAgent *        agent;
+
+    g_return_val_if_fail(NM_IS_AGENT_MANAGER(self), FALSE);
+    g_return_val_if_fail(username, FALSE);
+    g_return_val_if_fail(permission, FALSE);
+
+    priv = NM_AGENT_MANAGER_GET_PRIVATE(self);
+
+    c_list_for_each_entry (agent, &priv->agent_lst_head, agent_lst) {
+        if (!agent->fully_registered)
+            continue;
+        if (!nm_streq0(nm_secret_agent_get_owner_username(agent), username))
+            continue;
+        if (nm_secret_agent_has_permission(agent, permission))
+            return TRUE;
+    }
+
+    return FALSE;
+}
+
+/*****************************************************************************/
+
+gboolean
+nm_agent_manager_all_agents_have_capability(NMAgentManager *          manager,
+                                            NMAuthSubject *           subject,
+                                            NMSecretAgentCapabilities capability)
+{
+    NMAgentManagerPrivate *priv = NM_AGENT_MANAGER_GET_PRIVATE(manager);
+    NMSecretAgent *        agent;
+    gboolean               subject_is_unix_process =
+        (nm_auth_subject_get_subject_type(subject) == NM_AUTH_SUBJECT_TYPE_UNIX_PROCESS);
+    gulong subject_uid =
+        subject_is_unix_process ? nm_auth_subject_get_unix_process_uid(subject) : 0u;
+
+    c_list_for_each_entry (agent, &priv->agent_lst_head, agent_lst) {
+        if (!agent->fully_registered)
+            continue;
+        if (subject_is_unix_process && nm_secret_agent_get_owner_uid(agent) != subject_uid)
+            continue;
+        if (!(nm_secret_agent_get_capabilities(agent) & capability))
+            return FALSE;
+    }
+
+    return TRUE;
+}
+
+/*****************************************************************************/
+
+static void
+authority_changed_cb(NMAuthManager *auth_manager, NMAgentManager *self)
+{
+    NMAgentManagerPrivate *priv = NM_AGENT_MANAGER_GET_PRIVATE(self);
+    NMSecretAgent *        agent;
+
+    c_list_for_each_entry (agent, &priv->agent_lst_head, agent_lst)
+        _agent_create_auth_chain(self, agent, NULL);
+}
+
+/*****************************************************************************/
+
+static void
+nm_agent_manager_init(NMAgentManager *self)
+{
+    NMAgentManagerPrivate *priv = NM_AGENT_MANAGER_GET_PRIVATE(self);
+
+    priv->agent_version_id = 1;
+    c_list_init(&priv->agent_lst_head);
+    c_list_init(&priv->request_lst_head);
+}
+
+static void
+constructed(GObject *object)
+{
+    NMAgentManagerPrivate *priv = NM_AGENT_MANAGER_GET_PRIVATE(object);
+
+    G_OBJECT_CLASS(nm_agent_manager_parent_class)->constructed(object);
+
+    priv->auth_mgr        = g_object_ref(nm_auth_manager_get());
+    priv->session_monitor = g_object_ref(nm_session_monitor_get());
+
+    nm_dbus_object_export(NM_DBUS_OBJECT(object));
+
+    g_signal_connect(priv->auth_mgr,
+                     NM_AUTH_MANAGER_SIGNAL_CHANGED,
+                     G_CALLBACK(authority_changed_cb),
+                     object);
+}
+
+static void
+dispose(GObject *object)
+{
+    NMAgentManager *       self = NM_AGENT_MANAGER(object);
+    NMAgentManagerPrivate *priv = NM_AGENT_MANAGER_GET_PRIVATE(self);
+    Request *              request;
+    NMSecretAgent *        agent;
+
+    while ((request = c_list_first_entry(&priv->request_lst_head, Request, request_lst))) {
+        c_list_unlink(&request->request_lst);
+        req_complete_cancel(request, TRUE);
+    }
+
+    while ((agent = c_list_first_entry(&priv->agent_lst_head, NMSecretAgent, agent_lst)))
+        _agent_remove(self, agent);
+
+    if (priv->auth_mgr) {
+        g_signal_handlers_disconnect_by_func(priv->auth_mgr,
+                                             G_CALLBACK(authority_changed_cb),
+                                             object);
+        g_clear_object(&priv->auth_mgr);
+    }
+
+    nm_dbus_object_unexport(NM_DBUS_OBJECT(object));
+
+    g_clear_object(&priv->session_monitor);
+
+    G_OBJECT_CLASS(nm_agent_manager_parent_class)->dispose(object);
+}
+
+static const NMDBusInterfaceInfoExtended interface_info_agent_manager = {
+    .parent = NM_DEFINE_GDBUS_INTERFACE_INFO_INIT(
+        NM_DBUS_INTERFACE_AGENT_MANAGER,
+        .methods = NM_DEFINE_GDBUS_METHOD_INFOS(
+            NM_DEFINE_DBUS_METHOD_INFO_EXTENDED(
+                NM_DEFINE_GDBUS_METHOD_INFO_INIT(
+                    "Register",
+                    .in_args =
+                        NM_DEFINE_GDBUS_ARG_INFOS(NM_DEFINE_GDBUS_ARG_INFO("identifier", "s"), ), ),
+                .handle = impl_agent_manager_register, ),
+            NM_DEFINE_DBUS_METHOD_INFO_EXTENDED(
+                NM_DEFINE_GDBUS_METHOD_INFO_INIT(
+                    "RegisterWithCapabilities",
+                    .in_args = NM_DEFINE_GDBUS_ARG_INFOS(
+                        NM_DEFINE_GDBUS_ARG_INFO("identifier", "s"),
+                        NM_DEFINE_GDBUS_ARG_INFO("capabilities", "u"), ), ),
+                .handle = impl_agent_manager_register_with_capabilities, ),
+            NM_DEFINE_DBUS_METHOD_INFO_EXTENDED(NM_DEFINE_GDBUS_METHOD_INFO_INIT("Unregister", ),
+                                                .handle = impl_agent_manager_unregister, ), ), ),
+};
+
+static void
+nm_agent_manager_class_init(NMAgentManagerClass *agent_manager_class)
+{
+    GObjectClass *     object_class      = G_OBJECT_CLASS(agent_manager_class);
+    NMDBusObjectClass *dbus_object_class = NM_DBUS_OBJECT_CLASS(agent_manager_class);
+
+    dbus_object_class->export_path     = NM_DBUS_EXPORT_PATH_STATIC(NM_DBUS_PATH_AGENT_MANAGER);
+    dbus_object_class->interface_infos = NM_DBUS_INTERFACE_INFOS(&interface_info_agent_manager);
+
+    object_class->constructed = constructed;
+    object_class->dispose     = dispose;
+
+    signals[AGENT_REGISTERED] = g_signal_new(NM_AGENT_MANAGER_AGENT_REGISTERED,
+                                             G_OBJECT_CLASS_TYPE(object_class),
+                                             G_SIGNAL_RUN_FIRST,
+                                             0,
+                                             NULL,
+                                             NULL,
+                                             g_cclosure_marshal_VOID__OBJECT,
+                                             G_TYPE_NONE,
+                                             1,
+                                             G_TYPE_OBJECT);
+}