From bfe522304da217296e2a61040f58e35ec5d6f3f2 Mon Sep 17 00:00:00 2001 From: Michael Biebl Date: Mon, 16 Aug 2021 09:51:46 +0200 Subject: New upstream version 1.30.6 --- data/NetworkManager.service.in | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'data') diff --git a/data/NetworkManager.service.in b/data/NetworkManager.service.in index 91ebd9a3..9cf1c3d2 100644 --- a/data/NetworkManager.service.in +++ b/data/NetworkManager.service.in @@ -19,6 +19,10 @@ CapabilityBoundingSet=CAP_NET_ADMIN CAP_DAC_OVERRIDE CAP_NET_RAW CAP_NET_BIND_SE ProtectSystem=true ProtectHome=read-only +# We require file descriptors for DHCP etc. When activating many interfaces, +# the default limit of 1024 is easily reached. +LimitNOFILE=65536 + [Install] WantedBy=multi-user.target Also=NetworkManager-dispatcher.service -- cgit 1.3.0-6-gf8a5 From e74c568b07b50b97873fb4ee1d776dedefbd54d6 Mon Sep 17 00:00:00 2001 From: Michael Biebl Date: Fri, 1 Oct 2021 23:05:04 +0200 Subject: New upstream version 1.32.12 --- data/84-nm-drivers.rules | 2 +- data/85-nm-unmanaged.rules | 2 +- data/90-nm-thunderbolt.rules | 2 +- data/NetworkManager.service.in | 2 ++ data/org.freedesktop.NetworkManager.policy.in.in | 2 +- 5 files changed, 6 insertions(+), 4 deletions(-) (limited to 'data') diff --git a/data/84-nm-drivers.rules b/data/84-nm-drivers.rules index e398cb9f..148acade 100644 --- a/data/84-nm-drivers.rules +++ b/data/84-nm-drivers.rules @@ -2,7 +2,7 @@ # To override or extend the rules place a file in /etc/udev/rules.d SUBSYSTEM!="net", GOTO="nm_drivers_end" -ACTION!="add|change", GOTO="nm_drivers_end" +ACTION!="add|change|move", GOTO="nm_drivers_end" # Determine ID_NET_DRIVER if there's no ID_NET_DRIVER or DRIVERS (old udev?) ENV{ID_NET_DRIVER}=="?*", GOTO="nm_drivers_end" diff --git a/data/85-nm-unmanaged.rules b/data/85-nm-unmanaged.rules index edc4ddbe..eae8d7ce 100644 --- a/data/85-nm-unmanaged.rules +++ b/data/85-nm-unmanaged.rules @@ -2,7 +2,7 @@ # To override or extend the rules place a file in /etc/udev/rules.d SUBSYSTEM!="net", GOTO="nm_unmanaged_end" -ACTION!="add|change", GOTO="nm_unmanaged_end" +ACTION!="add|change|move", GOTO="nm_unmanaged_end" # VirtualBox host networking. Out-of-tree driver that looks like an ordinary # Ethernet. No parent device (lives in /virtual/), no support for ethtool diff --git a/data/90-nm-thunderbolt.rules b/data/90-nm-thunderbolt.rules index 52d8bb41..be105fd4 100644 --- a/data/90-nm-thunderbolt.rules +++ b/data/90-nm-thunderbolt.rules @@ -1,7 +1,7 @@ # Do not modify this file, it will get overwritten on updates. # To override or extend the rules place a file in /etc/udev/rules.d -ACTION!="add", GOTO="nm_thunderbolt_end" +ACTION!="add|change|move", GOTO="nm_thunderbolt_end" # Load he thunderbolt-net driver if we a device of type thunderbolt_xdomain # is added. diff --git a/data/NetworkManager.service.in b/data/NetworkManager.service.in index 9cf1c3d2..e23b3a52 100644 --- a/data/NetworkManager.service.in +++ b/data/NetworkManager.service.in @@ -14,6 +14,8 @@ ExecStart=@sbindir@/NetworkManager --no-daemon Restart=on-failure # NM doesn't want systemd to kill its children for it KillMode=process + +# CAP_DAC_OVERRIDE: required to open /run/openvswitch/db.sock socket. CapabilityBoundingSet=CAP_NET_ADMIN CAP_DAC_OVERRIDE CAP_NET_RAW CAP_NET_BIND_SERVICE CAP_SETGID CAP_SETUID CAP_SYS_MODULE CAP_AUDIT_WRITE CAP_KILL CAP_SYS_CHROOT ProtectSystem=true diff --git a/data/org.freedesktop.NetworkManager.policy.in.in b/data/org.freedesktop.NetworkManager.policy.in.in index 8b6ea515..8d46dac7 100644 --- a/data/org.freedesktop.NetworkManager.policy.in.in +++ b/data/org.freedesktop.NetworkManager.policy.in.in @@ -6,7 +6,7 @@ NetworkManager - http://www.gnome.org/projects/NetworkManager + https://networkmanager.dev/ nm-icon -- cgit 1.3.0-6-gf8a5 From 88c227d90a6b7b388c5c85d72802a0ca8f05ed5c Mon Sep 17 00:00:00 2001 From: Michael Biebl Date: Thu, 13 Jan 2022 22:30:39 +0100 Subject: New upstream version 1.34.0 --- data/NetworkManager-dispatcher.service.in | 7 +++ data/meson.build | 1 + data/nm-priv-helper.service.in | 79 +++++++++++++++++++++++++++++++ 3 files changed, 87 insertions(+) create mode 100644 data/nm-priv-helper.service.in (limited to 'data') diff --git a/data/NetworkManager-dispatcher.service.in b/data/NetworkManager-dispatcher.service.in index c450478b..1a45f353 100644 --- a/data/NetworkManager-dispatcher.service.in +++ b/data/NetworkManager-dispatcher.service.in @@ -5,6 +5,13 @@ Description=Network Manager Script Dispatcher Service Type=dbus BusName=org.freedesktop.nm_dispatcher ExecStart=@libexecdir@/nm-dispatcher +NotifyAccess=main + +# Enable debug logging in dispatcher service. Note that dispatcher +# also honors debug logging requests from NetworkManager, so you +# can also control logging requests with +# `nmcli general logging domain DISPATCHER level TRACE`. +#Environment=NM_DISPATCHER_DEBUG_LOG=1 # We want to allow scripts to spawn long-running daemons, so tell # systemd to not clean up when nm-dispatcher exits diff --git a/data/meson.build b/data/meson.build index 64a1372b..35e3de52 100644 --- a/data/meson.build +++ b/data/meson.build @@ -11,6 +11,7 @@ if install_systemdunitdir services = [ 'NetworkManager-dispatcher.service.in', 'NetworkManager.service.in', + 'nm-priv-helper.service.in', ] if have_systemd_200 diff --git a/data/nm-priv-helper.service.in b/data/nm-priv-helper.service.in new file mode 100644 index 00000000..aa028e6c --- /dev/null +++ b/data/nm-priv-helper.service.in @@ -0,0 +1,79 @@ +[Unit] +Description=NetworkManager Privileged Helper + +# +# nm-priv-helper exists for privilege separation. It allows to run +# NetworkManager without certain capabilities, and ask nm-priv-helper +# for special operations where more privileges are required. +# + +# While nm-priv-helper has privileges that NetworkManager has not, it +# does not mean that itself should run totally unconstrained. On the +# contrary, it also should only have permissions it requires. +# +# nm-priv-helper rejects all requests that come from any other than the +# name owner of "org.freedesktop.NetworkManager" (that is, +# NetworkManager process itself). It is thus only an implementation +# detail and provides no public API to the user. + +[Service] +Type=dbus +BusName=org.freedesktop.nm-priv-helper +ExecStart=@libexecdir@/nm-priv-helper +NotifyAccess=main + +# Extra configuration options. Set via `systemctl edit +# nm-priv-helper.service`: +# +# FOR TESTING ONLY: disable authentication to allow requests from +# everybody. Don't set this outside of testing! +#Environment=NM_PRIV_HELPER_NO_AUTH_FOR_TESTING=1 +# +# The logging level for debug messages (to stdout). +#Environment=NM_PRIV_HELPER_LOG=TRACE +# +# nm-priv-helper will exit on idle after timeout. Set timeout here or +# set to 2147483647 for infinity. + +#Environment=NM_PRIV_HELPER_IDLE_TIMEOUT_MSEC=10000 + + +# Restrict: +AmbientCapabilities= +CapabilityBoundingSet= +PrivateDevices=true +PrivateMounts=true +PrivateNetwork=true +PrivateTmp=true +ProtectClock=true +ProtectControlGroups=true +ProtectHome=true +ProtectHostname=true +ProtectKernelLogs=true +ProtectKernelModules=true +ProtectKernelTunables=true +ProtectSystem=strict +RestrictAddressFamilies= +RestrictNamespaces=true +SystemCallFilter=~@clock +SystemCallFilter=~@cpu-emulation +SystemCallFilter=~@debug +SystemCallFilter=~@module +SystemCallFilter=~@mount +SystemCallFilter=~@obsolete +SystemCallFilter=~@privileged +SystemCallFilter=~@raw-io +SystemCallFilter=~@reboot +SystemCallFilter=~@swap +NoNewPrivileges=true +SupplementaryGroups= + +# Grant: +CapabilityBoundingSet=CAP_DAC_OVERRIDE +PrivateUsers=no +RestrictAddressFamilies=AF_UNIX +SystemCallFilter=@resources + + +[Install] +Alias=dbus-org.freedesktop.nm-priv-helper.service -- cgit 1.3.0-6-gf8a5