From 537bfce2bda471c92caabd388589230200891509 Mon Sep 17 00:00:00 2001 From: Michael Biebl Date: Fri, 3 Jul 2026 19:53:18 +0200 Subject: New upstream version 1.58~rc1 --- data/NetworkManager-config-initrd.service.in | 5 +- data/NetworkManager-initrd.service.in | 10 +- data/NetworkManager-wait-online-initrd.service.in | 5 +- data/NetworkManager.service.in | 10 +- data/meson.build | 10 +- data/org.freedesktop.NetworkManager.policy.in | 174 ++++++++++++++++++++++ data/org.freedesktop.NetworkManager.policy.in.in | 174 ---------------------- 7 files changed, 187 insertions(+), 201 deletions(-) create mode 100644 data/org.freedesktop.NetworkManager.policy.in delete mode 100644 data/org.freedesktop.NetworkManager.policy.in.in (limited to 'data') diff --git a/data/NetworkManager-config-initrd.service.in b/data/NetworkManager-config-initrd.service.in index 4baf0f64..4f038036 100644 --- a/data/NetworkManager-config-initrd.service.in +++ b/data/NetworkManager-config-initrd.service.in @@ -1,10 +1,10 @@ [Unit] Description=NetworkManager Configuration (initrd) +AssertPathExists=/etc/initrd-release DefaultDependencies=no Wants=systemd-journald.socket After=systemd-journald.socket Before=systemd-udevd.service systemd-udev-trigger.service -ConditionPathExists=/etc/initrd-release [Service] Type=oneshot @@ -22,6 +22,3 @@ ExecStartPost=/bin/sh -c ' \ fi \ ' RemainAfterExit=yes - -[Install] -WantedBy=initrd.target diff --git a/data/NetworkManager-initrd.service.in b/data/NetworkManager-initrd.service.in index aef73a57..f936ffd2 100644 --- a/data/NetworkManager-initrd.service.in +++ b/data/NetworkManager-initrd.service.in @@ -1,11 +1,11 @@ [Unit] Description=NetworkManager (initrd) +AssertPathExists=/etc/initrd-release DefaultDependencies=no Wants=systemd-udev-trigger.service network.target After=systemd-udev-trigger.service network-pre.target dbus.service NetworkManager-config-initrd.service Before=network.target BindsTo=dbus.service -ConditionPathExists=/etc/initrd-release ConditionPathExists=/run/NetworkManager/initrd/neednet ConditionPathExistsGlob=|/usr/lib/NetworkManager/system-connections/* ConditionPathExistsGlob=|/run/NetworkManager/system-connections/* @@ -22,11 +22,3 @@ Environment=NM_CONFIG_ENABLE_TAG=initrd Restart=on-failure ProtectSystem=true ProtectHome=read-only - -[Install] -WantedBy=initrd.target -# We want to enable NetworkManager-wait-online-initrd.service whenever this -# service is enabled. NetworkManager-wait-online-initrd.service has -# WantedBy=network-online.target, so enabling it only has an effect if -# network-online.target itself is enabled or pulled in by some other unit. -Also=NetworkManager-config-initrd.service NetworkManager-wait-online-initrd.service diff --git a/data/NetworkManager-wait-online-initrd.service.in b/data/NetworkManager-wait-online-initrd.service.in index da4a2522..b89aa816 100644 --- a/data/NetworkManager-wait-online-initrd.service.in +++ b/data/NetworkManager-wait-online-initrd.service.in @@ -1,10 +1,10 @@ [Unit] Description=NetworkManager Wait Online (initrd) +AssertPathExists=/etc/initrd-release DefaultDependencies=no Requires=NetworkManager-initrd.service After=NetworkManager-initrd.service Before=network-online.target -ConditionPathExists=/etc/initrd-release ConditionPathExists=/run/NetworkManager/initrd/neednet [Service] @@ -21,6 +21,3 @@ Type=oneshot ExecStart=@bindir@/nm-online -s -q RemainAfterExit=yes Environment=NM_ONLINE_TIMEOUT=3600 - -[Install] -WantedBy=initrd.target network-online.target diff --git a/data/NetworkManager.service.in b/data/NetworkManager.service.in index d0cd8b73..b27b8d2d 100644 --- a/data/NetworkManager.service.in +++ b/data/NetworkManager.service.in @@ -21,8 +21,16 @@ TimeoutStartSec=600 CapabilityBoundingSet=CAP_NET_ADMIN CAP_DAC_OVERRIDE CAP_NET_RAW CAP_BPF CAP_NET_BIND_SERVICE CAP_SETGID CAP_SETUID CAP_SYS_MODULE CAP_AUDIT_WRITE CAP_KILL CAP_SYS_CHROOT -ProtectSystem=true +PrivateTmp=true + +ProtectClock=true +ProtectControlGroups=true ProtectHome=read-only +ProtectKernelLogs=true +ProtectSystem=true + +RestrictRealtime=true +RestrictSUIDSGID=true # We require file descriptors for DHCP etc. When activating many interfaces, # the default limit of 1024 is easily reached. diff --git a/data/meson.build b/data/meson.build index 34c98e3b..3e292cb2 100644 --- a/data/meson.build +++ b/data/meson.build @@ -55,16 +55,8 @@ if install_udevdir endif if enable_polkit - policy = 'org.freedesktop.NetworkManager.policy' - - policy_in = configure_file( - input: policy + '.in.in', - output: '@BASENAME@', - configuration: data_conf, - ) - i18n.merge_file( - input: policy_in, + input: 'org.freedesktop.NetworkManager.policy.in', output: '@BASENAME@', po_dir: po_dir, install: true, diff --git a/data/org.freedesktop.NetworkManager.policy.in b/data/org.freedesktop.NetworkManager.policy.in new file mode 100644 index 00000000..cb143a2d --- /dev/null +++ b/data/org.freedesktop.NetworkManager.policy.in @@ -0,0 +1,174 @@ + + + + + + NetworkManager + https://networkmanager.dev/ + nm-icon + + + Enable or disable system networking + System policy prevents enabling or disabling system networking + + no + yes + + + + + Reload NetworkManager configuration + System policy prevents reloading NetworkManager + + auth_admin_keep + auth_admin_keep + auth_admin_keep + + + + + Put NetworkManager to sleep or wake it up (should only be used by system power management) + System policy prevents putting NetworkManager to sleep or waking it up + + no + no + + + + + Enable or disable Wi-Fi devices + System policy prevents enabling or disabling Wi-Fi devices + + no + yes + + + + + Enable or disable mobile broadband devices + System policy prevents enabling or disabling mobile broadband devices + + no + yes + + + + + Enable or disable WiMAX mobile broadband devices + System policy prevents enabling or disabling WiMAX mobile broadband devices + + no + yes + + + + + Allow control of network connections + System policy prevents control of network connections + + auth_admin + yes + yes + + + + + Allow control of Wi-Fi scans + System policy prevents Wi-Fi scans + + auth_admin + yes + yes + + + + + Connection sharing via a protected Wi-Fi network + System policy prevents sharing connections via a protected Wi-Fi network + + no + yes + + + + + Connection sharing via an open Wi-Fi network + System policy prevents sharing connections via an open Wi-Fi network + + no + yes + + + + + Modify personal network connections + System policy prevents modification of personal network settings + + auth_self_keep + yes + yes + + + + + Modify network connections for all users + System policy prevents modification of network settings for all users + + auth_admin_keep + auth_admin_keep + auth_admin_keep + + + + + Modify persistent system hostname + System policy prevents modification of the persistent system hostname + + auth_admin_keep + auth_admin_keep + auth_admin_keep + + + + + Modify persistent global DNS configuration + System policy prevents modification of the persistent global DNS configuration + + auth_admin_keep + auth_admin_keep + auth_admin_keep + + + + + Perform a checkpoint or rollback of interfaces configuration + System policy prevents the creation of a checkpoint or its rollback + + auth_admin_keep + auth_admin_keep + auth_admin_keep + + + + + Enable or disable device statistics + System policy prevents enabling or disabling device statistics + + no + yes + + + + + Enable or disable connectivity checking + System policy prevents enabling or disabling connectivity checking + + no + yes + + + + + diff --git a/data/org.freedesktop.NetworkManager.policy.in.in b/data/org.freedesktop.NetworkManager.policy.in.in deleted file mode 100644 index 13a0a5b5..00000000 --- a/data/org.freedesktop.NetworkManager.policy.in.in +++ /dev/null @@ -1,174 +0,0 @@ - - - - - - NetworkManager - https://networkmanager.dev/ - nm-icon - - - Enable or disable system networking - System policy prevents enabling or disabling system networking - - no - yes - - - - - Reload NetworkManager configuration - System policy prevents reloading NetworkManager - - auth_admin_keep - auth_admin_keep - auth_admin_keep - - - - - Put NetworkManager to sleep or wake it up (should only be used by system power management) - System policy prevents putting NetworkManager to sleep or waking it up - - no - no - - - - - Enable or disable Wi-Fi devices - System policy prevents enabling or disabling Wi-Fi devices - - no - yes - - - - - Enable or disable mobile broadband devices - System policy prevents enabling or disabling mobile broadband devices - - no - yes - - - - - Enable or disable WiMAX mobile broadband devices - System policy prevents enabling or disabling WiMAX mobile broadband devices - - no - yes - - - - - Allow control of network connections - System policy prevents control of network connections - - auth_admin - yes - yes - - - - - Allow control of Wi-Fi scans - System policy prevents Wi-Fi scans - - auth_admin - yes - yes - - - - - Connection sharing via a protected Wi-Fi network - System policy prevents sharing connections via a protected Wi-Fi network - - no - yes - - - - - Connection sharing via an open Wi-Fi network - System policy prevents sharing connections via an open Wi-Fi network - - no - yes - - - - - Modify personal network connections - System policy prevents modification of personal network settings - - auth_self_keep - yes - yes - - - - - Modify network connections for all users - System policy prevents modification of network settings for all users - - auth_admin_keep - @NM_MODIFY_SYSTEM_POLICY@ - @NM_MODIFY_SYSTEM_POLICY@ - - - - - Modify persistent system hostname - System policy prevents modification of the persistent system hostname - - auth_admin_keep - auth_admin_keep - auth_admin_keep - - - - - Modify persistent global DNS configuration - System policy prevents modification of the persistent global DNS configuration - - auth_admin_keep - auth_admin_keep - auth_admin_keep - - - - - Perform a checkpoint or rollback of interfaces configuration - System policy prevents the creation of a checkpoint or its rollback - - auth_admin_keep - auth_admin_keep - auth_admin_keep - - - - - Enable or disable device statistics - System policy prevents enabling or disabling device statistics - - no - yes - - - - - Enable or disable connectivity checking - System policy prevents enabling or disabling connectivity checking - - no - yes - - - - - -- cgit 1.3.0-6-gf8a5