diff options
| author | Dan Williams <dcbw@redhat.com> | 2014-01-24 12:28:35 -0600 |
|---|---|---|
| committer | Dan Williams <dcbw@redhat.com> | 2014-01-24 12:32:43 -0600 |
| commit | c9b6f13c56583d95199857b9e0390962b642dae5 (patch) | |
| tree | b8796ee717488192c20755095122e1c2becb52c5 | |
| parent | de56f28db62d042c2c293867750228d6ac253892 (diff) | |
| download | NetworkManager-c9b6f13c56583d95199857b9e0390962b642dae5.tar.gz | |
policy: fix policy after dcbw/kill-at-console merge (bgo #707983) (rh #979416)
Polkit documentation suggests that <allow_any> applies to all
clients, but that's actually not the case. allow_any,
allow_inactive, and allow_active are evaluated individually based
on whether the user is local and active (allow_active), local and
inactive (allow_inactive), and not local (allow_any). Thus all
three allow options must be specified for any authorization other
than 'no'.
| -rw-r--r-- | policy/org.freedesktop.NetworkManager.policy.in.in | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/policy/org.freedesktop.NetworkManager.policy.in.in b/policy/org.freedesktop.NetworkManager.policy.in.in index 2de066c1e0..cb229990ca 100644 --- a/policy/org.freedesktop.NetworkManager.policy.in.in +++ b/policy/org.freedesktop.NetworkManager.policy.in.in @@ -85,7 +85,9 @@ <_description>Modify personal network connections</_description> <_message>System policy prevents modification of personal network settings</_message> <defaults> - <allow_any>yes</allow_any> + <allow_any>auth_self_keep</allow_any> + <allow_inactive>yes</allow_inactive> + <allow_active>yes</allow_active> </defaults> </action> @@ -93,7 +95,9 @@ <_description>Modify network connections for all users</_description> <_message>System policy prevents modification of network settings for all users</_message> <defaults> - <allow_any>@NM_MODIFY_SYSTEM_POLICY@</allow_any> + <allow_any>auth_admin_keep</allow_any> + <allow_inactive>@NM_MODIFY_SYSTEM_POLICY@</allow_inactive> + <allow_active>@NM_MODIFY_SYSTEM_POLICY@</allow_active> </defaults> </action> @@ -102,6 +106,8 @@ <_message>System policy prevents modification of the persistent system hostname</_message> <defaults> <allow_any>auth_admin_keep</allow_any> + <allow_inactive>auth_admin_keep</allow_inactive> + <allow_active>auth_admin_keep</allow_active> </defaults> </action> |