1b4a165
1b4a1656a549afef793290e72f60f4461509a60d1dde195
1c47ce0| Status | File | + | - |
|---|---|---|---|
| A |
examples/force-networkmanager-auth-admin.rules
|
18 | 0 |
| M |
examples/sprint-03-validation-report-2026-02-18.md
|
16 | 1 |
examples/force-networkmanager-auth-admin.rulesadded@@ -0,0 +1,18 @@ | ||
| 1 | +// Temporary validation override for Sprint 03 NetworkManager challenge testing. | |
| 2 | +// | |
| 3 | +// Install as: | |
| 4 | +// sudo install -m644 examples/force-networkmanager-auth-admin.rules \ | |
| 5 | +// /etc/polkit-1/rules.d/00-garcard-networkmanager-auth.rules | |
| 6 | +// sudo systemctl restart polkit | |
| 7 | +// | |
| 8 | +// Remove after validation: | |
| 9 | +// sudo rm -f /etc/polkit-1/rules.d/00-garcard-networkmanager-auth.rules | |
| 10 | +// sudo systemctl restart polkit | |
| 11 | +// | |
| 12 | +// This rule forces admin authentication for NetworkManager actions even when | |
| 13 | +// host rules would otherwise auto-authorize networkmanager-group members. | |
| 14 | +polkit.addRule(function(action, subject) { | |
| 15 | + if (action.id.indexOf("org.freedesktop.NetworkManager.") === 0) { | |
| 16 | + return polkit.Result.AUTH_ADMIN_KEEP; | |
| 17 | + } | |
| 18 | +}); | |
examples/sprint-03-validation-report-2026-02-18.mdmodified@@ -31,8 +31,23 @@ | ||
| 31 | 31 | - Result: authorized (`polkit.result=yes`) in this host policy context; no challenge callback required. |
| 32 | 32 | 4. Policy inspection (`pkaction --verbose`) confirms host/session policy variance: |
| 33 | 33 | - multiple NetworkManager actions resolve to active `yes` in this environment even when defaults are `auth_admin_keep`. |
| 34 | +5. Host policy root-cause confirmation: | |
| 35 | + - `/etc/static/polkit-1/rules.d/10-nixos.rules` contains: | |
| 36 | + - `subject.isInGroup("networkmanager")` + `org.freedesktop.NetworkManager.*` -> `polkit.Result.YES` | |
| 37 | + - session user groups include `networkmanager` (`id` output), so NetworkManager probes bypass challenge by design. | |
| 38 | + | |
| 39 | +## Deferred Caveat Closure Plan | |
| 40 | +1. Use `examples/force-networkmanager-auth-admin.rules` as temporary override. | |
| 41 | +2. Install and reload policy: | |
| 42 | + - `sudo install -m644 examples/force-networkmanager-auth-admin.rules /etc/polkit-1/rules.d/00-garcard-networkmanager-auth.rules` | |
| 43 | + - `sudo systemctl restart polkit` | |
| 44 | +3. Re-run probe while daemon is active: | |
| 45 | + - `pkcheck --allow-user-interaction --process $$ --action-id org.freedesktop.NetworkManager.settings.modify.system` | |
| 46 | +4. Expect callback logs from `garcard` auth request processing path. | |
| 47 | +5. Remove override and restart polkit after validation. | |
| 34 | 48 | |
| 35 | 49 | ## Conclusion |
| 36 | 50 | 1. Sprint 03 static integration wiring is in place. |
| 37 | 51 | 2. logind-side runtime challenge callback is verified with live daemon. |
| 38 | -3. NetworkManager challenge callback is policy-dependent on this host and should be re-run on a profile that enforces admin challenge for active users. | |
| 52 | +3. NetworkManager challenge suppression cause is identified and reproducible. | |
| 53 | +4. A deterministic override path is documented to force and validate the callback path on this host. | |