gardesk/garcard / 1b4a165

Browse files

Document NetworkManager challenge override

Authored by mfwolffe <wolffemf@dukes.jmu.edu>
SHA
1b4a1656a549afef793290e72f60f4461509a60d
Parents
1dde195
Tree
1c47ce0

2 changed files

StatusFile+-
A examples/force-networkmanager-auth-admin.rules 18 0
M examples/sprint-03-validation-report-2026-02-18.md 16 1
examples/force-networkmanager-auth-admin.rulesadded
@@ -0,0 +1,18 @@ 
1
+// Temporary validation override for Sprint 03 NetworkManager challenge testing.
2
+//
3
+// Install as:
4
+//   sudo install -m644 examples/force-networkmanager-auth-admin.rules \
5
+//     /etc/polkit-1/rules.d/00-garcard-networkmanager-auth.rules
6
+//   sudo systemctl restart polkit
7
+//
8
+// Remove after validation:
9
+//   sudo rm -f /etc/polkit-1/rules.d/00-garcard-networkmanager-auth.rules
10
+//   sudo systemctl restart polkit
11
+//
12
+// This rule forces admin authentication for NetworkManager actions even when
13
+// host rules would otherwise auto-authorize networkmanager-group members.
14
+polkit.addRule(function(action, subject) {
15
+  if (action.id.indexOf("org.freedesktop.NetworkManager.") === 0) {
16
+    return polkit.Result.AUTH_ADMIN_KEEP;
17
+  }
18
+});
examples/sprint-03-validation-report-2026-02-18.mdmodified
@@ -31,8 +31,23 @@ 
31
    - Result: authorized (`polkit.result=yes`) in this host policy context; no challenge callback required.
31
    - Result: authorized (`polkit.result=yes`) in this host policy context; no challenge callback required.
32
 4. Policy inspection (`pkaction --verbose`) confirms host/session policy variance:
32
 4. Policy inspection (`pkaction --verbose`) confirms host/session policy variance:
33
    - multiple NetworkManager actions resolve to active `yes` in this environment even when defaults are `auth_admin_keep`.
33
    - multiple NetworkManager actions resolve to active `yes` in this environment even when defaults are `auth_admin_keep`.
34
+5. Host policy root-cause confirmation:
35
+   - `/etc/static/polkit-1/rules.d/10-nixos.rules` contains:
36
+     - `subject.isInGroup("networkmanager")` + `org.freedesktop.NetworkManager.*` -> `polkit.Result.YES`
37
+   - session user groups include `networkmanager` (`id` output), so NetworkManager probes bypass challenge by design.
38
+
39
+## Deferred Caveat Closure Plan
40
+1. Use `examples/force-networkmanager-auth-admin.rules` as temporary override.
41
+2. Install and reload policy:
42
+   - `sudo install -m644 examples/force-networkmanager-auth-admin.rules /etc/polkit-1/rules.d/00-garcard-networkmanager-auth.rules`
43
+   - `sudo systemctl restart polkit`
44
+3. Re-run probe while daemon is active:
45
+   - `pkcheck --allow-user-interaction --process $$ --action-id org.freedesktop.NetworkManager.settings.modify.system`
46
+4. Expect callback logs from `garcard` auth request processing path.
47
+5. Remove override and restart polkit after validation.
34
 
48
 
35
 ## Conclusion
49
 ## Conclusion
36
 1. Sprint 03 static integration wiring is in place.
50
 1. Sprint 03 static integration wiring is in place.
37
 2. logind-side runtime challenge callback is verified with live daemon.
51
 2. logind-side runtime challenge callback is verified with live daemon.
38
-3. NetworkManager challenge callback is policy-dependent on this host and should be re-run on a profile that enforces admin challenge for active users.
52
+3. NetworkManager challenge suppression cause is identified and reproducible.
53
+4. A deterministic override path is documented to force and validate the callback path on this host.