nm: Create safe copies of files for user-specific connections

This ensures that only certificates/private keys accessible by the
configured user are accessed and prevents attackers from misusing
other user's credentials.

Also removed setting NM_VERSION_MIN_REQUIRED, which suppresses deprecation
warnings that were added with newer API versions, and
NM_VERSION_MAX_ALLOWED, which warns if using functions added in newer
API versions, so we always build against the latest API available.

But we check explicitly for the required function so this works with
older NM versions and automatically will use it if the function is
backported.

Note that we can't use BUILD_FROM_FILE to read the temporary files as that
uses mmap() which SELinux policies prevent us from using at the location
these files are stored ([/var]/run/NetworkManager/cert/).

Fixes: CVE-2025-9615

src/frontends/gnome/configure.ac

@@ -78,8 +78,6 @@ AC_ARG_WITH(
 AM_CONDITIONAL(WITH_GTK4, test "$with_gtk4" != no)
 
 PKG_CHECK_MODULES(LIBNM, libnm >= 1.1.0)
-LIBNM_CFLAGS="$LIBNM_CFLAGS -DNM_VERSION_MIN_REQUIRED=NM_VERSION_1_2"
-LIBNM_CFLAGS="$LIBNM_CFLAGS -DNM_VERSION_MAX_ALLOWED=NM_VERSION_1_2"
 PKG_CHECK_MODULES(LIBNMA, libnma >= 1.1.0)
 
 if test x"$with_gtk4" != xno; then

src/frontends/gnome/nm-strongswan-service.name.in

@@ -2,6 +2,7 @@
 name=strongswan
 service=org.freedesktop.NetworkManager.strongswan
 program=@CHARON@
+supports-safe-private-file-access=true
 
 [libnm]
 plugin=@NM_PLUGINDIR@/libnm-vpn-plugin-strongswan.so