denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Revert "nm: Pass back the username auth-dialog runs as to access ssh-agent socket"

Browse Source 
This partially reverts commit d7608ca192.

This was not actually an improvement over just doing the access as root.
The auth-dialog is not run by NM directly.  Instead, it requests secrets
via DBus from anybody who implements the SecretAgent interface.  It's
then e.g. nm-applet who starts the auth-dialog.  But this can really be
anybody, i.e. it's easy to return arbitrary information to the plugin.
So we can't trust the returned username.  This means that we can't
improve the situation for system-wide connections that don't provide
a username from the config.

We keep resetting the cached agent socket that the commit also added.
This commit is contained in:
Tobias Brunner
2026-07-24 08:47:37 +02:00
parent 8efb533008
commit e6dc515c97
2 changed files with 4 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/charon-nm/nm/nm_service.c
+2 -5
View File
@@ -583,7 +583,7 @@ static bool add_auth_cfg_cert(NMStrongswanPluginPrivate *priv,
identification_t *id = NULL;
certificate_t *cert = NULL;
auth_cfg_t *auth;
const char *str, *method, *cert_source, *agent_user;
const char *str, *method, *cert_source;
chunk_t safe_file;
method = nm_setting_vpn_get_data_item(vpn, "method");
@@ -633,15 +633,13 @@ static bool add_auth_cfg_cert(NMStrongswanPluginPrivate *priv,
str = nm_setting_vpn_get_secret(vpn, "agent");
if (agent && str)
{
agent_user = nm_setting_vpn_get_secret(vpn, "agent-user");
public = cert->get_public_key(cert);
if (public)
{
private = lib->creds->create(lib->creds, CRED_PRIVATE_KEY,
public->get_type(public),
BUILD_AGENT_SOCKET, str,
BUILD_AGENT_USER, agent_user ?: user,
BUILD_AGENT_USER, user,
BUILD_PUBLIC_KEY, public,
BUILD_END);
public->destroy(public);
@@ -1206,7 +1204,6 @@ static gboolean need_secrets(NMVpnServicePlugin *plugin, NMConnection *connectio
if (!priv->agent_requested)
{
nm_setting_vpn_remove_secret(settings, "agent");
nm_setting_vpn_remove_secret(settings, "agent-user");
priv->agent_requested = TRUE;
}
}
src/frontends/gnome/auth-dialog/main.c
+2 -21
View File
@@ -28,7 +28,6 @@
#include <glib/gi18n.h>
#include <gtk/gtk.h>
#include <libsecret/secret.h>
#include <pwd.h>
#include <NetworkManager.h>
#include <nm-vpn-service-plugin.h>
@@ -218,11 +217,6 @@ static void print_secret (const char *secret_name, gchar *secret)
printf("%s\n%s\n", secret_name, secret);
g_free(secret);
}
}
static void print_last_secret (const char *secret_name, gchar *secret)
{
print_secret(secret_name, secret);
printf("\n\n");
fflush(stdout);
}
@@ -322,17 +316,6 @@ int main (int argc, char *argv[])
agent = getenv("SSH_AUTH_SOCK");
if (agent)
{
int uid = getuid();
struct passwd *pw = getpwuid(uid);
if (!pw)
{
fprintf(stderr, "Unable to determine username for "
"authentication via ssh-agent\n");
status = 1;
goto out;
}
if (external_ui_mode)
{
GKeyFile *keyfile;
@@ -343,7 +326,6 @@ int main (int argc, char *argv[])
g_key_file_set_string (keyfile, UI_KEYFILE_GROUP, "Description", "SSH agent");
g_key_file_set_string (keyfile, UI_KEYFILE_GROUP, "Title", _("Authenticate VPN"));
keyfile_add_entry_info (keyfile, "agent-user", pw->pw_name, "SSH agent user", TRUE, FALSE);
keyfile_add_entry_info (keyfile, "agent", agent, "SSH agent socket", TRUE, FALSE);
keyfile_print_stdout (keyfile);
@@ -351,8 +333,7 @@ int main (int argc, char *argv[])
}
else
{
print_secret("agent-user", g_strdup (pw->pw_name));
print_last_secret("agent", g_strdup (agent));
print_secret("agent", g_strdup (agent));
wait_for_quit ();
}
}
@@ -385,7 +366,7 @@ int main (int argc, char *argv[])
}
else if (!external_ui_mode)
{
print_last_secret("password", pass);
print_secret("password", pass);
wait_for_quit ();
}
}