From e6dc515c978bea192ed1c0f42fe9cbbf43508c00 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Wed, 8 Jul 2026 08:36:36 +0200 Subject: [PATCH] Revert "nm: Pass back the username auth-dialog runs as to access ssh-agent socket" This partially reverts commit d7608ca1922152c07d5e3d4597c267cb84f0d7c0. This was not actually an improvement over just doing the access as root. The auth-dialog is not run by NM directly. Instead, it requests secrets via DBus from anybody who implements the SecretAgent interface. It's then e.g. nm-applet who starts the auth-dialog. But this can really be anybody, i.e. it's easy to return arbitrary information to the plugin. So we can't trust the returned username. This means that we can't improve the situation for system-wide connections that don't provide a username from the config. We keep resetting the cached agent socket that the commit also added. --- src/charon-nm/nm/nm_service.c | 7 ++----- src/frontends/gnome/auth-dialog/main.c | 23 ++--------------------- 2 files changed, 4 insertions(+), 26 deletions(-) diff --git a/src/charon-nm/nm/nm_service.c b/src/charon-nm/nm/nm_service.c index 1651b76f8..3b6bf8969 100644 --- a/src/charon-nm/nm/nm_service.c +++ b/src/charon-nm/nm/nm_service.c @@ -583,7 +583,7 @@ static bool add_auth_cfg_cert(NMStrongswanPluginPrivate *priv, identification_t *id = NULL; certificate_t *cert = NULL; auth_cfg_t *auth; - const char *str, *method, *cert_source, *agent_user; + const char *str, *method, *cert_source; chunk_t safe_file; method = nm_setting_vpn_get_data_item(vpn, "method"); @@ -633,15 +633,13 @@ static bool add_auth_cfg_cert(NMStrongswanPluginPrivate *priv, str = nm_setting_vpn_get_secret(vpn, "agent"); if (agent && str) { - agent_user = nm_setting_vpn_get_secret(vpn, "agent-user"); - public = cert->get_public_key(cert); if (public) { private = lib->creds->create(lib->creds, CRED_PRIVATE_KEY, public->get_type(public), BUILD_AGENT_SOCKET, str, - BUILD_AGENT_USER, agent_user ?: user, + BUILD_AGENT_USER, user, BUILD_PUBLIC_KEY, public, BUILD_END); public->destroy(public); @@ -1206,7 +1204,6 @@ static gboolean need_secrets(NMVpnServicePlugin *plugin, NMConnection *connectio if (!priv->agent_requested) { nm_setting_vpn_remove_secret(settings, "agent"); - nm_setting_vpn_remove_secret(settings, "agent-user"); priv->agent_requested = TRUE; } } diff --git a/src/frontends/gnome/auth-dialog/main.c b/src/frontends/gnome/auth-dialog/main.c index 803f70801..fe42875c1 100644 --- a/src/frontends/gnome/auth-dialog/main.c +++ b/src/frontends/gnome/auth-dialog/main.c @@ -28,7 +28,6 @@ #include #include #include -#include #include #include @@ -218,11 +217,6 @@ static void print_secret (const char *secret_name, gchar *secret) printf("%s\n%s\n", secret_name, secret); g_free(secret); } -} - -static void print_last_secret (const char *secret_name, gchar *secret) -{ - print_secret(secret_name, secret); printf("\n\n"); fflush(stdout); } @@ -322,17 +316,6 @@ int main (int argc, char *argv[]) agent = getenv("SSH_AUTH_SOCK"); if (agent) { - int uid = getuid(); - struct passwd *pw = getpwuid(uid); - - if (!pw) - { - fprintf(stderr, "Unable to determine username for " - "authentication via ssh-agent\n"); - status = 1; - goto out; - } - if (external_ui_mode) { GKeyFile *keyfile; @@ -343,7 +326,6 @@ int main (int argc, char *argv[]) g_key_file_set_string (keyfile, UI_KEYFILE_GROUP, "Description", "SSH agent"); g_key_file_set_string (keyfile, UI_KEYFILE_GROUP, "Title", _("Authenticate VPN")); - keyfile_add_entry_info (keyfile, "agent-user", pw->pw_name, "SSH agent user", TRUE, FALSE); keyfile_add_entry_info (keyfile, "agent", agent, "SSH agent socket", TRUE, FALSE); keyfile_print_stdout (keyfile); @@ -351,8 +333,7 @@ int main (int argc, char *argv[]) } else { - print_secret("agent-user", g_strdup (pw->pw_name)); - print_last_secret("agent", g_strdup (agent)); + print_secret("agent", g_strdup (agent)); wait_for_quit (); } } @@ -385,7 +366,7 @@ int main (int argc, char *argv[]) } else if (!external_ui_mode) { - print_last_secret("password", pass); + print_secret("password", pass); wait_for_quit (); } }