After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 760210 - dropping privileges in NM, sandboxing
dropping privileges in NM, sandboxing
Status: RESOLVED OBSOLETE
Product: NetworkManager
Classification: Platform
Component: general
1.0.x
Other Linux
: Normal normal
: ---
Assigned To: NetworkManager maintainer(s)
NetworkManager maintainer(s)
Depends on: 760205
Blocks: nm-next
 
 
Reported: 2016-01-06 12:40 UTC by Thomas Haller
Modified: 2020-11-12 14:31 UTC
See Also:
GNOME target: ---
GNOME version: ---


Description Thomas Haller 2016-01-06 12:40:46 UTC 
This is a tracker bug for hardening NM more.



1) dropping more privileges

./data/NetworkManager.service already contains:

CapabilityBoundingSet=CAP_NET_ADMIN CAP_DAC_OVERRIDE CAP_NET_RAW CAP_NET_BIND_SERVICE CAP_SETGID CAP_SETUID CAP_SYS_MODULE CAP_AUDIT_WRITE CAP_KILL
ProtectSystem=true
ProtectHome=read-only


Still, I think we would be well advised to restrict NM more.


First of all, maybe we should also set the same capabilities from NM itself. Lubomir said it is the job of the service manager to do that. I agree, but in *addition* it seems worthwhile that NM itself drops capabilities too.
Reason:
  - support for non-systemd-systems
  - I often start NM on the command line for debugging. I want
    this feature then too.



2.) we do now pretty dangerous stuff in NM core process itself:
  - systemd dhcp implementation
  - libndp
  - lndp(?)
I think we should fork processes (with reduced privileges) to perform these tasks.



3.) see how to sandbox/harden VPN plugins

4.) other? pppd?
Comment 1 André Klapper 2020-11-12 14:31:27 UTC 
bugzilla.gnome.org is being shut down in favor of a GitLab instance. 
We are closing all old bug reports and feature requests in GNOME Bugzilla which have not seen updates for a long time.

If you still use NetworkManager and if you still see this bug / want this feature in a recent and supported version of NetworkManager, then please feel free to report it at https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/issues/

Thank you for creating this report and we are sorry it could not be implemented (workforce and time is unfortunately limited).