From 2f5b6e6582e71630193d0098d4cc60db019e1e9b Mon Sep 17 00:00:00 2001
From: Marek Marczykowski <marmarek@mimuw.edu.pl>
Date: Thu, 7 Apr 2011 12:40:35 +0200
Subject: [PATCH] Run nm-applet as normal user

Configuration for D-Bus policy and PolicyKit to allow this.
---
 netvm/dbus-nm-applet.conf | 42 +++++++++++++++++++++++++++++++++++++++
 rpm_spec/core-netvm.spec  |  9 +++++++++
 2 files changed, 51 insertions(+)
 create mode 100644 netvm/dbus-nm-applet.conf

diff --git a/netvm/dbus-nm-applet.conf b/netvm/dbus-nm-applet.conf
new file mode 100644
index 00000000..0d0f0822
--- /dev/null
+++ b/netvm/dbus-nm-applet.conf
@@ -0,0 +1,42 @@
+<!DOCTYPE busconfig PUBLIC
+ "-//freedesktop//DTD D-BUS Bus Configuration 1.0//EN"
+ "http://www.freedesktop.org/standards/dbus/1.0/busconfig.dtd">
+<busconfig>
+	<!--
+	     WARNING: if running any D-Bus version prior to 1.2.6, you may be
+	     vulnerable to information leakage via the NM D-Bus interface.
+	     Previous D-Bus versions did not deny-by-default, and this permissions
+	     config file assumes that D-Bus will deny rules by default unless
+	     explicitly over-ridden with an <allow /> tag.
+	 -->
+
+        <policy user="root">
+                <allow own="org.freedesktop.NetworkManagerUserSettings"/>
+
+                <allow send_destination="org.freedesktop.NetworkManagerUserSettings"
+                       send_interface="org.freedesktop.NetworkManagerSettings"/>
+
+                <allow send_destination="org.freedesktop.NetworkManagerUserSettings"
+                       send_interface="org.freedesktop.NetworkManagerSettings.Connection"/>
+
+                <!-- Only root can get secrets -->
+                <allow send_destination="org.freedesktop.NetworkManagerUserSettings"
+                       send_interface="org.freedesktop.NetworkManagerSettings.Connection.Secrets"/>
+        </policy>
+        <policy user="user">
+                <allow own="org.freedesktop.NetworkManagerUserSettings"/>
+
+                <allow send_destination="org.freedesktop.NetworkManagerUserSettings"
+                       send_interface="org.freedesktop.NetworkManagerSettings"/>
+
+                <allow send_destination="org.freedesktop.NetworkManagerUserSettings"
+                       send_interface="org.freedesktop.NetworkManagerSettings.Connection"/>
+        </policy>
+        <policy context="default">
+                <allow send_destination="org.freedesktop.NetworkManagerUserSettings"
+                       send_interface="org.freedesktop.DBus.Introspectable"/>
+        </policy>
+
+        <limit name="max_replies_per_connection">512</limit>
+</busconfig>
+
diff --git a/rpm_spec/core-netvm.spec b/rpm_spec/core-netvm.spec
index a4c966b9..07200b44 100644
--- a/rpm_spec/core-netvm.spec
+++ b/rpm_spec/core-netvm.spec
@@ -66,6 +66,9 @@ mkdir -p $RPM_BUILD_ROOT/var/run/qubes
 mkdir -p $RPM_BUILD_ROOT/etc/xen/scripts
 cp ../common/vif-route-qubes $RPM_BUILD_ROOT/etc/xen/scripts
 
+mkdir -p $RPM_BUILD_ROOT/etc/dbus-1/system.d
+cp ../netvm/dbus-nm-applet.conf $RPM_BUILD_ROOT/etc/dbus-1/system.d/qubes-nm-applet.conf
+
 %post
 
 # Create NetworkManager configuration if we do not have it
@@ -88,6 +91,11 @@ if [ "$1" = 0 ] ; then
     chkconfig qubes_core_netvm off
 fi
 
+%triggerin -- NetworkManager
+# Fix PolicyKit settings to allow run as normal user not visible to ConsoleKit
+sed 's#<defaults>$#\0<allow_any>yes</allow_any>#' -i /usr/share/polkit-1/actions/org.freedesktop.NetworkManager.policy
+
+
 %clean
 rm -rf $RPM_BUILD_ROOT
 
@@ -100,3 +108,4 @@ rm -rf $RPM_BUILD_ROOT
 /etc/NetworkManager/dispatcher.d/qubes_nmhook
 /etc/NetworkManager/dispatcher.d/30-qubes_external_ip
 /etc/xen/scripts/vif-route-qubes
+/etc/dbus-1/system.d/qubes-nm-applet.conf