I am now getting asked for the root password to connect to the wifi when I boot, I guess this is a polkit thing? Ironically, it now takes even longer to connect because of the time it takes to type the password.
I really don’t want to have to enter the root password to connect to a known wifi network (I’m ok with requiring the pw to add or modify a connection though), but I also want to connect to wifi as quickly after booting as I could on Kubuntu.
Is there a group I can add my user to so that I can connect to known wifi networks without authenticating? Or do I have to do it with polkit?
I’ve spent some time reading about polkit, but it seems all of the docs online are for the old policykit, not polkit-1.
So, I’ve been reading the man pages and Arch wiki, and comparing the configuration files on Kubuntu 14.04 to openSUSE. Here’s Kubuntu:
sam@kubuntu:~$ cat /usr/share/polkit-1/actions/org.freedesktop.NetworkManager.policy | egrep -v '[description|message] xml'
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE policyconfig PUBLIC
"-//freedesktop//DTD PolicyKit Policy Configuration 1.0//EN"
"http://www.freedesktop.org/standards/PolicyKit/1.0/policyconfig.dtd">
<policyconfig>
<vendor>NetworkManager</vendor>
<vendor_url>http://www.gnome.org/projects/NetworkManager</vendor_url>
<icon_name>nm-icon</icon_name>
<action id="org.freedesktop.NetworkManager.enable-disable-network">
<description>Enable or disable system networking</description>
<message>System policy prevents enabling or disabling system networking</message>
<defaults>
<allow_inactive>no</allow_inactive>
<allow_active>yes</allow_active>
</defaults>
</action>
<action id="org.freedesktop.NetworkManager.sleep-wake">
<description>Put NetworkManager to sleep or wake it up (should only be used by system power management)</description>
<message>System policy prevents putting NetworkManager to sleep or waking it up</message>
<defaults>
<allow_inactive>no</allow_inactive>
<allow_active>no</allow_active>
</defaults>
</action>
<action id="org.freedesktop.NetworkManager.enable-disable-wifi">
<description>Enable or disable WiFi devices</description>
<message>System policy prevents enabling or disabling WiFi devices</message>
<defaults>
<allow_inactive>no</allow_inactive>
<allow_active>yes</allow_active>
</defaults>
</action>
<action id="org.freedesktop.NetworkManager.enable-disable-wwan">
<description>Enable or disable mobile broadband devices</description>
<message>System policy prevents enabling or disabling mobile broadband devices</message>
<defaults>
<allow_inactive>no</allow_inactive>
<allow_active>yes</allow_active>
</defaults>
</action>
<action id="org.freedesktop.NetworkManager.enable-disable-wimax">
<description>Enable or disable WiMAX mobile broadband devices</description>
<message>System policy prevents enabling or disabling WiMAX mobile broadband devices</message>
<defaults>
<allow_inactive>no</allow_inactive>
<allow_active>yes</allow_active>
</defaults>
</action>
<action id="org.freedesktop.NetworkManager.network-control">
<description>Allow control of network connections</description>
<message>System policy prevents control of network connections</message>
<defaults>
<allow_inactive>yes</allow_inactive>
<allow_active>yes</allow_active>
</defaults>
</action>
<action id="org.freedesktop.NetworkManager.wifi.share.protected">
<description>Connection sharing via a protected WiFi network</description>
<message>System policy prevents sharing connections via a protected WiFi network</message>
<defaults>
<allow_inactive>no</allow_inactive>
<allow_active>yes</allow_active>
</defaults>
</action>
<action id="org.freedesktop.NetworkManager.wifi.share.open">
<description>Connection sharing via an open WiFi network</description>
<message>System policy prevents sharing connections via an open WiFi network</message>
<defaults>
<allow_inactive>no</allow_inactive>
<allow_active>yes</allow_active>
</defaults>
</action>
<action id="org.freedesktop.NetworkManager.settings.modify.own">
<description>Modify personal network connections</description>
<message>System policy prevents modification of personal network settings</message>
<defaults>
<allow_inactive>no</allow_inactive>
<allow_active>yes</allow_active>
</defaults>
</action>
<action id="org.freedesktop.NetworkManager.settings.modify.system">
<description>Modify network connections for all users</description>
<message>System policy prevents modification of network settings for all users</message>
<defaults>
<allow_inactive>no</allow_inactive>
<allow_active>auth_admin_keep</allow_active>
</defaults>
</action>
<action id="org.freedesktop.NetworkManager.settings.modify.hostname">
<description>Modify persistent system hostname</description>
<message>System policy prevents modification of the persistent system hostname</message>
<defaults>
<allow_inactive>no</allow_inactive>
<allow_active>auth_admin_keep</allow_active>
</defaults>
</action>
<action id="org.freedesktop.NetworkManager.use-user-connections">
<description>Allow use of user-specific connections</description>
<message>System policy prevents use of user-specific connections</message>
<defaults>
<allow_inactive>yes</allow_inactive>
<allow_active>yes</allow_active>
</defaults>
</action>
</policyconfig>
and here’s openSUSE, with the different bits highlighted
sam@T440s:~$ cat /usr/share/polkit-1/actions/org.freedesktop.NetworkManager.policy | egrep -v '[description|message] xml'
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE policyconfig PUBLIC
"-//freedesktop//DTD PolicyKit Policy Configuration 1.0//EN"
"http://www.freedesktop.org/standards/PolicyKit/1.0/policyconfig.dtd">
<policyconfig>
<vendor>NetworkManager</vendor>
<vendor_url>http://www.gnome.org/projects/NetworkManager</vendor_url>
<icon_name>nm-icon</icon_name>
<action id="org.freedesktop.NetworkManager.enable-disable-network">
<description>Enable or disable system networking</description>
<message>System policy prevents enabling or disabling system networking</message>
<defaults>
<allow_inactive>no</allow_inactive>
<allow_active>yes</allow_active>
</defaults>
</action>
<action id="org.freedesktop.NetworkManager.sleep-wake">
<description>Put NetworkManager to sleep or wake it up (should only be used by system power management)</description>
<message>System policy prevents putting NetworkManager to sleep or waking it up</message>
<defaults>
<allow_inactive>no</allow_inactive>
<allow_active>no</allow_active>
</defaults>
</action>
<action id="org.freedesktop.NetworkManager.enable-disable-wifi">
<description>Enable or disable WiFi devices</description>
<message>System policy prevents enabling or disabling WiFi devices</message>
<defaults>
<allow_inactive>no</allow_inactive>
<allow_active>yes</allow_active>
</defaults>
</action>
<action id="org.freedesktop.NetworkManager.enable-disable-wwan">
<description>Enable or disable mobile broadband devices</description>
<message>System policy prevents enabling or disabling mobile broadband devices</message>
<defaults>
<allow_inactive>no</allow_inactive>
<allow_active>yes</allow_active>
</defaults>
</action>
<action id="org.freedesktop.NetworkManager.enable-disable-wimax">
<description>Enable or disable WiMAX mobile broadband devices</description>
<message>System policy prevents enabling or disabling WiMAX mobile broadband devices</message>
<defaults>
<allow_inactive>no</allow_inactive>
<allow_active>yes</allow_active>
</defaults>
</action>
<action id="org.freedesktop.NetworkManager.network-control">
<description>Allow control of network connections</description>
<message>System policy prevents control of network connections</message>
<defaults>
**<allow_any>auth_admin</allow_any>**
<allow_inactive>yes</allow_inactive>
<allow_active>yes</allow_active>
</defaults>
</action>
<action id="org.freedesktop.NetworkManager.wifi.share.protected">
<description>Connection sharing via a protected WiFi network</description>
<message>System policy prevents sharing connections via a protected WiFi network</message>
<defaults>
<allow_inactive>no</allow_inactive>
<allow_active>yes</allow_active>
</defaults>
</action>
<action id="org.freedesktop.NetworkManager.wifi.share.open">
<description>Connection sharing via an open WiFi network</description>
<message>System policy prevents sharing connections via an open WiFi network</message>
<defaults>
<allow_inactive>no</allow_inactive>
<allow_active>yes</allow_active>
</defaults>
</action>
<action id="org.freedesktop.NetworkManager.settings.modify.own">
<description>Modify personal network connections</description>
<message>System policy prevents modification of personal network settings</message>
<defaults>
**<allow_any>auth_self_keep</allow_any>
<allow_inactive>yes</allow_inactive>**
<allow_active>yes</allow_active>
</defaults>
</action>
<action id="org.freedesktop.NetworkManager.settings.modify.system">
<description>Modify network connections for all users</description>
<message>System policy prevents modification of network settings for all users</message>
<defaults>
**<allow_any>auth_admin_keep</allow_any>
<allow_inactive>auth_admin_keep</allow_inactive>**
<allow_active>auth_admin_keep</allow_active>
</defaults>
</action>
<action id="org.freedesktop.NetworkManager.settings.modify.hostname">
<description>Modify persistent system hostname</description>
<message>System policy prevents modification of the persistent system hostname</message>
<defaults>
**<allow_any>auth_admin_keep</allow_any>
<allow_inactive>auth_admin_keep</allow_inactive>**
<allow_active>auth_admin_keep</allow_active>
</defaults>
</action>
</policyconfig>
It seems allow_inactive deals with remote sessions, allow_active is local sessions, and allow_any is both.
no denies authentication and yes grants it without prompting for a password.
auth_self requires a user password and auth_admin requires an administrator password, and the *_keep options result in authentication being granted for a period of time.
That explains why if I provide the root password when asked it will connect, and then if I disconnect and reconnect I don’t need the root password again.
Anyway, the setttings that matter seem to be the same on both systems (admin authentication is required to modify system connections, which I think is the action required to connect to wifi if it’s a system connection). I guess I could do something like this:
polkit.addRule(function(action, subject) { if (action.id == "org.freedesktop.NetworkManager.settings.modify.system" &&
subject.user == "sam") {
return polkit.Result.YES;
}
});
But I don’t really understand why it’s necessary in the first place - why does openSUSE connect without authentication when Ubuntu does not?
Is it a NetworkManager setting?