Re: if-up hooks not working
On Dec 3, 2007 8:33 AM, Dan Williams <[EMAIL PROTECTED]> wrote: > Sure; NMD was written before a lot of stuff like SELinux or PolicyKit or > whatever came along, and really hasn't been touched in a long time. > What sort of permissions checks would you propose? > > Dan Well, I think that checking that /etc/NetworkManager/dispatcher.d is owned by root and only writable by root and that the files in that dir were executable by root would be adequate. In that situation, NMD would know that everything in that directory was there with root's permission. Of course, there's the possibility that root could put something there that was writable by the wrong person and that person could do something they shouldn't, but I think that in such a situation, that would be solely the sysadmin's fault. Someone who knows enough to use NMD probably knows enough to set sensible permissions. Whether the permissions checking should be changed to that outright, or made an option, I don't care one way or the other. Scott -- ===Scott Severance=== Website: http://www.scottseverance.us Blog: http://blog.scottseverance.us Phone: (903) 756-8066 Check out the Sermon Illustration Library: http://www.sermonillustrationlibrary.org ___ NetworkManager-list mailing list NetworkManager-list@gnome.org http://mail.gnome.org/mailman/listinfo/networkmanager-list
Re: if-up hooks not working
On Sat, 2007-12-01 at 20:56 -0600, Scott Severance wrote: > snip > > > > > > > After rebooting the computer in question as well as my > server because > > > > > > NFS was acting up, my script now seems to get run reliably > if I put it > > > > > > in /etc/network/if- up.d. However, contrary to the docs, the > only script > > > > > > in /etc/NetworkManager/dispatcher.d that ever gets executed > is > > > > > > 01ifupdown. Since that script calls run-parts > on /etc/network/if- up.d, > > > > > > My script gets executed in that directory. > > > > > > > > > > > > Is the NetworkManagerDispatcher man page wrong, or am I > experiencing > > > > > > some kind of bug? > > > > > > > > > > > > By the way, I'm running Ubuntu Gutsy. > > > > > > > > > > Is the script only owned by root and executable? Do you see > the script > > > > > execute when you tail syslog? > > > > > > > > > The script is owned by myuser:root, with 770 permissions. I > chowned to > > > > root:root, but it didn't make any difference. One reason that I > know > > > > it isn't running is because the script logs several messages to > > > > syslog, and those messages don't show up. > NetworkManagerDispatcher > > > > doesn't itself log the scripts it runs. So, the script > definitely > > > > isn't executing. > > > > > > I think the permissions need to be 0700 or 0500 and the file owned > by > > > root. I remember some messages on the list to that affect but I > can't > > > seem to find them off-hand. > > > > > > > Yep that is correct from the source: > > > http://svn.gnome.org/viewvc/NetworkManager/tags/NETWORKMANAGER_0_6_5_RELEASE/dispatcher-daemon/NetworkManagerDispatcher.c?view=markup > > > > > > /* > > * nmd_permission_check > > * > > * Verify that the given script has the permissions we > want. Specifically, > > * ensure that the file is > > * - A regular file. > > * - Owned by root. > > * - Not writable by the group or by other. > > * - Not setuid. > > * - Executable by the owner. > > * > > */ > > OK. Changing the owner to root:root and the permissions to 755 (the > permissions of 01ifupdown) did the trick. I'll file a documentation > bug on this, since the man page says nothing about required > permissions. > > I do wonder, though, why NetworkManagerDispatcher is so particular > about permissions. As long as /etc/NetworkManager/dispatcher.d is only > writable by root, then it is safe to assume that anything in there is > something that root has authorized, regardless of its permissions. And > a particular script might or might not contain sensitive information. > Shouldn't security policy be left up to the system administrator? > > The reason this is an issue for me is that I have a number of scripts > that I've written to automate various tasks. For the sake of > maintainability, it's easiest to keep all of them in subdirectories of > my normal user's home directory and then make symlinks as appropriate. > Since /home is on a separate partition, I can have all my data on a > single partition, leaving the rest of the filesystem for > distro-specific stuff and system-wide config. > > Naturally, it is strongly preferable that everything under $HOME > should be owned by $USER, so that I don't have to become root to > manipulate files in my home directory. But NetworkManagerDispatcher > actively prevents me from configuring my system as I see fit, and > that's quite frustrating. > > Another point to make is that the machine in question is a laptop, and > I'm the only person who uses it. So I'm not too worried about someone > pulling some attack on files that aren't locked down. If someone were > to steal my laptop, their ability to mess with a NetworkManager file > would be the least of my worries. Besides, I have sudo configured to > grant me root without asking for a password, so root ownership doesn't > provide much protection against an adversary. I realize that many > people want to run a much tighter system than I do, and they should > have that choice. But should I be forced into a security model > designed for a multi-user environment when I only operate in a > single-user environment? > > Would it be possible to relax the permissions checking a bit? Sure; NMD was written before a lot of stuff like SELinux or PolicyKit or whatever came along, and really hasn't been touched in a long time. What sort of permissions checks would you propose? Dan ___ NetworkManager-list mailing list NetworkManager-list@gnome.org http://mail.gnome.org/mailman/listinfo/networkmanager-list
Re: if-up hooks not working
snip > > > > > After rebooting the computer in question as well as my server because > > > > > NFS was acting up, my script now seems to get run reliably if I put it > > > > > in /etc/network/if-up.d. However, contrary to the docs, the only script > > > > > in /etc/NetworkManager/dispatcher.d that ever gets executed is > > > > > 01ifupdown. Since that script calls run-parts on /etc/network/if- up.d, > > > > > My script gets executed in that directory. > > > > > > > > > > Is the NetworkManagerDispatcher man page wrong, or am I experiencing > > > > > some kind of bug? > > > > > > > > > > By the way, I'm running Ubuntu Gutsy. > > > > > > > > Is the script only owned by root and executable? Do you see the script > > > > execute when you tail syslog? > > > > > > > The script is owned by myuser:root, with 770 permissions. I chowned to > > > root:root, but it didn't make any difference. One reason that I know > > > it isn't running is because the script logs several messages to > > > syslog, and those messages don't show up. NetworkManagerDispatcher > > > doesn't itself log the scripts it runs. So, the script definitely > > > isn't executing. > > > > I think the permissions need to be 0700 or 0500 and the file owned by > > root. I remember some messages on the list to that affect but I can't > > seem to find them off-hand. > > > > Yep that is correct from the source: > http://svn.gnome.org/viewvc/NetworkManager/tags/NETWORKMANAGER_0_6_5_RELEASE/dispatcher-daemon/NetworkManagerDispatcher.c?view=markup > > > /* > * nmd_permission_check > * > * Verify that the given script has the permissions we want. Specifically, > * ensure that the file is > * - A regular file. > * - Owned by root. > * - Not writable by the group or by other. > * - Not setuid. > * - Executable by the owner. > * > */ OK. Changing the owner to root:root and the permissions to 755 (the permissions of 01ifupdown) did the trick. I'll file a documentation bug on this, since the man page says nothing about required permissions. I do wonder, though, why NetworkManagerDispatcher is so particular about permissions. As long as /etc/NetworkManager/dispatcher.d is only writable by root, then it is safe to assume that anything in there is something that root has authorized, regardless of its permissions. And a particular script might or might not contain sensitive information. Shouldn't security policy be left up to the system administrator? The reason this is an issue for me is that I have a number of scripts that I've written to automate various tasks. For the sake of maintainability, it's easiest to keep all of them in subdirectories of my normal user's home directory and then make symlinks as appropriate. Since /home is on a separate partition, I can have all my data on a single partition, leaving the rest of the filesystem for distro-specific stuff and system-wide config. Naturally, it is strongly preferable that everything under $HOME should be owned by $USER, so that I don't have to become root to manipulate files in my home directory. But NetworkManagerDispatcher actively prevents me from configuring my system as I see fit, and that's quite frustrating. Another point to make is that the machine in question is a laptop, and I'm the only person who uses it. So I'm not too worried about someone pulling some attack on files that aren't locked down. If someone were to steal my laptop, their ability to mess with a NetworkManager file would be the least of my worries. Besides, I have sudo configured to grant me root without asking for a password, so root ownership doesn't provide much protection against an adversary. I realize that many people want to run a much tighter system than I do, and they should have that choice. But should I be forced into a security model designed for a multi-user environment when I only operate in a single-user environment? Would it be possible to relax the permissions checking a bit? Scott -- ===Scott Severance=== Website: http://www.scottseverance.us Blog: http://blog.scottseverance.us Check out the Sermon Illustration Library: http://www.sermonillustrationlibrary.org ___ NetworkManager-list mailing list NetworkManager-list@gnome.org http://mail.gnome.org/mailman/listinfo/networkmanager-list
Re: if-up hooks not working
On Sat, 2007-12-01 at 08:17 -0500, Darren Albers wrote: > On Fri, 2007-11-30 at 21:58 -0600, Scott Severance wrote: > > On 11/30/07, Darren Albers <[EMAIL PROTECTED]> wrote: > > > > > > On Fri, 2007-11-30 at 14:33 -0600, Scott Severance wrote: > > > > snip > > > > > > > > > > > After poking around the filesystem and NetworkManager's scanty > > > > > > > documentation, I determined that I should place my script in > > > > > > > /etc/network/if-up.d. However, I've discovered that those scripts > > > > > get called > > > > > > > when switching from wireless to wired, but not the other way > > > > > around. How can > > > > > > > I persuade NetworkManager to run my script *every* time it > > > > > switches > > > > > > > interfaces? > > > > snip > > > > > Thanks for the reply. I gather from the NetworkManagerDispatcher man > > > > > page that I should put my script in /etc/NetworkManager/dispatcher.d > > > > > and modify it so it only runs when the second command line argument is > > > > > "up." However, in its new location the script never gets executed. > > > > > What's even more confusing is that, apparently the only reason the > > > > > script worked at all in /etc/network/if- up.d was because there's a > > > > > script in /etc/NetworkManager/dispatcher.d which calls run-parts on > > > > > the other directory. Why isn't NetworkManagerDispatcher running my > > > > > script? > > > > After rebooting the computer in question as well as my server because > > > > NFS was acting up, my script now seems to get run reliably if I put it > > > > in /etc/network/if-up.d. However, contrary to the docs, the only script > > > > in /etc/NetworkManager/dispatcher.d that ever gets executed is > > > > 01ifupdown. Since that script calls run-parts on /etc/network/if-up.d, > > > > My script gets executed in that directory. > > > > > > > > Is the NetworkManagerDispatcher man page wrong, or am I experiencing > > > > some kind of bug? > > > > > > > > By the way, I'm running Ubuntu Gutsy. > > > > > > Is the script only owned by root and executable? Do you see the script > > > execute when you tail syslog? > > > > > The script is owned by myuser:root, with 770 permissions. I chowned to > > root:root, but it didn't make any difference. One reason that I know > > it isn't running is because the script logs several messages to > > syslog, and those messages don't show up. NetworkManagerDispatcher > > doesn't itself log the scripts it runs. So, the script definitely > > isn't executing. > > I think the permissions need to be 0700 or 0500 and the file owned by > root. I remember some messages on the list to that affect but I can't > seem to find them off-hand. > Yep that is correct from the source: http://svn.gnome.org/viewvc/NetworkManager/tags/NETWORKMANAGER_0_6_5_RELEASE/dispatcher-daemon/NetworkManagerDispatcher.c?view=markup /* * nmd_permission_check * * Verify that the given script has the permissions we want. Specifically, * ensure that the file is * - A regular file. * - Owned by root. * - Not writable by the group or by other. * - Not setuid. * - Executable by the owner. * */ So hopefully that helps. Thanks! Darren ___ NetworkManager-list mailing list NetworkManager-list@gnome.org http://mail.gnome.org/mailman/listinfo/networkmanager-list
Re: if-up hooks not working
On Fri, 2007-11-30 at 21:58 -0600, Scott Severance wrote: > On 11/30/07, Darren Albers <[EMAIL PROTECTED]> wrote: > > > > On Fri, 2007-11-30 at 14:33 -0600, Scott Severance wrote: > > > snip > > > > > > > > > After poking around the filesystem and NetworkManager's scanty > > > > > > documentation, I determined that I should place my script in > > > > > > /etc/network/if-up.d. However, I've discovered that those scripts > > > > get called > > > > > > when switching from wireless to wired, but not the other way > > > > around. How can > > > > > > I persuade NetworkManager to run my script *every* time it > > > > switches > > > > > > interfaces? > > > snip > > > > Thanks for the reply. I gather from the NetworkManagerDispatcher man > > > > page that I should put my script in /etc/NetworkManager/dispatcher.d > > > > and modify it so it only runs when the second command line argument is > > > > "up." However, in its new location the script never gets executed. > > > > What's even more confusing is that, apparently the only reason the > > > > script worked at all in /etc/network/if- up.d was because there's a > > > > script in /etc/NetworkManager/dispatcher.d which calls run-parts on > > > > the other directory. Why isn't NetworkManagerDispatcher running my > > > > script? > > > After rebooting the computer in question as well as my server because > > > NFS was acting up, my script now seems to get run reliably if I put it > > > in /etc/network/if-up.d. However, contrary to the docs, the only script > > > in /etc/NetworkManager/dispatcher.d that ever gets executed is > > > 01ifupdown. Since that script calls run-parts on /etc/network/if-up.d, > > > My script gets executed in that directory. > > > > > > Is the NetworkManagerDispatcher man page wrong, or am I experiencing > > > some kind of bug? > > > > > > By the way, I'm running Ubuntu Gutsy. > > > > Is the script only owned by root and executable? Do you see the script > > execute when you tail syslog? > > > The script is owned by myuser:root, with 770 permissions. I chowned to > root:root, but it didn't make any difference. One reason that I know > it isn't running is because the script logs several messages to > syslog, and those messages don't show up. NetworkManagerDispatcher > doesn't itself log the scripts it runs. So, the script definitely > isn't executing. I think the permissions need to be 0700 or 0500 and the file owned by root. I remember some messages on the list to that affect but I can't seem to find them off-hand. ___ NetworkManager-list mailing list NetworkManager-list@gnome.org http://mail.gnome.org/mailman/listinfo/networkmanager-list
Re: if-up hooks not working
On 11/30/07, Darren Albers <[EMAIL PROTECTED]> wrote: > > On Fri, 2007-11-30 at 14:33 -0600, Scott Severance wrote: > > snip > > > > > > > After poking around the filesystem and NetworkManager's scanty > > > > > documentation, I determined that I should place my script in > > > > > /etc/network/if-up.d. However, I've discovered that those scripts > > > get called > > > > > when switching from wireless to wired, but not the other way > > > around. How can > > > > > I persuade NetworkManager to run my script *every* time it > > > switches > > > > > interfaces? > > snip > > > Thanks for the reply. I gather from the NetworkManagerDispatcher man > > > page that I should put my script in /etc/NetworkManager/dispatcher.d > > > and modify it so it only runs when the second command line argument is > > > "up." However, in its new location the script never gets executed. > > > What's even more confusing is that, apparently the only reason the > > > script worked at all in /etc/network/if- up.d was because there's a > > > script in /etc/NetworkManager/dispatcher.d which calls run-parts on > > > the other directory. Why isn't NetworkManagerDispatcher running my > > > script? > > After rebooting the computer in question as well as my server because > > NFS was acting up, my script now seems to get run reliably if I put it > > in /etc/network/if-up.d. However, contrary to the docs, the only script > > in /etc/NetworkManager/dispatcher.d that ever gets executed is > > 01ifupdown. Since that script calls run-parts on /etc/network/if-up.d, > > My script gets executed in that directory. > > > > Is the NetworkManagerDispatcher man page wrong, or am I experiencing > > some kind of bug? > > > > By the way, I'm running Ubuntu Gutsy. > > Is the script only owned by root and executable? Do you see the script > execute when you tail syslog? > The script is owned by myuser:root, with 770 permissions. I chowned to root:root, but it didn't make any difference. One reason that I know it isn't running is because the script logs several messages to syslog, and those messages don't show up. NetworkManagerDispatcher doesn't itself log the scripts it runs. So, the script definitely isn't executing. ___ NetworkManager-list mailing list NetworkManager-list@gnome.org http://mail.gnome.org/mailman/listinfo/networkmanager-list
Re: if-up hooks not working
On Fri, 2007-11-30 at 14:33 -0600, Scott Severance wrote: > snip > > > > > After poking around the filesystem and NetworkManager's scanty > > > > documentation, I determined that I should place my script in > > > > /etc/network/if-up.d. However, I've discovered that those scripts > > get called > > > > when switching from wireless to wired, but not the other way > > around. How can > > > > I persuade NetworkManager to run my script *every* time it > > switches > > > > interfaces? > snip > > Thanks for the reply. I gather from the NetworkManagerDispatcher man > > page that I should put my script in /etc/NetworkManager/dispatcher.d > > and modify it so it only runs when the second command line argument is > > "up." However, in its new location the script never gets executed. > > What's even more confusing is that, apparently the only reason the > > script worked at all in /etc/network/if- up.d was because there's a > > script in /etc/NetworkManager/dispatcher.d which calls run-parts on > > the other directory. Why isn't NetworkManagerDispatcher running my > > script? > After rebooting the computer in question as well as my server because > NFS was acting up, my script now seems to get run reliably if I put it > in /etc/network/if-up.d. However, contrary to the docs, the only script > in /etc/NetworkManager/dispatcher.d that ever gets executed is > 01ifupdown. Since that script calls run-parts on /etc/network/if-up.d, > My script gets executed in that directory. > > Is the NetworkManagerDispatcher man page wrong, or am I experiencing > some kind of bug? > > By the way, I'm running Ubuntu Gutsy. Is the script only owned by root and executable? Do you see the script execute when you tail syslog? ___ NetworkManager-list mailing list NetworkManager-list@gnome.org http://mail.gnome.org/mailman/listinfo/networkmanager-list
Re: if-up hooks not working
snip > > > After poking around the filesystem and NetworkManager's scanty > > > documentation, I determined that I should place my script in > > > /etc/network/if-up.d. However, I've discovered that those scripts > get called > > > when switching from wireless to wired, but not the other way > around. How can > > > I persuade NetworkManager to run my script *every* time it > switches > > > interfaces? snip > Thanks for the reply. I gather from the NetworkManagerDispatcher man > page that I should put my script in /etc/NetworkManager/dispatcher.d > and modify it so it only runs when the second command line argument is > "up." However, in its new location the script never gets executed. > What's even more confusing is that, apparently the only reason the > script worked at all in /etc/network/if- up.d was because there's a > script in /etc/NetworkManager/dispatcher.d which calls run-parts on > the other directory. Why isn't NetworkManagerDispatcher running my > script? After rebooting the computer in question as well as my server because NFS was acting up, my script now seems to get run reliably if I put it in /etc/network/if-up.d. However, contrary to the docs, the only script in /etc/NetworkManager/dispatcher.d that ever gets executed is 01ifupdown. Since that script calls run-parts on /etc/network/if-up.d, My script gets executed in that directory. Is the NetworkManagerDispatcher man page wrong, or am I experiencing some kind of bug? By the way, I'm running Ubuntu Gutsy. signature.asc Description: This is a digitally signed message part ___ NetworkManager-list mailing list NetworkManager-list@gnome.org http://mail.gnome.org/mailman/listinfo/networkmanager-list
Re: if-up hooks not working
On Nov 28, 2007 7:35 PM, Darren Albers <[EMAIL PROTECTED]> wrote: > On Nov 28, 2007 7:32 PM, Scott Severance <[EMAIL PROTECTED]> wrote: > > Due to wireless issues I've been experiencing since upgrading to Ubuntu > > Gutsy, I've been switching somewhat frequently between wired and wireless. > > When I do that, my IP address changes and my router doesn't have enough > > configurability to force the IP to stay the same. So, I've written a set of > > scripts that keep my DNS server up-to-date. > > > > After poking around the filesystem and NetworkManager's scanty > > documentation, I determined that I should place my script in > > /etc/network/if-up.d. However, I've discovered that those scripts get called > > when switching from wireless to wired, but not the other way around. How can > > I persuade NetworkManager to run my script *every* time it switches > > interfaces? > > > I take you are are trying to update a DNS servers A record for your > PC? What I think you want to use is NetworkManagerDispatcher. > These are scripts that are run based on the state of an interface. > > Some examples are here: > http://www.darrenalbers.net/wiki/index.php?title=NetworkManagerScripts > > In fact someone posted a script to update a dynamic dns server here: > http://article.gmane.org/gmane.linux.network.networkmanager.devel/5044 > Thanks for the reply. I gather from the NetworkManagerDispatcher man page that I should put my script in /etc/NetworkManager/dispatcher.d and modify it so it only runs when the second command line argument is "up." However, in its new location the script never gets executed. What's even more confusing is that, apparently the only reason the script worked at all in /etc/network/if- up.d was because there's a script in /etc/NetworkManager/dispatcher.d which calls run-parts on the other directory. Why isn't NetworkManagerDispatcher running my script? BTW: Yes, I guess I'm doing dynamic DNS (never thought of it that way before) but with my own DNS server that runs on my network. The dynamic DNS scripts work great. My only problem is that NetworkManager refuses to call my trigger script. If I run it manually, everything's peachy. -- ===Scott Severance=== Website: http://www.scottseverance.us Blog: http://blog.scottseverance.us Check out the Sermon Illustration Library: http://www.sermonillustrationlibrary.org ___ NetworkManager-list mailing list NetworkManager-list@gnome.org http://mail.gnome.org/mailman/listinfo/networkmanager-list
Re: if-up hooks not working
On Nov 28, 2007 7:32 PM, Scott Severance <[EMAIL PROTECTED]> wrote: > Due to wireless issues I've been experiencing since upgrading to Ubuntu > Gutsy, I've been switching somewhat frequently between wired and wireless. > When I do that, my IP address changes and my router doesn't have enough > configurability to force the IP to stay the same. So, I've written a set of > scripts that keep my DNS server up-to-date. > > After poking around the filesystem and NetworkManager's scanty > documentation, I determined that I should place my script in > /etc/network/if-up.d. However, I've discovered that those scripts get called > when switching from wireless to wired, but not the other way around. How can > I persuade NetworkManager to run my script *every* time it switches > interfaces? > > -- > ===Scott Severance=== > > Website: http://www.scottseverance.us > Blog: http://blog.scottseverance.us > > Check out the Sermon Illustration Library: > http://www.sermonillustrationlibrary.org > ___ > NetworkManager-list mailing list > NetworkManager-list@gnome.org > http://mail.gnome.org/mailman/listinfo/networkmanager-list > > I take you are are trying to update a DNS servers A record for your PC? What I think you want to use is NetworkManagerDispatcher. These are scripts that are run based on the state of an interface. Some examples are here: http://www.darrenalbers.net/wiki/index.php?title=NetworkManagerScripts In fact someone posted a script to update a dynamic dns server here: http://article.gmane.org/gmane.linux.network.networkmanager.devel/5044 ___ NetworkManager-list mailing list NetworkManager-list@gnome.org http://mail.gnome.org/mailman/listinfo/networkmanager-list
if-up hooks not working
Due to wireless issues I've been experiencing since upgrading to Ubuntu Gutsy, I've been switching somewhat frequently between wired and wireless. When I do that, my IP address changes and my router doesn't have enough configurability to force the IP to stay the same. So, I've written a set of scripts that keep my DNS server up-to-date. After poking around the filesystem and NetworkManager's scanty documentation, I determined that I should place my script in /etc/network/if-up.d. However, I've discovered that those scripts get called when switching from wireless to wired, but not the other way around. How can I persuade NetworkManager to run my script *every* time it switches interfaces? -- ===Scott Severance=== Website: http://www.scottseverance.us Blog: http://blog.scottseverance.us Check out the Sermon Illustration Library: http://www.sermonillustrationlibrary.org ___ NetworkManager-list mailing list NetworkManager-list@gnome.org http://mail.gnome.org/mailman/listinfo/networkmanager-list
