NM 0.9 asks for PK auth without need

[Ludwig Nussel <ludwig nussel suse de>]

Hi,

802.11x connections that are configured to always prompt for the
password also always require polkit authentication (bgo#646187).

I tried to find out why but got stuck. AFAICS one culprit is
has_system_secrets() in src/settings/nm-agent-manager.c. It iterates
over all properties of a connection and checks whether the flags are
NM_SETTING_SECRET_FLAG_NONE. Of course the flags for 'password'
don't match but since the iterates goes over all properties, others
like 'psk' are at their default value which happens to be
NM_SETTING_SECRET_FLAG_NONE too. So has_system_secrets() always
returns true.
I suppose there needs to be a set_secrets_not_required() call
somewhere to indicate that the other potential secrets actually do
not apply to this connection. Alternatively an extra flag != NONE
could be set explicitly to indicate system secrets.

Suppose that bug is fixed and NM rightfully choses that code path
the PK popup at that point would be still annyoing. It's there to
avoid leaking system stored secrets to the user's agent. What are
those secrets needed for in the user's agent anyways though?

After hacking has_system_secrets() to always return false still the
attached patch is needed to make NM take the supplied secrets.

Btw, why does NM actually distinguish agent owned and not saved?
Shouldn't that decision just be left to the user's agent? The user
agent could lie about where it got the secret from anyways.

Btw2, for 802.1x it would make sense to also not store the user name
globally.

cu
Ludwig

-- 
 (o_   Ludwig Nussel
 //\
 V_/_  http://www.suse.de/
SUSE LINUX Products GmbH, GF: Jeff Hawn, Jennifer Guild, Felix Imendörffer, HRB 16746 (AG Nürnberg) 

>From b2a51325d95ad89bea62bed5cce63c1290a2f92d Mon Sep 17 00:00:00 2001
From: Ludwig Nussel <ludwig nussel suse de>
Date: Tue, 27 Sep 2011 12:34:11 +0200
Subject: [PATCH] treat not saved secrets just like agent owned when cleaning

---
 src/settings/nm-settings-connection.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/src/settings/nm-settings-connection.c b/src/settings/nm-settings-connection.c
index cdad832..4cd9395 100644
--- a/src/settings/nm-settings-connection.c
+++ b/src/settings/nm-settings-connection.c
@@ -592,7 +592,7 @@ clear_nonagent_secrets (GHashTableIter *iter,
                         NMSettingSecretFlags flags,
                         gpointer user_data)
 {
-	if (flags != NM_SETTING_SECRET_FLAG_AGENT_OWNED)
+	if (!(flags & (NM_SETTING_SECRET_FLAG_AGENT_OWNED | NM_SETTING_SECRET_FLAG_NOT_SAVED)))
 		g_hash_table_iter_remove (iter);
 	return TRUE;
 }
-- 
1.7.3.4