Re: connection to disable an interface

[Adrian Freihofer <adrian freihofer gmail com>]

On Sat, 2022-05-14 at 21:54 +0200, Thomas Haller via networkmanager-
list wrote:
> On Sat, 2022-05-14 at 22:43 +0300, Andrei Borzenkov wrote:
> > On 14.05.2022 22:24, Thomas Haller wrote:
> > > Hi,
> > >
> > >
> > > On Sat, 2022-05-14 at 07:38 +0300, Andrei Borzenkov via
> > > networkmanager-
> > > list wrote:
> > > > > The background is a security requirement. Unused interfaces
> > > > > must
> > > > > ideally remain disabled at the physical layer when a cable is
> > > > > plugged
> > > > > in. Ideally, the LEDs would also remain dark.
> > > >
> > > > It sounds like
> > > >
> > > > no-auto-default=*
> > > >
> > > > mostly does what you want.

Yes, we are already doing that. But it's only part of the solution.

> > > that option merely disables that NetworkManager will automatically
> > > generate a profile for ethernet devices, that don't have a profile
> > > yet.
> > > Such profiles are called "Wired connection 1", which is how you can
> > > recognize it.
> > >
> > > This does very little magic, you can manually create a profile to
> > > the
> > > same effect. In any case, NetworkManager would have already set the
> > > interface IFF_UP at this point -- regardless of "(no-)auto-
> > > default".

It solves the problem after a reboot but it does not allow to disable a
port via DBUS API.

> > Sure, but usual question is - what are the expected threats? Simply
> > having interface up does not hurt anyone (except may be audit
> > company).

That's exactly the point here. The use case is very similar to a switch
where the user can enable or disable a port. The expectation is that
the LEDs go off when the port is disabled and the link establishes as
soon as the port gets enabled. The enable part is perfectly handled by
NetworkManager. But the disable case is at least not obvious to me.

In more detail: The use case is that Linux manages a switch via DSA.
Creating a bridge with NetworkManager configures the switch chip to do
all the switching in hardware. It's really great. Only the disabling of
a port via DBUS API is not really ready for a security audit or a
perfect responsive UI.

That's why I'm asking if the "ip link down" feature could be somehow
provided via DBUS API and nmconnection file by NetworkManager.

Adrian

> > But having automatic profile on interface allows someone to connect
> > PC
> > with DHCP server and so get known IP address to (attempt to) access
> > the
> > server. This is prevented by no-auto-default.
>
> you are right!
>
> Thomas
>
> _______________________________________________
> networkmanager-list mailing list
> networkmanager-list gnome org
> https://mail.gnome.org/mailman/listinfo/networkmanager-list