How can I set the permissions for users to make changes to the network connections and state? For instance, how can I allow/disallow users to connect to new wireless networks? How can I allow/disallow users to turn off networking?
You can create a local policy for one or more users.
Create the document where the settings will live...
Add one or more policies...
[Let foo modify system settings for network] Identity=unix-user:foo Action=org.freedesktop.NetworkManager.settings.modify.system ResultAny=no ResultInactive=no ResultActive=yes [Do not allow foo to enable/disable networking] Identity=unix-user:foo Action=org.freedesktop.NetworkManager.settings.enable-disable-network ResultAny=no ResultInactive=no ResultActive=no
The key is the
ResultActive element which can be set to yes, no, auth_admin, or auth_admin_keep where the latter two will require the password of another user with sudo privileges.
Action element defines what action will be allowed/disallowed or require authentication with a password. There are options like
org.freedesktop.NetworkManager.enable-disable-network for toggling network as enabled/disabled. You can see more options in the
/usr/share/polkit-1/actions/org.freedesktop.NetworkManager.policy file, just look for something like
<action id="org.freedesktop.NetworkManager.enable-disable-network"> and read it's description.
You can also set all values with the
[Prevent foo from modifying all network states and settings except with admin password] Identity=unix-user:foo Action=org.freedesktop.NetworkManager.* ResultAny=no ResultInactive=no ResultActive=auth_admin_keep
This will require a password to make ANY change to network settings or state.
You can do this in a single command that could be included in a script...
sudo su -c 'printf "[Prevent foo from modifying all network states and settings]\nIdentity=unix-user:foo\nAction=org.freedesktop.NetworkManager.*\nResultAny=no\nResultInactive=no\nResultActive=auth_admin" > /var/lib/polkit-1/localauthority/50-local.d/10-network-manager.pkla'