ekklesiaandClaude Opus 5
bf7b959893
These are shared computers in rooms full of people, and in a stock Plasma
desktop "use the network" and "read the network's password" are much
closer together than they look.
Measured on Debian 13 with NetworkManager 1.52 and Plasma 6.3:
* org.freedesktop.NetworkManager.settings.modify.own ships as "yes" for
an active session — no prompt, no administrator. It covers any
connection whose connection.permissions names that user, and a Wi-Fi
network added from the desktop is created exactly that way. So a
password a teacher types in is readable by the next person to sit
down.
* the applet offers "Show Network's QR Code" on every saved wireless
connection, and the QR code contains the pre-shared key.
* that action, and the "Configure…" beside it, are contextual actions in
ConnectionItem.qml and do NOT consult
authorizeControlModule("kcm_networkmanagement"). The Kiosk key gates
the toolbar button only. Hiding buttons was never going to be the
answer.
Every one of those paths ends at NetworkManager's GetSecrets, so that is
where this is answered. A polkit rule refuses settings.modify.own,
settings.modify.system, both wifi.share actions and the machine-wide
settings, for the classroom user by name.
Deliberately NOT refused: network-control, wifi.scan and the
enable/disable actions. None returns a secret, and they are what
connecting and seeing a network are made of. Automatic reconnection does
not go through polkit at all — NetworkManager does it as root — so nothing
here can stop the room coming back on the network after a reboot, which is
the property that matters most on a Sunday.
An administrator's account and root are untouched, and the override route
is the same one the sleep rule has.
classroom-wifi is the other half, and it is a requirement rather than a
convenience: it provisions the church Wi-Fi as a SYSTEM connection, with
no connection.permissions, psk-flags=0 and a 0600 root:root file. A
connection the machine owns is one nobody in the room can read. Verified
against real NetworkManager in the lab — the classroom account gets
"Permission denied" on the file, "--" from nmcli and "Insufficient
privileges" from GetSecrets, while autoconnect stays on.
There is deliberately no teacher-facing join dialog. Anything that lets
the room add a connection lets the room own it, and an owned connection is
a readable one; docs/networking.md says so rather than leaving it to be
rediscovered.
The rule is plain JavaScript, so the test evaluates it with polkit's
objects stubbed and asserts both halves: which actions come back NO, and
which are left alone. What it cannot test is the last mile — polkit
resolves a subject through logind and a container has no graphical seat
session, so every check there is denied for reasons unrelated to this
rule. That one is a physical check, and it is written down as one.
Co-Authored-By: Claude Opus 5 <[email protected]>
109 lines
4.5 KiB
Markdown
109 lines
4.5 KiB
Markdown
# Classroom networking
|
|
|
|
Ethernet remains the normal classroom connection. The package also installs
|
|
and enables NetworkManager so an administrator can add Wi-Fi when a room needs
|
|
it; there is no classroom Wi-Fi screen and no network name or password in the
|
|
package.
|
|
|
|
## Add Wi-Fi
|
|
|
|
From a terminal or SSH session, run:
|
|
|
|
```
|
|
sudo nmtui
|
|
```
|
|
|
|
Choose **Activate a connection**, select the church Wi-Fi network, enter its
|
|
password, and activate it. NetworkManager saves the connection as a system
|
|
connection and reconnects it automatically after reboot.
|
|
|
|
Useful checks:
|
|
|
|
```
|
|
nmcli device status
|
|
nmcli connection show
|
|
systemctl status NetworkManager
|
|
```
|
|
|
|
There is nothing to configure on a computer without Wi-Fi hardware.
|
|
NetworkManager starts normally, sees no Wi-Fi device, and Ethernet continues
|
|
to work.
|
|
|
|
## Existing Ethernet configuration
|
|
|
|
Do not remove or rewrite `/etc/network/interfaces` as part of this procedure.
|
|
Debian Trixie's NetworkManager configuration uses the `ifupdown` plugin with
|
|
`managed=false`, so any Ethernet interface declared there remains under
|
|
ifupdown's control. NetworkManager manages other interfaces, including Wi-Fi.
|
|
This preserves an existing static or ifupdown Ethernet setup.
|
|
|
|
The package disables `NetworkManager-wait-online.service`; no classroom
|
|
feature is allowed to hold boot waiting for Wi-Fi or Internet access. Saved
|
|
connections still reconnect automatically.
|
|
|
|
## Wi-Fi passwords, and who may see them
|
|
|
|
These are shared computers in rooms full of people. The classroom account
|
|
has to be able to USE the church Wi-Fi and must never be able to READ its
|
|
password. In a stock Plasma desktop those two are much closer together
|
|
than they look.
|
|
|
|
**Provision Wi-Fi with `classroom-wifi`, as root.** Not from the desktop.
|
|
|
|
```
|
|
classroom-wifi "Church Wi-Fi" # prompts, never echoes, never in ps
|
|
classroom-wifi --list
|
|
classroom-wifi --forget "Old Network"
|
|
```
|
|
|
|
This is a requirement, not a convenience. A wireless network added from
|
|
the desktop becomes a **user** connection: NetworkManager records
|
|
`connection.permissions` naming whoever added it, and Debian allows that
|
|
user to read its secrets with **no authentication at all** —
|
|
`org.freedesktop.NetworkManager.settings.modify.own` ships as `yes` for an
|
|
active session. Plasma's applet then offers *Show Network's QR Code* on
|
|
every saved wireless connection, and that QR code contains the pre-shared
|
|
key. So a password typed in at the desktop is readable by the next person
|
|
to sit down.
|
|
|
|
`classroom-wifi` creates a **system** connection instead: no
|
|
`connection.permissions`, secrets in a root-only file
|
|
(`/etc/NetworkManager/system-connections/*.nmconnection`, 0600 root:root),
|
|
`psk-flags=0` so nothing lands in a login keyring. Every account can use
|
|
it, and NetworkManager reconnects at boot on its own — no teacher ever
|
|
re-enters it.
|
|
|
|
### What is refused, and what is deliberately not
|
|
|
|
`49-ekklesia-classroom-network.rules` answers at NetworkManager rather
|
|
than in a menu, because hiding buttons is not a control: the applet's
|
|
*Show Network's QR Code* and *Configure…* are contextual actions that do
|
|
**not** consult the Kiosk key which hides its settings button.
|
|
|
|
Refused for `classroom`: `settings.modify.own`, `settings.modify.system`,
|
|
`wifi.share.protected`, `wifi.share.open`, `settings.modify.hostname`,
|
|
`settings.modify.global-dns`, `reload`, `checkpoint-rollback`.
|
|
|
|
Left alone on purpose: `network-control`, `wifi.scan`,
|
|
`enable-disable-network`, `enable-disable-wifi`. None of them returns a
|
|
secret, and they are what connecting and seeing a network are made of. A
|
|
rule that protected a password by taking the room off the internet would
|
|
not be a trade this room can make. Automatic reconnection does not go
|
|
through polkit at all — NetworkManager does it as root — so nothing here
|
|
can stop the room coming back after a reboot.
|
|
|
|
An administrator's own account and root are untouched. To lift any of it
|
|
for maintenance, drop a file of the same name into
|
|
`/etc/polkit-1/rules.d/`, which polkit reads first.
|
|
|
|
### Recovery when there is no network at all
|
|
|
|
There is deliberately no teacher-facing "join a network" dialog in this
|
|
release. Anything that lets the room add a connection also lets the room
|
|
own it, and an owned connection is a readable one. Recovery is an
|
|
administrator running `classroom-wifi` over SSH, or at the machine
|
|
through the maintenance terminal chord. If a room ever needs to join a
|
|
network unattended, that workflow has to be designed so the connection it
|
|
creates still belongs to the machine — not bolted on by relaxing the rule
|
|
above.
|