Добрый день, коллеги.
Нужно как-то понять каким образом могу я убрать возможность у других юзеров просматривать сохраненный пароль для приватного ключа в nm-connection-editor (Private Key Password)
Копал в сторону polkit правил sudo nano /var/lib/polkit-1/localauthority/50-local.d/10-network-manager.pkla
[Prevent foo from modifying all network states and settings except with admin password]
Identity=unix-user:test2
Action=org.freedesktop.NetworkManager.*
ResultAny=no
ResultInactive=no
ResultActive=auth_admin_keepне помогло. действует не так как ожидал. сначала просит пароль sudo а потом и пароль от приватного ключа.
пробовал в /etc/NetworkManager/system-connections/Sber.nmconnection менять строки
#private-key-password=password
на
private-key-password-flags=1
курил доки по networkmanager нашел там опцию
private-key
Contains the private key when the "eap" property is set to "tls". Key data is specified using a "scheme"; two are currently supported: blob and path. When using the blob scheme and private keys, this property should be set to the key's encrypted PEM encoded data. When using private keys with the path scheme, this property should be set to the full UTF-8 encoded path of the key, prefixed with the string "file://" and ending with a terminating NUL byte. When using PKCS#12 format private keys and the blob scheme, this property should be set to the PKCS#12 data and the "private-key-password" property must be set to password used to decrypt the PKCS#12 certificate and key. When using PKCS#12 files and the path scheme, this property should be set to the full UTF-8 encoded path of the key, prefixed with the string "file://" and ending with a terminating NUL byte, and as with the blob scheme the "private-key-password" property must be set to the password used to decode the PKCS#12 private key and certificate. WARNING: "private-key" is not a "secret" property, and thus unencrypted private key data using the BLOB scheme may be readable by unprivileged users. Private keys should always be encrypted with a private key password to prevent unauthorized access to unencrypted private key data.
Format: byte array