Firewalld only assigns interface zone in NetworkManager in the CLI script about firewalld

[erig0]

The NetworkManager configuration should be performed in the firewall Python module, not just as part of the CLI script, as the issue is not specific to the CLI.

The nuance here is polkit authorization. If the request is done by the firewalld daemon, then it's not representative of the user making the request via firewall-cmd (or ansible). This means NetworkManager can't apply any reasonable policy for modifying the connections (ZONE) setting; it would always appear to come from the user firewalld runs as, i.e. root.

My guess is the above is why it's done by the UI and not the daemon.

So the question becomes, does it make sense to allow firewalld the daemon to modify NetworkManager's connection profiles. It may side-step NM's existing polkit policies.

I'm not sure it makes sense for firewalld (client or daemon) to forward these requests to NM on behalf of the user. It would be better to configure them through NetworkManager directly, but then users are confused because NM will alter the interface to zone assignment at runtime; overriding firewalld's own configuration. This NM integration has been in firewalld for a long time. We can't just drop it.

@thom311, any thoughts?

[darius-m]

Is it possible to run the firewall Python module without root access? If not, I don't see a reason why firewalld wouldn't go through with the changes at library level, instead of CLI level, since in the end the result would be the same, as you'd still have to run the firewalld commands as root. You also wouldn't violate NetworkManager's polkit policies, since they cannot offer capabilities that root does not have (as far as I know, there might be some niche interactions in SELinux or other other security modules).

[erig0]

Is it possible to run the firewall Python module without root access?

Yes. It's possible to specify and customize the polkit authorization. In practice (default) config changes require root, but they don't have to.