From 04af28bc2f73c4652a58a94e623884f68a8c790a Mon Sep 17 00:00:00 2001 From: Josephine Pfeiffer Date: Mon, 6 Jul 2026 10:45:56 +0200 Subject: [PATCH] Update to 1.58.0 (rc1) Also fix RPM scriptlet dependencies for udev-less installs: Adjust %postun to skip udevadm when udevd isn't accessible, matching %post. This lets the package install and remove inside a container or rpm-ostree system without udev. Move the /usr/sbin/update-alternatives dependency to the initscripts-updown subpackage, which is the only consumer, and drop the systemd-udev Requires(post) from the main package. Backport of upstream 09e2de8b. Resolves: RHEL-93551 Resolves: RHEL-126543 Resolves: RHEL-149149 Resolves: RHEL-126455 Resolves: RHEL-129186 Resolves: RHEL-140113 Resolves: RHEL-182559 Signed-off-by: Josephine Pfeiffer --- .gitignore | 1 + ...re-permissive-modify-system-defaults.patch | 32 ++++ 24-clat-auto.conf | 32 ++++ NetworkManager.spec | 163 ++++++++---------- sources | 2 +- 5 files changed, 142 insertions(+), 88 deletions(-) create mode 100644 0001-policy-restore-permissive-modify-system-defaults.patch create mode 100644 24-clat-auto.conf diff --git a/.gitignore b/.gitignore index 249cf70..0a3a722 100644 --- a/.gitignore +++ b/.gitignore @@ -467,3 +467,4 @@ network-manager-applet-0.8.1.tar.bz2 /NetworkManager-1.55.91.tar.xz /NetworkManager-1.56.0.tar.xz /NetworkManager-1.56.1.tar.xz +/NetworkManager-1.58-rc1.tar.xz diff --git a/0001-policy-restore-permissive-modify-system-defaults.patch b/0001-policy-restore-permissive-modify-system-defaults.patch new file mode 100644 index 0000000..59b4cdb --- /dev/null +++ b/0001-policy-restore-permissive-modify-system-defaults.patch @@ -0,0 +1,32 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Josephine Pfeiffer +Date: Thu, 9 Jul 2026 00:00:00 +0200 +Subject: [PATCH] policy: restore permissive modify.system defaults + +RHEL 10 previously built NetworkManager with modify_system=true, which +allowed local console users to modify system connections without +authentication. Upstream 1.58 removed that build option and now defaults +the action to auth_admin_keep. + +Keep the existing RHEL 10 behavior for minor-release compatibility. +--- + data/org.freedesktop.NetworkManager.policy.in | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/data/org.freedesktop.NetworkManager.policy.in b/data/org.freedesktop.NetworkManager.policy.in +index c6797f47d2..548f69982a 100644 +--- a/data/org.freedesktop.NetworkManager.policy.in ++++ b/data/org.freedesktop.NetworkManager.policy.in +@@ -117,8 +117,8 @@ + System policy prevents modification of network settings for all users + + auth_admin_keep +- auth_admin_keep +- auth_admin_keep ++ yes ++ yes + + + +-- +2.52.0 diff --git a/24-clat-auto.conf b/24-clat-auto.conf new file mode 100644 index 0000000..668ec04 --- /dev/null +++ b/24-clat-auto.conf @@ -0,0 +1,32 @@ +# CLAT implements the client part of 464XLAT (RFC 6877), an +# architecture that provides IPv4 connectivity to hosts on IPv6-only +# networks. +# +# The default value for the connection property 'ipv4.clat' is still +# 'no'. Change it globally to 'auto' (1) so that CLAT gets enabled +# automatically when the network advertises a PREF64 and there is no +# native IPv4 configured (either because DHCPv4 option 108 was +# received or because there is no DHCPv4 server). +# +# See: https://fedoraproject.org/wiki/Changes/IPv6-Mostly_Support_In_NetworkManager + +# Do not modify this file. You can hide/overwrite this file by +# creating "/etc/NetworkManager/conf.d/24-clat-auto.conf". You can +# also add configuration snippets with higher priority that override +# this setting (see `man 5 NetworkManager.conf`). Most importantly, +# this snippet only sets default values for the profile. You can +# explicitly set the value for each profile, so that this default +# value is not used. + +# For example, on a particular profile/network set +# +# $ nmcli connection modify "$PROFILE" ipv4.clat no +# +# to disable CLAT. This prevents the default from this file to take +# effect. + +[connection-24-clat-auto] +ipv4.clat=1 + +[.config] +enable=nm-version-min:1.57 diff --git a/NetworkManager.spec b/NetworkManager.spec index f1133d8..72646d2 100644 --- a/NetworkManager.spec +++ b/NetworkManager.spec @@ -1,15 +1,20 @@ +Name: NetworkManager +Summary: Network connection manager and user applications +License: GPL-2.0-or-later AND LGPL-2.1-or-later +URL: https://networkmanager.dev/ +Group: System Environment/Base + +Epoch: 1 +Version: 1.58~rc1 +Release: 1%{?dist} + +############################################################################### + %global wpa_supplicant_version 1:1.1 %global ppp_version %(pkg-config --modversion pppd 2>/dev/null || sed -n 's/^#define\\s*VERSION\\s*"\\([^\\s]*\\)"$/\\1/p' %{_includedir}/pppd/patchlevel.h 2>/dev/null | grep . || echo bad) %global glib2_version %(pkg-config --modversion glib-2.0 2>/dev/null || echo bad) -%global epoch_version 1 -%global real_version 1.56.1 -%global git_tag_version 1.56.1 -%global rpm_version %{real_version} -%global release_version 1 -%global snapshot %{nil} -%global git_sha %{nil} %global bcond_default_debug 0 %global bcond_default_lto %{nil} %global bcond_default_test 0 @@ -24,27 +29,11 @@ %global _hardened_build 1 -%if "x%{?snapshot}" != "x" -%global snapshot_dot .%{snapshot} -%endif -%if "x%{?git_sha}" != "x" -%global git_sha_dot .%{git_sha} -%endif - -%global snap %{?snapshot_dot}%{?git_sha_dot} - -%global real_version_major %(printf '%s' '%{real_version}' | sed -n 's/^\\([1-9][0-9]*\\.[0-9][0-9]*\\)\\.[0-9][0-9]*$/\\1/p') - %global systemd_units NetworkManager.service NetworkManager-wait-online.service NetworkManager-dispatcher.service nm-priv-helper.service %global systemd_units_cloud_setup nm-cloud-setup.service nm-cloud-setup.timer ############################################################################### -%if 0%{?fedora} > 40 || 0%{?rhel} >= 10 -%bcond_with dhclient -%else -%bcond_without dhclient -%endif %bcond_without adsl %bcond_without bluetooth %bcond_without wwan @@ -98,7 +87,13 @@ %else %bcond_without iwd %endif - +%bcond_without polkit_noauth_group +%ifarch %{ix86} +# there is no bpftool in i686 +%bcond_with clat +%else +%bcond_without clat +%endif ############################################################################### %global dbus_version 1.9.18 @@ -145,17 +140,6 @@ %bcond_with ifcfg_migrate %endif -%if 0%{?fedora} -# Although eBPF would be available on Fedora's kernel, it seems -# we often get SELinux denials (rh#1651654). But even aside them, -# bpf(BPF_MAP_CREATE, ...) randomly fails with EPERM. That might -# be related to `ulimit -l`. Anyway, this is not usable at the -# moment. -%global ebpf_enabled "no" -%else -%global ebpf_enabled "no" -%endif - # Fedora 33 enables LTO by default by setting CFLAGS="-flto -ffat-lto-objects". # However, we also require "-flto -flto-partition=none", so disable Fedora's # default and use our configure option --with-lto instead. @@ -163,16 +147,7 @@ ############################################################################### -Name: NetworkManager -Summary: Network connection manager and user applications -Epoch: %{epoch_version} -Version: %{rpm_version} -Release: %{release_version}%{?snap}%{?dist} -Group: System Environment/Base -License: GPL-2.0-or-later AND LGPL-2.1-or-later -URL: https://networkmanager.dev/ - -Source: https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/releases/%{git_tag_version}/downloads/%{name}-%{real_version}.tar.xz +Source: https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/releases/%{version_no_tilde}/downloads/%{name}-%{version_no_tilde}.tar.xz Source1: NetworkManager.conf Source2: 00-server.conf Source4: 20-connectivity-fedora.conf @@ -181,27 +156,21 @@ Source6: 22-wifi-mac-addr.conf Source7: 70-nm-connectivity.conf Source8: readme-ifcfg-rh.txt Source9: readme-ifcfg-rh-migrated.txt +Source10: 24-clat-auto.conf -# RHEL downstream patches that change behavior from upstream. -# These are not bugfixes, hence they are also relevant after -# the next rebase of the source tarball. -# Patch0001: 0001-some.patch - -# Bugfixes that are only relevant until next rebase of the package. -# Patch1001: 1001-some.patch +Patch0001: 0001-policy-restore-permissive-modify-system-defaults.patch Requires(post): systemd -Requires(post): systemd-udev -Requires(post): /usr/sbin/update-alternatives Requires(preun): systemd -Requires(preun): /usr/sbin/update-alternatives Requires(postun): systemd Requires: dbus >= %{dbus_version} Requires: glib2 >= %{glib2_version} Requires: %{name}-libnm%{?_isa} = %{epoch}:%{version}-%{release} -Recommends: iputils +%if %{with clat} +Requires: libbpf +%endif %if 0%{?rhel} == 8 # Older libndp versions use select() (rh#1933041). On well known distros, @@ -250,7 +219,7 @@ Conflicts: NetworkManager-dispatcher-routing-rules <= 1:1.47.5-3 %endif BuildRequires: gcc -BuildRequires: libtool +BuildRequires: clang BuildRequires: pkgconfig BuildRequires: meson BuildRequires: gettext-devel >= 0.19.8 @@ -305,6 +274,10 @@ BuildRequires: firewalld-filesystem BuildRequires: iproute BuildRequires: iproute-tc BuildRequires: libnvme-devel >= 1.5 +%if %{with clat} +BuildRequires: libbpf-devel +BuildRequires: bpftool +%endif Provides: %{name}-dispatcher%{?_isa} = %{epoch}:%{version}-%{release} @@ -573,6 +546,8 @@ Group: System Environment/Base BuildArch: noarch Requires: NetworkManager Requires: /usr/bin/nmcli +Requires(post): /usr/sbin/update-alternatives +Requires(preun): /usr/sbin/update-alternatives Obsoletes: NetworkManager < %{obsoletes_initscripts_updown} %description initscripts-updown @@ -583,7 +558,7 @@ Preferably use nmcli instead. %prep -%autosetup -p1 -n NetworkManager-%{real_version} +%autosetup -p1 -n NetworkManager-%{version_no_tilde} %build @@ -595,11 +570,7 @@ Preferably use nmcli instead. %endif -Dnft=%{_sbindir}/nft \ -Diptables=%{_sbindir}/iptables \ -%if %{with dhclient} - -Ddhclient=%{_sbindir}/dhclient \ -%else - -Ddhclient=no \ -%endif + -Dip6tables=%{_sbindir}/ip6tables \ -Ddhcpcd=no \ -Dcrypto=gnutls \ %if %{with debug} @@ -623,19 +594,20 @@ Preferably use nmcli instead. %endif %if %{with wifi} -Dwifi=true \ -%if 0%{?fedora} - -Dwext=true \ -%else - -Dwext=false \ -%endif %else -Dwifi=false \ %endif + -Dwext=false \ %if %{with iwd} -Diwd=true \ %else -Diwd=false \ %endif +%if %{with clat} + -Dclat=true \ +%else + -Dclat=false \ +%endif %if %{with bluetooth} -Dbluez5_dun=true \ %else @@ -672,22 +644,20 @@ Preferably use nmcli instead. -Dselinux=true \ -Dpolkit=true \ -Dconfig_auth_polkit_default=true \ - -Dmodify_system=true \ +%if %{with polkit_noauth_group} + -Dpolkit_noauth_group=wheel \ +%endif -Dconcheck=true \ %if 0%{?fedora} -Dlibpsl=true \ %else -Dlibpsl=false \ -%endif -%if %{ebpf_enabled} != "yes" - -Debpf=false \ -%else - -Debpf=true \ %endif -Dsession_tracking=systemd \ -Dsuspend_resume=systemd \ -Dsystemdsystemunitdir=%{_unitdir} \ - -Dsystem_ca_path=/etc/pki/tls/cert.pem \ + -Dsystemdsystemgeneratordir=%{_systemdgeneratordir} \ + -Dsystem_ca_path=/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem \ -Ddbus_conf_dir=%{dbus_sys_dir} \ -Dtests=yes \ -Dvalgrind=no \ @@ -716,14 +686,7 @@ Preferably use nmcli instead. -Dconfig_dns_rc_manager_default=%{dns_rc_manager_default} \ -Dconfig_logging_backend_default=journal -# Limit number of jobs on ppc64 to prevent high RAM usage -%ifarch ppc64le -%global numjobs 4 -%else -%global numjobs %{_smp_build_ncpus} -%endif - -%meson_build -j %{numjobs} +%meson_build %install %meson_install @@ -745,6 +708,9 @@ cp %{SOURCE7} %{buildroot}%{_sysctldir} %if 0%{?fedora} >= 40 cp %{SOURCE6} %{buildroot}%{nmlibdir}/conf.d/ %endif +%if 0%{?fedora} >= 45 +cp %{SOURCE10} %{buildroot}%{nmlibdir}/conf.d/ +%endif %if %{with ifcfg_warning} cp %{SOURCE8} %{buildroot}%{_sysconfdir}/sysconfig/network-scripts @@ -766,6 +732,7 @@ rm -f %{buildroot}%{_libdir}/pppd/%{ppp_version}/*.la rm -f %{buildroot}%{nmplugindir}/*.la # Don't use the *-initrd.service files yet, wait dracut to support them +rm -f %{buildroot}%{_systemdgeneratordir}/nm-initrd-generator.sh rm -f %{buildroot}%{_unitdir}/NetworkManager-config-initrd.service rm -f %{buildroot}%{_unitdir}/NetworkManager-initrd.service rm -f %{buildroot}%{_unitdir}/NetworkManager-wait-online-initrd.service @@ -774,8 +741,8 @@ rm -f %{buildroot}%{_unitdir}/NetworkManager-wait-online-initrd.service find %{buildroot}%{_datadir}/gtk-doc -exec touch --reference meson.build '{}' \+ %if 0%{?__debug_package} && ! 0%{?flatpak} -mkdir -p %{buildroot}%{_prefix}/src/debug/NetworkManager-%{real_version} -cp valgrind.suppressions %{buildroot}%{_prefix}/src/debug/NetworkManager-%{real_version} +mkdir -p %{buildroot}%{_prefix}/src/debug/NetworkManager-%{version_no_tilde} +cp valgrind.suppressions %{buildroot}%{_prefix}/src/debug/NetworkManager-%{version_no_tilde} %endif %if %{with ifcfg_rh} @@ -857,8 +824,12 @@ fi %postun -/usr/bin/udevadm control --reload-rules || : -/usr/bin/udevadm trigger --subsystem-match=net || : +# skip triggering if udevd isn't even accessible, e.g. containers or +# rpm-ostree-based systems +if [ -S /run/udev/control ]; then + /usr/bin/udevadm control --reload-rules || : + /usr/bin/udevadm trigger --subsystem-match=net || : +fi %firewalld_reload %systemd_postun %{systemd_units} @@ -893,6 +864,9 @@ fi %if 0%{?fedora} >= 40 %{nmlibdir}/conf.d/22-wifi-mac-addr.conf %endif +%if 0%{?fedora} >= 45 +%{nmlibdir}/conf.d/24-clat-auto.conf +%endif %ghost %{_sysconfdir}/%{name}/VPN %{_bindir}/nm-online %{_libexecdir}/nm-dhcp-helper @@ -931,6 +905,9 @@ fi %{_datadir}/dbus-1/system-services/org.freedesktop.nm_dispatcher.service %{_datadir}/dbus-1/system-services/org.freedesktop.nm_priv_helper.service %{_datadir}/polkit-1/actions/*.policy +%if %{with polkit_noauth_group} +%{_datadir}/polkit-1/rules.d/org.freedesktop.NetworkManager.rules +%endif %{_prefix}/lib/udev/rules.d/*.rules %{_prefix}/lib/firewalld/zones/nm-shared.xml # systemd stuff @@ -1087,6 +1064,18 @@ fi %changelog +* Thu Jul 02 2026 Josephine Pfeiffer - 1:1.58~rc1-1 +- Update to 1.58-rc1 release +- Add IPv6-mostly support with CLAT via a BPF program (RHEL-93551) +- Keep permissive modify.system polkit defaults for RHEL 10 minor compatibility +- Warn about gateways that are not directly reachable (RHEL-126543) +- Fix suppressing DHCPv6 DNS servers with ipv6.ignore-auto-dns on reapply (RHEL-149149) +- Fix sending DHCP release on bridge interfaces (RHEL-126455) +- Allow selecting from available devices when creating profiles in nmtui (RHEL-129186) +- Fix AVC error when running NetworkManager --print-config as systemd service (RHEL-140113) +- Fix invalid default value of the bond arp_missed_max option (RHEL-182559) +- Fix RPM scriptlet dependencies for udev-less container installs + * Thu May 14 2026 Ján Václav - 1:1.56.1-1 - Update to 1.56.1 - fix handling onlink route flag for ECMP routes (RHEL-1402) diff --git a/sources b/sources index b475cb2..ae9dcc2 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (NetworkManager-1.56.1.tar.xz) = 887d8ee3f80f392fcbaa93d6a704d21be84e246676bb012ab108edcce2503ec875b25a0c3bfab7431e2eb7e3b14a66c662253363a4550f7b283be6885d514d32 +SHA512 (NetworkManager-1.58-rc1.tar.xz) = 35a4ada775e411bfb74345d1d492b9297a3a8c42412d2ca16d74bb118ffe2dc982749761f8b682336e5724213455769032889c4670efe1bfe4a479640b6af328