Bug 1935261

On gdm-40.0-3.el8 and gnome-shell-3.32.2-31.el8, I still see all networking options greyed out at the GDM login screen. Am I missing something?

Ray and I agreed to be conservative and not change the default behavior. That's why gdm installs a default polkit rule that disables network-configuration for the gdm user. It can be overriden by something like

/etc/polkit-1/rules.d/org.gnome.gdm.rules:
  polkit.addRule(function(action, subject) {
      if (action.id == "org.freedesktop.NetworkManager.network-control" {
          return polkit.Result.YES;
      }

      return polkit.Result.NOT_HANDLED;
  });

Ah okay, I understand now but am still having trouble. 

I created a /etc/polkit-1/rules.d/org.gnome.gdm.rules file with the content you suggested with some additions from the git commit as follows:

polkit.addRule(function(action, subject) {
    if (action.id == "org.freedesktop.NetworkManager.network-control" &&
        subject.user == "@GDM_USERNAME@") {
            return polkit.Result.YES;
    }

    return polkit.Result.NOT_HANDLED;
});

After restarting GDM/rebooting, I still don't have the ability to modify networking settings

Jumped the gun here. 

Replacing "@GDM_USERNAME@" with just "gdm" allows network configuration. 

So the content of the .rules file should be as follows:

polkit.addRule(function(action, subject) {
    if (action.id == "org.freedesktop.NetworkManager.network-control" &&
        subject.user == "gdm") {
            return polkit.Result.YES;
    }

    return polkit.Result.NOT_HANDLED;
});

(In reply to Michael Boisvert from comment #12)
> Ah okay, I understand now but am still having trouble. 
> 
> I created a /etc/polkit-1/rules.d/org.gnome.gdm.rules file with the content
> you suggested with some additions from the git commit as follows:
> 
> polkit.addRule(function(action, subject) {
>     if (action.id == "org.freedesktop.NetworkManager.network-control" &&
>         subject.user == "@GDM_USERNAME@") {
>             return polkit.Result.YES;
>     }
> 
>     return polkit.Result.NOT_HANDLED;
> });

The file in the git commit is a template, from which the actual rule is generated at build time: @GDM_USERNAME@ is replaced by gdm. The above override literally matches a user called @GDM_USERNAME@, which doesn't exist. It should work oif you replace it with "gdm".

(In reply to Florian Müllner from comment #14)
> (In reply to Michael Boisvert from comment #12)
> > Ah okay, I understand now but am still having trouble. 
> > 
> > I created a /etc/polkit-1/rules.d/org.gnome.gdm.rules file with the content
> > you suggested with some additions from the git commit as follows:
> > 
> > polkit.addRule(function(action, subject) {
> >     if (action.id == "org.freedesktop.NetworkManager.network-control" &&
> >         subject.user == "@GDM_USERNAME@") {
> >             return polkit.Result.YES;
> >     }
> > 
> >     return polkit.Result.NOT_HANDLED;
> > });
> 
> The file in the git commit is a template, from which the actual rule is
> generated at build time: @GDM_USERNAME@ is replaced by gdm. The above
> override literally matches a user called @GDM_USERNAME@, which doesn't
> exist. It should work oif you replace it with "gdm".

Thanks for the quick reply, I ended up figuring it out.

The next hurdle is that you cannot connect to a VPN. When attempting to connect to a VPN at the login screen, the popup where you input your pin/token never arrives. I imagine its blocked in some way. It is possible to disconnect from the VPN and adjust all WiFi settings though.

Ah yes, I missed that we disable the component that is responsible for handling network secrets on the login screen. It should work now in gnome-shell-3.32.2-32.el8.

Using gdm-40.0-3.el8, gnome-shell-3.32.2-32.el8 and the polkit rule mentioned earlier, you can fully configure your networking needs at the gdm login screen.

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Moderate: GNOME security, bug fix, and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2021:4381