Description of problem:
man nm-settings-keyfile states the following

"For security, it will ignore files that are readable or writable by any user or group other than 'root' since private keys and passphrases may be stored in plaintext inside the file."

However if you create /etc/NetworkManager/system-connections/* and make its mode 640, ownership root:root it will be ignored by NetworkManager

Version-Release number of selected component (if applicable):
This behaviour is present in RHEL 7/8 and fc31

How reproducible:
Every time

Steps to Reproduce:
1. create a NM connection via keyfile in /etc/NetworkManager/system-connections/*
2. Make sure ownership is root:root
3. set mode to 640
4. restart NetworkManager

Actual results:
File is ignored

Expected results:
File be read and settings applied

Additional info:
Looking at the NM source it looks like it's checking against the umask of 0077

gboolean
nms_keyfile_utils_check_file_permissions_stat (NMSKeyfileFiletype filetype,
                                               const struct stat *st,
                                               GError **error)
{
        g_return_val_if_fail (st, FALSE);

        if (filetype == NMS_KEYFILE_FILETYPE_KEYFILE) {
                if (!S_ISREG (st->st_mode)) {
                        g_set_error_literal (error, NM_SETTINGS_ERROR, NM_SETTINGS_ERROR_INVALID_CONNECTION,
                                             "file is not a regular file");
                        return FALSE;
                }
        } else if (filetype == NMS_KEYFILE_FILETYPE_NMMETA) {
                if (   !S_ISLNK (st->st_mode)
                    && !S_ISREG (st->st_mode)) {
                        g_set_error_literal (error, NM_SETTINGS_ERROR, NM_SETTINGS_ERROR_INVALID_CONNECTION,
                                             "file is neither a symlink nor a regular file");
                        return FALSE;
                }
        } else
                g_return_val_if_reached (FALSE);

        if (!NM_FLAGS_HAS (nm_utils_get_testing (), NM_UTILS_TEST_NO_KEYFILE_OWNER_CHECK)) {
                if (st->st_uid != 0) {
                        g_set_error (error, NM_SETTINGS_ERROR, NM_SETTINGS_ERROR_INVALID_CONNECTION,
                                     "File owner (%lld) is insecure",
                                     (long long) st->st_uid);
                        return FALSE;
                }

                if (   S_ISREG (st->st_mode)
                    && (st->st_mode & 0077)) {        <<<<<------   
                        g_set_error (error, NM_SETTINGS_ERROR, NM_SETTINGS_ERROR_INVALID_CONNECTION,
                                     "File permissions (%03o) are insecure",
                                     st->st_mode);
                        return FALSE;
                }
        }

        return TRUE;
}



The code could be fixed to do what the man page states by adding in an additional check for st->st_gid != 0 to make sure the group is set to root, and then the 0077 could be changed to 0007 to allow 640 to work.