Register a new secret agent

[benjamin-grzimek]

Hi,
I want to create a small python script that does the same thing as 'nmcli -t agent secret', i.e. register itself as the NetworkManager's secret agent and forward all password requests to the terminal input, replacing the systems dialog. I'm new to D-Bus and couldn't figure out how to do that using python-sdbus-networkmanager. Would it be possible to add a small example for that?

[igo95862]

Hello @benjamin-grzimek

This probably involves the org.freedesktop.NetworkManager.SecretAgent interface:

https://www.networkmanager.dev/docs/api/latest/gdbus-org.freedesktop.NetworkManager.SecretAgent.html

From the documentation it seems like you have to create your own secret agent object and then export it. I can look in to it more in the future.

[benjamin-grzimek]

Thanks, I tried to follow the sdbus documentation to create and export a secret agent:

from asyncio import get_event_loop

import sdbus
from sdbus import request_default_bus_name_async
from sdbus_async.networkmanager import NetworkManagerSecretAgentInterfaceAsync, \
    NetworkManagerAgentManager

sdbus.set_default_bus(sdbus.sd_bus_open_system())

loop = get_event_loop()
secret_agent = NetworkManagerSecretAgentInterfaceAsync()


async def start() -> None:
    # Acquire a name on the bus
    await request_default_bus_name_async('org.example.test')
    # Start serving at / path
    secret_agent.export_to_dbus('/')
    # Register the agent
    agent_manager = NetworkManagerAgentManager()
    await agent_manager.register('org.example.test')


loop.run_until_complete(start())
loop.run_forever()

which leads to a sdbus.dbus_exceptions.DbusAccessDeniedError: Connection ":1.1539" is not allowed to own the service "org.example.test" due to security policies in the configuration file error.
Running with sudo permissions does not help. But it should not be needed, because I did manage running a secret agent using an example from the archived D-Bus wrapper without any extra permissions python-networkmanager.
Using the user bus results in a different error: sdbus.dbus_exceptions.DbusServiceUnknownError: The name org.freedesktop.NetworkManager was not provided by any .service files

So I guess I must be doing something wrong. For now, I will be using the python-networkmanager library, but I would still be interested to know how to use this library instead.

[igo95862]

After reading NetworkManager documentation I realized that the agent is not required to obtain any D-Bus names.

So I fixed your code and added example of overriding the agent methods:

from __future__ import annotations

from asyncio import new_event_loop
from typing import Any

import sdbus
from sdbus_async.networkmanager import (
    NetworkManagerSecretAgentInterfaceAsync,
    NetworkManagerAgentManager,
    NetworkManagerConnectionProperties,
)

sdbus.set_default_bus(sdbus.sd_bus_open_system())


class MySecretAgent(NetworkManagerSecretAgentInterfaceAsync):
    @sdbus.dbus_method_async_override()
    async def get_secrets(
        self,
        connection: NetworkManagerConnectionProperties,
        connection_path: str,
        setting_name: str,
        hints: list[str],
        flags: int,
    ) -> dict[str, dict[str, tuple[str, Any]]]:
        """Retrieve stored secrets"""
        print("get_secrets called")
        print("Connection:", connection)
        print("Connection path:", connection_path)
        print("Setting name:", setting_name)
        print("Hints:", hints)
        print("Flags:", flags)
        raise NotImplementedError

    @sdbus.dbus_method_async_override()
    async def save_secrets(
        self,
        connection: NetworkManagerConnectionProperties,
        connection_path: str,
    ) -> None:
        """Save given secrets"""
        print("save_secrets called")
        print("Connection:", connection)
        print("Connection path:", connection_path)
        raise NotImplementedError


secret_agent = MySecretAgent()


async def start() -> None:
    # Start serving at /org/freedesktop/NetworkManager/SecretAgent path
    secret_agent.export_to_dbus('/org/freedesktop/NetworkManager/SecretAgent')
    # Register the agent
    agent_manager = NetworkManagerAgentManager()
    await agent_manager.register('org.example.test')
    print("Registered")


loop = new_event_loop()
loop.run_until_complete(start())
loop.run_forever()

After running it and editing some Wifi passwords with nm-connection-editor it seems to be working:

Registered
save_secrets called
Connection: {'connection': {'id': ('s', 'Access Point'), .....................
Connection path: /org/freedesktop/NetworkManager/Settings/8

[igo95862]

You can also use the ConnectionProfile to convert connection dict to a dataclass:

from sdbus_async.networkmanager.settings import ConnectionProfile

print(ConnectionProfile.from_dbus(connection))

[benjamin-grzimek]

Very nice, that is exactly what I was looking for. Thank you for your help!
I thought that registering works through the exported D-Bus name, but if that is actually not needed, that solves the problem of obtaining a name on the system bus.