[rpms/NetworkManager] rawhide: Remove unused patch files

[rpms/NetworkManager] rawhide: Remove unused patch files

[Josephine Pfeiffer]

            A new commit has been pushed.

            Repo   : rpms/NetworkManager
            Branch : rawhide
            Commit : 47d7c2762e4fde4ce90ad216e73a7c8a4fefd509
            Author : Josephine Pfeiffer <josie@redhat.com>
            Date   : 2026-07-20T17:55:17+02:00
            Stats  : +0/-289 in 2 file(s)
            URL    : https://src.fedoraproject.org/rpms/NetworkManager/c/47d7c2762e4fde4ce90ad216e73a7c8a4fefd509?branch=rawhide

            Log:
            Remove unused patch files

The spec stopped referencing them but the files were never removed.

---
diff --git a/0001-polkit-noauth-group.patch b/0001-polkit-noauth-group.patch
deleted file mode 100644
index 2ba3b17..0000000
--- a/0001-polkit-noauth-group.patch
+++ /dev/null
@@ -1,130 +0,0 @@
-From 3b54d7836cf2baf6bc4a68aed51c7739b727d58a Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?=C3=8D=C3=B1igo=20Huguet?= <ihuguet@riseup.net>
-Date: Wed, 17 Sep 2025 14:31:50 +0200
-Subject: [PATCH] polkit: add build option to allow admin users not to type
- their password
-
-Add a build option to allow installing a Polkit rule that will grant
-permissions for admin users without asking for their password if they're
-in a local console.
-
-This shouldn't be encouraged, though. It's common practice that admin
-users has to introduce their password to make system-wide changes. The
-standard polkit policy, without this rule, is auth_admin_keep. This
-policy will ask for the password once and won't ask for it again for
-~5 minutes, so it is not too unconvenient.
-
-Different distros use different group names for users with admin rights,
-typically 'sudo' or 'wheel'. The build option allows to define the
-desired group, or to leave it empty to not install the rule.
-
-However, until the previous commit it was allowed that local users (even
-non-admin) could do system-wide changes without introducing a password.
-This option allows to maintain the same behavior for admin users,
-keeping backwards compatibility so we avoid breaking existing scripts,
-for example. We cannot achieve the same for non-admin users because
-allowing them to create system-wide connection causes security
-vulnerabilities that cannot be fixed in any other way.
-
-(cherry picked from commit b0006afd5d38318e2a6ef60ef98cae8f9f0d2252)
----
- data/meson.build                             | 11 ++++++++++-
- data/org.freedesktop.NetworkManager.rules.in | 17 +++++++++++++++++
- meson.build                                  |  7 +++++--
- meson_options.txt                            |  1 +
- 4 files changed, 33 insertions(+), 3 deletions(-)
- create mode 100644 data/org.freedesktop.NetworkManager.rules.in
-
-diff --git a/data/meson.build b/data/meson.build
-index b77bf4340c..34c98e3b5f 100644
---- a/data/meson.build
-+++ b/data/meson.build
-@@ -68,8 +68,17 @@ if enable_polkit
-     output: '@BASENAME@',
-     po_dir: po_dir,
-     install: true,
--    install_dir: polkit_gobject_policydir,
-+    install_dir: polkit_policydir,
-   )
-+
-+  if polkit_noauth_group != ''
-+    configure_file(
-+      input: 'org.freedesktop.NetworkManager.rules.in',
-+      output: '@BASENAME@',
-+      install_dir: polkit_rulesdir,
-+      configuration: {'NM_POLKIT_NOAUTH_GROUP': polkit_noauth_group},
-+    )
-+  endif
- endif
- 
- if enable_firewalld_zone
-diff --git a/data/org.freedesktop.NetworkManager.rules.in b/data/org.freedesktop.NetworkManager.rules.in
-new file mode 100644
-index 0000000000..d6df0b323e
---- /dev/null
-+++ b/data/org.freedesktop.NetworkManager.rules.in
-@@ -0,0 +1,17 @@
-+// NetworkManager authorizations/policy for the @NM_POLKIT_NOAUTH_GROUP@ group.
-+//
-+// DO NOT EDIT THIS FILE, it will be overwritten on update.
-+//
-+// Allow users in the @NM_POLKIT_NOAUTH_GROUP@ group to create system-wide connections without being
-+// prompted for a password if they are in a local console.
-+// This is optional and is only recommended to maintain backwards compatibility
-+// in systems where it was already working in this way. It is discouraged
-+// otherwise.
-+
-+polkit.addRule(function(action, subject) {
-+    if (action.id == "org.freedesktop.NetworkManager.settings.modify.system" &&
-+        subject.isInGroup("@NM_POLKIT_NOAUTH_GROUP@") &&
-+        subject.local) {
-+        return polkit.Result.YES;
-+    }
-+});
-diff --git a/meson.build b/meson.build
-index 0657ce5af9..317a74c8f6 100644
---- a/meson.build
-+++ b/meson.build
-@@ -526,7 +526,8 @@ config_h.set10('WITH_TEAMDCTL', enable_teamdctl)
- enable_polkit = get_option('polkit')
- if enable_polkit
-   # FIXME: policydir should be relative to `datadir`, not `prefix`. Fixed in https://gitlab.freedesktop.org/polkit/polkit/merge_requests/2
--  polkit_gobject_policydir = dependency('polkit-gobject-1').get_variable(pkgconfig: 'policydir', pkgconfig_define: ['prefix', nm_prefix])
-+  polkit_policydir = dependency('polkit-gobject-1').get_variable(pkgconfig: 'policydir', pkgconfig_define: ['prefix', nm_prefix])
-+  polkit_rulesdir = join_paths(fs.parent(polkit_policydir), 'rules.d')
- endif
- 
- config_auth_polkit_default = get_option('config_auth_polkit_default')
-@@ -537,6 +538,8 @@ config_h.set_quoted('NM_CONFIG_DEFAULT_MAIN_AUTH_POLKIT', config_auth_polkit_def
- 
- enable_modify_system = get_option('modify_system')
- 
-+polkit_noauth_group = get_option('polkit_noauth_group')
-+
- polkit_agent_helper_1_path = get_option('polkit_agent_helper_1')
- foreach p : [ '/usr/libexec/polkit-agent-helper-1',
-               '/usr/lib/polkit-1/polkit-agent-helper-1',
-@@ -1098,7 +1101,7 @@ output += '  dbus_conf_dir: ' + dbus_conf_dir + '\n'
- output += '\nPlatform:\n'
- output += '  session tracking: ' + ','.join(session_trackers) + '\n'
- output += '  suspend/resume: ' + suspend_resume + '\n'
--output += '  policykit: ' + enable_polkit.to_string() + ' (default: ' + config_auth_polkit_default + ')'
-+output += '  policykit: ' + enable_polkit.to_string() + ' (default: ' + config_auth_polkit_default + ', noauth_group: "' + polkit_noauth_group + '")'
- if enable_polkit
-   output += ' ('
-   if enable_modify_system
-diff --git a/meson_options.txt b/meson_options.txt
-index d28cc76fc8..631b3037f1 100644
---- a/meson_options.txt
-+++ b/meson_options.txt
-@@ -19,6 +19,7 @@ option('suspend_resume', type: 'combo', choices: ['systemd', 'elogind', 'console
- option('polkit', type: 'boolean', value: true, description: 'User auth-polkit configuration option.')
- option('config_auth_polkit_default', type: 'combo', choices: ['default', 'true', 'false', 'root-only'], value: 'default', description: 'Default value for configuration main.auth-polkit.')
- option('modify_system', type: 'boolean', value: false, description: 'Allow users to modify system connections')
-+option('polkit_noauth_group', type: 'string', value: '', description: 'Allow users of the selected group, typically sudo or wheel, to modify system connections without introducing a password (discouraged)')
- option('polkit_agent_helper_1', type: 'string', value: '', description: 'Path name to the polkit-agent-helper-1 binary from polkit')
- option('selinux', type: 'boolean', value: true, description: 'Build with SELinux')
- option('systemd_journal', type: 'boolean', value: true, description: 'Use systemd journal for logging')
--- 
-2.52.0
-

diff --git a/0002-secret-permission-fixes.patch b/0002-secret-permission-fixes.patch
deleted file mode 100644
index 45986fd..0000000
--- a/0002-secret-permission-fixes.patch
+++ /dev/null
@@ -1,159 +0,0 @@
-From 61b5f9f8f774c21dc677013551519c8d8bc9d543 Mon Sep 17 00:00:00 2001
-From: Beniamino Galvani <bgalvani@redhat.com>
-Date: Mon, 23 Feb 2026 18:09:12 +0100
-Subject: [PATCH 1/3] libnm-core: add missing flags check in
- .to_dbus_function()
-
-Properties that define a .to_dbus_function() as a D-Bus override, need
-to return early if the flags only ask to serialize secrets.
-
-Fixes: 7fb23b0a62a0 ('libnm: add NMIPRoutingRule API')
-(cherry picked from commit eff8330b579c07f1f5338f50a459709727d690cf)
-(cherry picked from commit 11f642168edf188789ed628ae3420f34917549b1)
----
- src/libnm-core-impl/nm-setting-ip-config.c | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/src/libnm-core-impl/nm-setting-ip-config.c b/src/libnm-core-impl/nm-setting-ip-config.c
-index 1aecc20c83..f4ee094ca4 100644
---- a/src/libnm-core-impl/nm-setting-ip-config.c
-+++ b/src/libnm-core-impl/nm-setting-ip-config.c
-@@ -5079,6 +5079,9 @@ routing_rules_to_dbus(_NM_SETT_INFO_PROP_TO_DBUS_FCN_ARGS _nm_nil)
-     gboolean                  any = FALSE;
-     guint                     i;
- 
-+    if (!_nm_connection_serialize_non_secret(flags))
-+        return NULL;
-+
-     priv = NM_SETTING_IP_CONFIG_GET_PRIVATE(self);
- 
-     if (!priv->routing_rules || priv->routing_rules->len == 0)
--- 
-2.52.0
-
-From 66547cfad7514013e973dcb207982b849ccec060 Mon Sep 17 00:00:00 2001
-From: Beniamino Galvani <bgalvani@redhat.com>
-Date: Mon, 23 Feb 2026 17:21:55 +0100
-Subject: [PATCH 2/3] settings: accept not-saved secrets from agents without
- modify-system
-
-The "modify.system" polkit permission allows a user to modify settings
-for connection profiles that belong to all users.
-
-For this reason, when an agent returns system secrets (i.e. secrets
-that are going to be stored to disk), NetworkManager checks that the
-agent has the modify.system permission.
-
-If a secret has the AGENT_OWNED flag, it's stored in the agent
-itself. If the secret has the NOT_SAVED flag, it will be asked to
-users at the beginning of every connection attempt.
-
-In both those cases the profile is not modified and there is no need
-for the modify.system permission. Fix the check to also consider the
-NOT_SAVED flag.
-
-(cherry picked from commit db0825a110b24b755d3dab5df4381959b693ba9e)
-(cherry picked from commit 480ba052f3553b1af6ebbbd8d2995486d5f62270)
----
- src/core/settings/nm-settings-connection.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/src/core/settings/nm-settings-connection.c b/src/core/settings/nm-settings-connection.c
-index d5611e7640..7ed3712b47 100644
---- a/src/core/settings/nm-settings-connection.c
-+++ b/src/core/settings/nm-settings-connection.c
-@@ -781,7 +781,8 @@ validate_secret_flags(NMConnection *connection, GVariant *secrets, ForEachSecret
- static gboolean
- secret_is_system_owned(NMSettingSecretFlags flags, gpointer user_data)
- {
--    return !NM_FLAGS_HAS(flags, NM_SETTING_SECRET_FLAG_AGENT_OWNED);
-+    return !NM_FLAGS_ANY(flags,
-+                         NM_SETTING_SECRET_FLAG_AGENT_OWNED | NM_SETTING_SECRET_FLAG_NOT_SAVED);
- }
- 
- static void
--- 
-2.52.0
-
-From 1ca4b7d7784ae3cd77b9213a9bac240b2a01f3c1 Mon Sep 17 00:00:00 2001
-From: Beniamino Galvani <bgalvani@redhat.com>
-Date: Mon, 23 Feb 2026 17:23:23 +0100
-Subject: [PATCH 3/3] settings: fix check on existing system secrets
-
-The previous check was based only on the presence of a non-NULL
-"existing_secrets" GVariant. That GVariant is created via:
-
-  nm_connection_to_dbus(nm_settings_connection_get_connection(self),
-                        NM_CONNECTION_SERIALIZE_WITH_SECRETS_SYSTEM_OWNED)
-
-The function returns a GVariant containing a first-level dictionary
-for each setting, even for those that doesn't contain any secrets. As
-a result, the check was requiring the system.modify permission even if
-there weren't any cached secrets to send to the agent.
-
-Fix the check to actually check for the presence of any secrets in the
-cached dictionary. Some connection types have a third-level
-dictionary that can be empty, for example VPNs have vpn.secrets.
-
-(cherry picked from commit 024360bffa1d0848f2acb0d4eabefedf1b5f8787)
-(cherry picked from commit 375be1c1b0eb852bbfb897f813f64d86b4211963)
----
- src/core/settings/nm-agent-manager.c | 35 +++++++++++++++++++++++++++-
- 1 file changed, 34 insertions(+), 1 deletion(-)
-
-diff --git a/src/core/settings/nm-agent-manager.c b/src/core/settings/nm-agent-manager.c
-index 19b3cfcbaf..ce7dbab2f0 100644
---- a/src/core/settings/nm-agent-manager.c
-+++ b/src/core/settings/nm-agent-manager.c
-@@ -1083,6 +1083,39 @@ _con_get_request_start_validated(NMAuthChain           *chain,
-     _con_get_request_start_proceed(req, req->con.current_has_modify);
- }
- 
-+static gboolean
-+_req_has_existing_secrets(Request *req)
-+{
-+    GVariantIter iter;
-+    const char  *setting_name;
-+    GVariant    *setting_dict;
-+    gboolean     has;
-+
-+    if (!req->con.get.existing_secrets)
-+        return FALSE;
-+
-+    nm_assert(g_variant_is_of_type(req->con.get.existing_secrets, NM_VARIANT_TYPE_CONNECTION));
-+
-+    g_variant_iter_init(&iter, req->con.get.existing_secrets);
-+    while (g_variant_iter_next(&iter, "{&s@a{sv}}", &setting_name, &setting_dict)) {
-+        GVariantIter setting_iter;
-+        GVariant    *val;
-+
-+        g_variant_iter_init(&setting_iter, setting_dict);
-+        while (g_variant_iter_next(&setting_iter, "{&sv}", NULL, &val)) {
-+            has = !g_variant_is_container(val) || g_variant_n_children(val) > 0;
-+            g_variant_unref(val);
-+            if (has) {
-+                g_variant_unref(setting_dict);
-+                return TRUE;
-+            }
-+        }
-+        g_variant_unref(setting_dict);
-+    }
-+
-+    return FALSE;
-+}
-+
- static void
- _con_get_request_start(Request *req)
- {
-@@ -1103,7 +1136,7 @@ _con_get_request_start(Request *req)
-      * unprivileged users.
-      */
-     if ((req->con.get.flags != NM_SECRET_AGENT_GET_SECRETS_FLAG_NONE)
--        && (req->con.get.existing_secrets
-+        && (_req_has_existing_secrets(req)
-             || _nm_connection_aggregate(req->con.connection,
-                                         NM_CONNECTION_AGGREGATE_ANY_SYSTEM_SECRET_FLAGS,
-                                         NULL))) {
--- 
-2.52.0
-