Add sidecar process for performing privileged operations#36
Merged
Conversation
ethanjli
changed the title
github-merge-queue bot
pushed a commit
to openUC2/os-rpi
that referenced
this pull request
Mar 19, 2026
This PR integrates openUC2/device-admin#36 . This work is tracked on Notion at https://www.notion.so/device-admin-can-t-trigger-a-reload-of-NetworkManager-connection-profiles-3134e612c78a8098a2b6cfbeb609505b?source=copy_link
github-merge-queue bot
pushed a commit
to openUC2/device-portal
that referenced
this pull request
Mar 19, 2026
This PR replicates some refactoring done in openUC2/device-admin#36 .
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
When device-admin is run as the unprivileged
piuser (instead of therootuser) so that it can mount USB drives withpiuser permissions (instead ofrootuser permissions), then the advanced connection profile editor can’t make NetworkManager reload connection profiles (because that operation requiresrootpermissions and has no available PolicyKit workaround). This PR adds a separate operating mode fordevice-admin(as a sidecar process) which is meant to be run as therootuser and expose a varlink IPC interface for the unprivileged device-admin web server to trigger privileged operations.This work is tracked on Notion at https://www.notion.so/device-admin-can-t-trigger-a-reload-of-NetworkManager-connection-profiles-3134e612c78a8098a2b6cfbeb609505b?source=copy_link and https://www.notion.so/TASK-FR014-Bug-ImSwitch-is-unable-to-shut-down-the-RPi-30a4e612c78a808db81efe5f053fcc93?source=copy_link