On Fri, 2022-05-13 at 23:23 +0200, Adrian Freihofer via networkmanager-
list wrote:
> Hi
> Is it somehow possible to disable an interface via NetworkManager?
> I am thinking of something like:
> nmcli connection modify con-eth0 802-3-ethernet.phy disabled
> nmcli connection up con-eth0
> which would basically have the same effect as:
> ip link set eth0 down
> nmcli connection modify con-eth0 802-3-ethernet.phy enabled
> nmcli connection up con-eth0
> which would basically have the same effect as:
> ip link set eth0 up
> The background is a security requirement. Unused interfaces must
> ideally remain disabled at the physical layer when a cable is plugged
> in. Ideally, the LEDs would also remain dark.
> If this function does not exist yet, would it be interesting for
> NetworkManager?
> Could the functionality be implemented with reasonable effort or
> would
> it be difficult to implement?
> Thank you and regards,
> Adrian

no, what you ask for is currently not possible.

NM always likes to set the interface up, because otherwise it wouldn't
get a carrier event (to know whether a cable is plugged in). Doing that
causes other difficulties, like when the device is "disconnected" in
NetworkManager, then NetworkManager needs to set IPv6 addr-gen-mode
"none". Otherwise, kernel would already add an IPv6 address, which is
more than NetworkManager wants. What would be best, if kernel would
allow to enable carrier-detection on an interface, without all the
other things that "IFF_UP" brings.

But what you ask for is very sensible. Just not done yet, and it's also
not entirely clear what do to.

"ethernet.phy no" seems odd to me, because you have to activate a
profile to set it down. Also, most of the other settings of the profile
would be meaningless with "phy no".

What you already can do, is `nmcli device set $IFNAME managed no`. I
think that is the way. The only problem with this is, that
NetworkManager will give up the interface and leave it to the user an a
not well-defined state. What would even be the right state? If the
device is currently connected, I partly think that NM should just leave
everything up (including all IP addresses). The advantage of that would
be, that setting a device unmanaged does not disconnect you right away.
On the other hand, if the device is currently disconnected and you set
it unmanaged, then I think the addr-gen-mode will stay at "none". That
is confusing to the user, because IPv6 does not work without
modification. Or should NM always deconfigure it? Maybe it is indeed
the latter, and then NM should also set the interface down.

Patch welcome, but maybe first discuss what it should do in detail :)
Thank you.


networkmanager-list mailing list

Reply via email to