Network Manager refactor

files/dracut/95dot1x-macsec/nm-unmanaged.sh

@@ -0,0 +1,37 @@
+#!/bin/bash
+# nm-unmanaged.sh — dracut cmdline-stage hook (runs BEFORE NetworkManager starts).
+#
+# In the SECURE path (802.1X/MACsec), wpa_supplicant owns the physical NIC: it
+# runs EAPOL and the MACsec key agreement (MKA) on it, and that link carries the
+# root filesystem. NetworkManager must NOT touch that NIC — a competing NM
+# supplicant would drop MKA and kill netroot. So drop an NM config that marks the
+# physical NIC unmanaged. IP is carried by macsec0, which is left MANAGED so NM
+# does DHCP *and renews the lease* on it.
+#
+# In the TEST path (rd.dot1x=0) there is no macsec0; IP rides on the physical NIC
+# directly and we WANT NM to manage+renew it — so write nothing.
+#
+# Why /run (not /etc) and why the cmdline stage: /run/NetworkManager/conf.d is
+# read by NM and the tmpfs survives switch-root, so the same rule applies in both
+# the initramfs and the real root. Writing here at the cmdline stage guarantees
+# the file exists before NM is started, so NM never transiently manages the EAPOL
+# NIC. This replaces the old static /etc/.../99-dot1x-unmanaged.conf, which could
+# not be mode-aware (it wrongly unmanaged en* in test mode too, blocking renewal).
+
+type getarg >/dev/null 2>&1 || . /lib/dracut-lib.sh
+
+# Test mode: leave the boot NIC managed so NM renews its lease.
+[ "$(getarg rd.dot1x=)" = "0" ] && return 0
+
+_dir=/run/NetworkManager/conf.d
+_conf="$_dir/10-dot1x-unmanaged.conf"
+[ -e "$_conf" ] && return 0          # idempotent (cmdline hooks may re-run)
+
+mkdir -p "$_dir"
+# interface-name:en* matches the predictable physical NIC names (eno/ens/enp);
+# macsec0 is deliberately NOT listed, so NM manages it for DHCP/renewal.
+{
+    echo "[keyfile]"
+    echo "unmanaged-devices=interface-name:en*"
+} > "$_conf"
+info "dot1x-macsec: NM unmanaged drop-in written ($_conf) — physical NIC reserved for wpa_supplicant"