diff --git a/clients/cli/general.c b/clients/cli/general.c
index 0704688ff5..04c51c4849 100644
--- a/clients/cli/general.c
+++ b/clients/cli/general.c
@@ -398,6 +398,7 @@ show_nm_status (NmCli *nmc, const char *pretty_header_name, const char *print_fl
 #define NM_AUTH_PERMISSION_SETTINGS_MODIFY_SYSTEM     "org.freedesktop.NetworkManager.settings.modify.system"
 #define NM_AUTH_PERMISSION_SETTINGS_MODIFY_OWN        "org.freedesktop.NetworkManager.settings.modify.own"
 #define NM_AUTH_PERMISSION_SETTINGS_MODIFY_HOSTNAME   "org.freedesktop.NetworkManager.settings.modify.hostname"
+#define NM_AUTH_PERMISSION_SETTINGS_MODIFY_GLOBAL_DNS "org.freedesktop.NetworkManager.settings.modify.global-dns"
 
 static const char *
 permission_to_string (NMClientPermission perm)
@@ -425,6 +426,8 @@ permission_to_string (NMClientPermission perm)
 		return NM_AUTH_PERMISSION_SETTINGS_MODIFY_OWN;
 	case NM_CLIENT_PERMISSION_SETTINGS_MODIFY_HOSTNAME:
 		return NM_AUTH_PERMISSION_SETTINGS_MODIFY_HOSTNAME;
+	case NM_CLIENT_PERMISSION_SETTINGS_MODIFY_GLOBAL_DNS:
+		return NM_AUTH_PERMISSION_SETTINGS_MODIFY_GLOBAL_DNS;
 	default:
 		return _("unknown");
 	}
@@ -433,7 +436,6 @@ permission_to_string (NMClientPermission perm)
 static const char *
 permission_result_to_string (NMClientPermissionResult perm_result)
 {
-	
 	switch (perm_result) {
 	case NM_CLIENT_PERMISSION_RESULT_YES:
 		return _("yes");
diff --git a/libnm-glib/nm-client.c b/libnm-glib/nm-client.c
index 20112d69c1..68fb24fe17 100644
--- a/libnm-glib/nm-client.c
+++ b/libnm-glib/nm-client.c
@@ -219,6 +219,7 @@ register_properties (NMClient *client)
 #define NM_AUTH_PERMISSION_SETTINGS_MODIFY_SYSTEM     "org.freedesktop.NetworkManager.settings.modify.system"
 #define NM_AUTH_PERMISSION_SETTINGS_MODIFY_OWN        "org.freedesktop.NetworkManager.settings.modify.own"
 #define NM_AUTH_PERMISSION_SETTINGS_MODIFY_HOSTNAME   "org.freedesktop.NetworkManager.settings.modify.hostname"
+#define NM_AUTH_PERMISSION_SETTINGS_MODIFY_GLOBAL_DNS "org.freedesktop.NetworkManager.settings.modify.global-dns"
 
 static NMClientPermission
 nm_permission_to_client (const char *nm)
@@ -245,6 +246,8 @@ nm_permission_to_client (const char *nm)
 		return NM_CLIENT_PERMISSION_SETTINGS_MODIFY_OWN;
 	else if (!strcmp (nm, NM_AUTH_PERMISSION_SETTINGS_MODIFY_HOSTNAME))
 		return NM_CLIENT_PERMISSION_SETTINGS_MODIFY_HOSTNAME;
+	else if (!strcmp (nm, NM_AUTH_PERMISSION_SETTINGS_MODIFY_GLOBAL_DNS))
+		return NM_CLIENT_PERMISSION_SETTINGS_MODIFY_GLOBAL_DNS;
 
 	return NM_CLIENT_PERMISSION_NONE;
 }
diff --git a/libnm-glib/nm-client.h b/libnm-glib/nm-client.h
index 39af321ebe..8ab5f69389 100644
--- a/libnm-glib/nm-client.h
+++ b/libnm-glib/nm-client.h
@@ -84,6 +84,8 @@ G_BEGIN_DECLS
  *  owned by the current user can be modified
  * @NM_CLIENT_PERMISSION_SETTINGS_MODIFY_HOSTNAME: controls whether the
  *  persistent hostname can be changed
+ * @NM_CLIENT_PERMISSION_SETTINGS_MODIFY_GLOBAL_DNS: modify persistent global
+ *  DNS configuration
  * @NM_CLIENT_PERMISSION_LAST: a reserved boundary value
  *
  * #NMClientPermission values indicate various permissions that NetworkManager
@@ -102,8 +104,9 @@ typedef enum {
 	NM_CLIENT_PERMISSION_SETTINGS_MODIFY_SYSTEM = 9,
 	NM_CLIENT_PERMISSION_SETTINGS_MODIFY_OWN = 10,
 	NM_CLIENT_PERMISSION_SETTINGS_MODIFY_HOSTNAME = 11,
+	NM_CLIENT_PERMISSION_SETTINGS_MODIFY_GLOBAL_DNS = 12,
 
-	NM_CLIENT_PERMISSION_LAST = NM_CLIENT_PERMISSION_SETTINGS_MODIFY_HOSTNAME
+	NM_CLIENT_PERMISSION_LAST = 12,
 } NMClientPermission;
 
 /**
diff --git a/libnm/nm-client.h b/libnm/nm-client.h
index 66ec9ea5bb..bdd7c46310 100644
--- a/libnm/nm-client.h
+++ b/libnm/nm-client.h
@@ -92,6 +92,8 @@ G_BEGIN_DECLS
  *  owned by the current user can be modified
  * @NM_CLIENT_PERMISSION_SETTINGS_MODIFY_HOSTNAME: controls whether the
  *  persistent hostname can be changed
+ * @NM_CLIENT_PERMISSION_SETTINGS_MODIFY_GLOBAL_DNS: modify persistent global
+ *  DNS configuration
  * @NM_CLIENT_PERMISSION_LAST: a reserved boundary value
  *
  * #NMClientPermission values indicate various permissions that NetworkManager
@@ -110,8 +112,9 @@ typedef enum {
 	NM_CLIENT_PERMISSION_SETTINGS_MODIFY_SYSTEM = 9,
 	NM_CLIENT_PERMISSION_SETTINGS_MODIFY_OWN = 10,
 	NM_CLIENT_PERMISSION_SETTINGS_MODIFY_HOSTNAME = 11,
+	NM_CLIENT_PERMISSION_SETTINGS_MODIFY_GLOBAL_DNS = 12,
 
-	NM_CLIENT_PERMISSION_LAST = NM_CLIENT_PERMISSION_SETTINGS_MODIFY_HOSTNAME
+	NM_CLIENT_PERMISSION_LAST = 12,
 } NMClientPermission;
 
 /**
diff --git a/libnm/nm-manager.c b/libnm/nm-manager.c
index a6c1f3f954..66755e1394 100644
--- a/libnm/nm-manager.c
+++ b/libnm/nm-manager.c
@@ -213,6 +213,7 @@ init_dbus (NMObject *object)
 #define NM_AUTH_PERMISSION_SETTINGS_MODIFY_SYSTEM     "org.freedesktop.NetworkManager.settings.modify.system"
 #define NM_AUTH_PERMISSION_SETTINGS_MODIFY_OWN        "org.freedesktop.NetworkManager.settings.modify.own"
 #define NM_AUTH_PERMISSION_SETTINGS_MODIFY_HOSTNAME   "org.freedesktop.NetworkManager.settings.modify.hostname"
+#define NM_AUTH_PERMISSION_SETTINGS_MODIFY_GLOBAL_DNS "org.freedesktop.NetworkManager.settings.modify.global-dns"
 
 static NMClientPermission
 nm_permission_to_client (const char *nm)
@@ -239,6 +240,8 @@ nm_permission_to_client (const char *nm)
 		return NM_CLIENT_PERMISSION_SETTINGS_MODIFY_OWN;
 	else if (!strcmp (nm, NM_AUTH_PERMISSION_SETTINGS_MODIFY_HOSTNAME))
 		return NM_CLIENT_PERMISSION_SETTINGS_MODIFY_HOSTNAME;
+	else if (!strcmp (nm, NM_AUTH_PERMISSION_SETTINGS_MODIFY_GLOBAL_DNS))
+		return NM_CLIENT_PERMISSION_SETTINGS_MODIFY_GLOBAL_DNS;
 
 	return NM_CLIENT_PERMISSION_NONE;
 }
diff --git a/tools/test-networkmanager-service.py b/tools/test-networkmanager-service.py
index 4f81500a79..f2e1553bd3 100755
--- a/tools/test-networkmanager-service.py
+++ b/tools/test-networkmanager-service.py
@@ -783,7 +783,9 @@ class NetworkManager(ExportedObj):
                  "org.freedesktop.NetworkManager.wifi.share.open":          "yes",
                  "org.freedesktop.NetworkManager.settings.modify.own":      "yes",
                  "org.freedesktop.NetworkManager.settings.modify.system":   "yes",
-                 "org.freedesktop.NetworkManager.settings.modify.hostname": "yes" }
+                 "org.freedesktop.NetworkManager.settings.modify.hostname": "yes",
+                 "org.freedesktop.NetworkManager.settings.modify.global-dns": "no",
+                 }
 
     @dbus.service.method(dbus_interface=IFACE_NM, in_signature='ss', out_signature='')
     def SetLogging(self, level, domains):