David Herrmann
99da30059f
By using:
<deny send_destination="org.freedesktop.ModemManager1"/>
..we prevent anyone on the system from sending us signals, even if we
subscribed to them. This is clearly not what this line intended. More
importantly, we silently break mm-auth-provider-polkit, as we never
receiver 'changed' signals via PolkitAuthority. Right now, this is not
required by the implementation of PolkitAuthority, but ModemManager
should not place restrictions on the implementation of external
libraries.
So make sure we only prevent Method-Calls to be sent to us. Any other
message that we didn't expect is automatically discarded by gdbus,
anyway.
Without this change, debugging dbus policies constantly shows messages
that Polkit couldn't send the 'changed' signal to ModemManager. This is
suppressed in non-debugging mode. But it would make debugging a lot
easier, if we'd avoid force-dropping those events and not clutter the
debug-log.
210 lines
8.1 KiB
Plaintext
210 lines
8.1 KiB
Plaintext
<!DOCTYPE busconfig PUBLIC
|
|
"-//freedesktop//DTD D-BUS Bus Configuration 1.0//EN"
|
|
"http://www.freedesktop.org/standards/dbus/1.0/busconfig.dtd">
|
|
<busconfig>
|
|
<policy context="default">
|
|
<deny send_destination="org.freedesktop.ModemManager1"
|
|
send_type="method_call"/>
|
|
|
|
<!-- Methods listed here are explicitly allowed or PolicyKit protected.
|
|
The rest are restricted to root for security.
|
|
-->
|
|
|
|
<!-- org.freedesktop.ModemManager1.xml -->
|
|
|
|
<!-- Allowed for everyone -->
|
|
<allow send_destination="org.freedesktop.ModemManager1"
|
|
send_interface="org.freedesktop.DBus.Introspectable"/>
|
|
|
|
<allow send_destination="org.freedesktop.ModemManager1"
|
|
send_interface="org.freedesktop.DBus.Properties"/>
|
|
|
|
<allow send_destination="org.freedesktop.ModemManager1"
|
|
send_interface="org.freedesktop.DBus.ObjectManager"/>
|
|
|
|
<!-- Protected by the Control policy rule -->
|
|
<allow send_destination="org.freedesktop.ModemManager1"
|
|
send_interface="org.freedesktop.ModemManager1"
|
|
send_member="ScanDevices"/>
|
|
|
|
<allow send_destination="org.freedesktop.ModemManager1"
|
|
send_interface="org.freedesktop.ModemManager1"
|
|
send_member="SetLogging"/>
|
|
|
|
<!-- org.freedesktop.ModemManager1.Modem.xml -->
|
|
|
|
<!-- Allowed for everyone -->
|
|
<allow send_destination="org.freedesktop.ModemManager1"
|
|
send_interface="org.freedesktop.ModemManager1.Modem"
|
|
send_member="ListBearers"/>
|
|
|
|
<!-- Protected by the Device.Control policy rule -->
|
|
<allow send_destination="org.freedesktop.ModemManager1"
|
|
send_interface="org.freedesktop.ModemManager1.Modem"
|
|
send_member="Enable"/>
|
|
|
|
<allow send_destination="org.freedesktop.ModemManager1"
|
|
send_interface="org.freedesktop.ModemManager1.Modem"
|
|
send_member="CreateBearer"/>
|
|
|
|
<allow send_destination="org.freedesktop.ModemManager1"
|
|
send_interface="org.freedesktop.ModemManager1.Modem"
|
|
send_member="DeleteBearer"/>
|
|
|
|
<allow send_destination="org.freedesktop.ModemManager1"
|
|
send_interface="org.freedesktop.ModemManager1.Modem"
|
|
send_member="Reset"/>
|
|
|
|
<allow send_destination="org.freedesktop.ModemManager1"
|
|
send_interface="org.freedesktop.ModemManager1.Modem"
|
|
send_member="FactoryReset"/>
|
|
|
|
<allow send_destination="org.freedesktop.ModemManager1"
|
|
send_interface="org.freedesktop.ModemManager1.Modem"
|
|
send_member="SetAllowedModes"/>
|
|
|
|
<allow send_destination="org.freedesktop.ModemManager1"
|
|
send_interface="org.freedesktop.ModemManager1.Modem"
|
|
send_member="SetBands"/>
|
|
|
|
<allow send_destination="org.freedesktop.ModemManager1"
|
|
send_interface="org.freedesktop.ModemManager1.Modem"
|
|
send_member="Command"/>
|
|
|
|
<!-- org.freedesktop.ModemManager1.Modem.Simple.xml -->
|
|
|
|
<!-- Allowed for everyone -->
|
|
<allow send_destination="org.freedesktop.ModemManager1"
|
|
send_interface="org.freedesktop.ModemManager1.Modem.Simple"
|
|
send_member="GetStatus"/>
|
|
|
|
<!-- Protected by the Device.Control policy rule -->
|
|
<allow send_destination="org.freedesktop.ModemManager1"
|
|
send_interface="org.freedesktop.ModemManager1.Modem.Simple"
|
|
send_member="Connect"/>
|
|
|
|
<allow send_destination="org.freedesktop.ModemManager1"
|
|
send_interface="org.freedesktop.ModemManager1.Modem.Simple"
|
|
send_member="Disconnect"/>
|
|
|
|
<!-- org.freedesktop.ModemManager1.Modem.Modem3gpp.xml -->
|
|
|
|
<!-- Protected by the Device.Control policy rule -->
|
|
<allow send_destination="org.freedesktop.ModemManager1"
|
|
send_interface="org.freedesktop.ModemManager1.Modem.Modem3gpp"
|
|
send_member="Register"/>
|
|
|
|
<allow send_destination="org.freedesktop.ModemManager1"
|
|
send_interface="org.freedesktop.ModemManager1.Modem.Modem3gpp"
|
|
send_member="Scan"/>
|
|
|
|
<!-- org.freedesktop.ModemManager1.Modem.ModemCdma.xml -->
|
|
|
|
<!-- Protected by the Device.Control policy rule -->
|
|
<allow send_destination="org.freedesktop.ModemManager1"
|
|
send_interface="org.freedesktop.ModemManager1.Modem.ModemCdma"
|
|
send_member="Activate"/>
|
|
|
|
<allow send_destination="org.freedesktop.ModemManager1"
|
|
send_interface="org.freedesktop.ModemManager1.Modem.ModemCdma"
|
|
send_member="ActivateManual"/>
|
|
|
|
<!-- org.freedesktop.ModemManager1.Sim.xml -->
|
|
|
|
<!-- Protected by the Device.Control policy rule -->
|
|
<allow send_destination="org.freedesktop.ModemManager1"
|
|
send_interface="org.freedesktop.ModemManager1.Sim"
|
|
send_member="SendPin"/>
|
|
|
|
<allow send_destination="org.freedesktop.ModemManager1"
|
|
send_interface="org.freedesktop.ModemManager1.Sim"
|
|
send_member="SendPuk"/>
|
|
|
|
<allow send_destination="org.freedesktop.ModemManager1"
|
|
send_interface="org.freedesktop.ModemManager1.Sim"
|
|
send_member="EnablePin"/>
|
|
|
|
<allow send_destination="org.freedesktop.ModemManager1"
|
|
send_interface="org.freedesktop.ModemManager1.Sim"
|
|
send_member="ChangePin"/>
|
|
|
|
<!-- org.freedesktop.ModemManager1.Bearer.xml -->
|
|
|
|
<!-- Protected by the Device.Control policy rule -->
|
|
<allow send_destination="org.freedesktop.ModemManager1"
|
|
send_interface="org.freedesktop.ModemManager1.Bearer"
|
|
send_member="Connect"/>
|
|
|
|
<allow send_destination="org.freedesktop.ModemManager1"
|
|
send_interface="org.freedesktop.ModemManager1.Bearer"
|
|
send_member="Disconnect"/>
|
|
|
|
<!-- org.freedesktop.ModemManager1.Modem.Modem3gpp.Ussd.xml -->
|
|
|
|
<!-- Protected by the USSD policy rule -->
|
|
<allow send_destination="org.freedesktop.ModemManager1"
|
|
send_interface="org.freedesktop.ModemManager1.Modem.Modem3gpp.Ussd"
|
|
send_member="Initiate"/>
|
|
|
|
<allow send_destination="org.freedesktop.ModemManager1"
|
|
send_interface="org.freedesktop.ModemManager1.Modem.Modem3gpp.Ussd"
|
|
send_member="Respond"/>
|
|
|
|
<allow send_destination="org.freedesktop.ModemManager1"
|
|
send_interface="org.freedesktop.ModemManager1.Modem.Modem3gpp.Ussd"
|
|
send_member="Cancel"/>
|
|
|
|
<!-- org.freedesktop.ModemManager1.Modem.Location.xml -->
|
|
|
|
<!-- Protected by the Device.Control policy rule -->
|
|
<allow send_destination="org.freedesktop.ModemManager1"
|
|
send_interface="org.freedesktop.ModemManager1.Modem.Location"
|
|
send_member="Setup"/>
|
|
|
|
<!-- Protected by the Location policy rule -->
|
|
<allow send_destination="org.freedesktop.ModemManager1"
|
|
send_interface="org.freedesktop.ModemManager1.Modem.Location"
|
|
send_member="GetLocation"/>
|
|
|
|
<!-- org.freedesktop.ModemManager1.Modem.Messaging.xml -->
|
|
|
|
<!-- Allowed for everyone -->
|
|
<allow send_destination="org.freedesktop.ModemManager1"
|
|
send_interface="org.freedesktop.ModemManager1.Modem.Messaging"
|
|
send_member="List"/>
|
|
|
|
<!-- Protected by the Messaging policy rule -->
|
|
<allow send_destination="org.freedesktop.ModemManager1"
|
|
send_interface="org.freedesktop.ModemManager1.Modem.Messaging"
|
|
send_member="Create"/>
|
|
|
|
<allow send_destination="org.freedesktop.ModemManager1"
|
|
send_interface="org.freedesktop.ModemManager1.Modem.Messaging"
|
|
send_member="Delete"/>
|
|
|
|
<!-- org.freedesktop.ModemManager1.Sms.xml -->
|
|
|
|
<!-- Protected by the Messaging policy rule -->
|
|
<allow send_destination="org.freedesktop.ModemManager1"
|
|
send_interface="org.freedesktop.ModemManager1.Sms"
|
|
send_member="Store"/>
|
|
|
|
<allow send_destination="org.freedesktop.ModemManager1"
|
|
send_interface="org.freedesktop.ModemManager1.Sms"
|
|
send_member="Send"/>
|
|
|
|
<!-- org.freedesktop.ModemManager1.Modem.Signal.xml -->
|
|
|
|
<!-- Allowed for everyone -->
|
|
<allow send_destination="org.freedesktop.ModemManager1"
|
|
send_interface="org.freedesktop.ModemManager1.Modem.Signal"
|
|
send_member="Setup"/>
|
|
|
|
</policy>
|
|
|
|
<policy user="root">
|
|
<allow own="org.freedesktop.ModemManager1"/>
|
|
<allow send_destination="org.freedesktop.ModemManager1"/>
|
|
</policy>
|
|
</busconfig>
|