From 770548ac04f8b9734c95ad6f700c84ccd348fddb Mon Sep 17 00:00:00 2001
From: Dan Williams <dcbw@redhat.com>
Date: Fri, 19 Aug 2011 16:55:16 -0500
Subject: [PATCH] dbus: ensure NM can talk to newly installed VPN plugins (fdo
 #39463)

When new services are installed and the daemon reloads bus policy
(like when installing new VPN plugins with rpm or dpkg) it appears
the rules don't get loaded into NetworkManager's policy space.
Thus any D-Bus message NM sends to the newly installed VPN plugin
gets denied until a restart of NM or the machine.  Work around
this dbus bug by letting NM talk to all known VPN services in the
NM policy file which will always exist when NM is around.
---
 src/NetworkManager.conf | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/src/NetworkManager.conf b/src/NetworkManager.conf
index b256a444e4..15b11b7e1c 100644
--- a/src/NetworkManager.conf
+++ b/src/NetworkManager.conf
@@ -10,6 +10,19 @@
                        send_interface="org.freedesktop.NetworkManager.PPP"/>
 
                 <allow send_interface="org.freedesktop.NetworkManager.SecretAgent"/>
+
+                <!-- Allow NM to talk to known VPN plugins; due to a bug in
+                     the D-Bus daemon, when a plugin is installed and the user
+                     immediately tries to use it, the VPN plugin's rules aren't
+                     always loaded into dbus-daemon.  Those rules allow NM to
+                     talk to the plugin.  Oops.  Work around that by explicitly
+                     allowing NM to talk to VPN plugins here.
+                  -->
+                <allow send_destination="org.freedesktop.NetworkManager.openconnect"/>
+                <allow send_destination="org.freedesktop.NetworkManager.openswan"/>
+                <allow send_destination="org.freedesktop.NetworkManager.openvpn"/>
+                <allow send_destination="org.freedesktop.NetworkManager.pptp"/>
+                <allow send_destination="org.freedesktop.NetworkManager.vpnc"/>
         </policy>
         <policy at_console="true">
                 <allow send_destination="org.freedesktop.NetworkManager"/>