From b3f192e2164e1e65a82b9fa3fc681d7eabfc3210 Mon Sep 17 00:00:00 2001
From: Dan Williams <dcbw@redhat.com>
Date: Tue, 17 Feb 2009 10:43:53 -0500
Subject: [PATCH] dbus: final dbus policy fixes (bgo #563730)

Keep explicit denials, consolidate stuff, ensure that when denying
send_interface it's almost always matched with send_destination.
---
 callouts/nm-avahi-autoipd.conf              | 3 +--
 callouts/nm-dhcp-client.conf                | 3 +--
 callouts/nm-dispatcher.conf                 | 4 ++--
 src/NetworkManager.conf                     | 6 +++---
 system-settings/src/nm-system-settings.conf | 6 ++----
 5 files changed, 9 insertions(+), 13 deletions(-)

diff --git a/callouts/nm-avahi-autoipd.conf b/callouts/nm-avahi-autoipd.conf
index 97d9ff5397..485ab42929 100644
--- a/callouts/nm-avahi-autoipd.conf
+++ b/callouts/nm-avahi-autoipd.conf
@@ -4,11 +4,10 @@
 <busconfig>
         <policy user="root">
                 <allow own="org.freedesktop.nm_avahi_autoipd"/>
-                <allow send_interface="org.freedesktop.nm_avahi_autoipd"/>
         </policy>
         <policy context="default">
                 <deny own="org.freedesktop.nm_avahi_autoipd"/>
-                <deny send_interface="org.freedesktop.nm_avahi_autoipd"/>
+                <deny send_destination="org.freedesktop.nm_avahi_autoipd"/>
         </policy>
 </busconfig>
 
diff --git a/callouts/nm-dhcp-client.conf b/callouts/nm-dhcp-client.conf
index 515a1106c6..0aeae6032c 100644
--- a/callouts/nm-dhcp-client.conf
+++ b/callouts/nm-dhcp-client.conf
@@ -4,11 +4,10 @@
 <busconfig>
         <policy user="root">
                 <allow own="org.freedesktop.nm_dhcp_client"/>
-		<allow send_interface="org.freedesktop.nm_dhcp_client"/>
         </policy>
         <policy context="default">
                 <deny own="org.freedesktop.nm_dhcp_client"/>
-		<deny send_interface="org.freedesktop.nm_dhcp_client"/>
+		<deny send_destination="org.freedesktop.nm_dhcp_client"/>
         </policy>
 </busconfig>
 
diff --git a/callouts/nm-dispatcher.conf b/callouts/nm-dispatcher.conf
index 32833a73cd..fd2f0e5a42 100644
--- a/callouts/nm-dispatcher.conf
+++ b/callouts/nm-dispatcher.conf
@@ -4,11 +4,11 @@
 <busconfig>
 	<policy user="root">
 		<allow own="org.freedesktop.nm_dispatcher"/>
-		<allow send_interface="org.freedesktop.nm_dispatcher"/>
+		<allow send_destination="org.freedesktop.nm_dispatcher"/>
     </policy>
     <policy context="default">
 		<deny own="org.freedesktop.nm_dispatcher"/>
-		<deny send_interface="org.freedesktop.nm_dispatcher"/>
+		<deny send_destination="org.freedesktop.nm_dispatcher"/>
     </policy>
 </busconfig>
 
diff --git a/src/NetworkManager.conf b/src/NetworkManager.conf
index 0d1e0377a6..bb1c771135 100644
--- a/src/NetworkManager.conf
+++ b/src/NetworkManager.conf
@@ -5,19 +5,19 @@
         <policy user="root">
                 <allow own="org.freedesktop.NetworkManager"/>
                 <allow send_destination="org.freedesktop.NetworkManager"/>
-                <allow send_interface="org.freedesktop.NetworkManager"/>
 
                 <allow send_destination="org.freedesktop.NetworkManager"
                        send_interface="org.freedesktop.NetworkManager.PPP"/>
         </policy>
         <policy at_console="true">
                 <allow send_destination="org.freedesktop.NetworkManager"/>
-                <allow send_interface="org.freedesktop.NetworkManager"/>
+
+                <deny send_destination="org.freedesktop.NetworkManager"
+                      send_interface="org.freedesktop.NetworkManager.PPP"/>
         </policy>
         <policy context="default">
                 <deny own="org.freedesktop.NetworkManager"/>
                 <deny send_destination="org.freedesktop.NetworkManager"/>
-                <deny send_interface="org.freedesktop.NetworkManager"/>
 
                 <deny send_destination="org.freedesktop.NetworkManager"
                       send_interface="org.freedesktop.NetworkManager.PPP"/>
diff --git a/system-settings/src/nm-system-settings.conf b/system-settings/src/nm-system-settings.conf
index 10184baede..ab239ce535 100644
--- a/system-settings/src/nm-system-settings.conf
+++ b/system-settings/src/nm-system-settings.conf
@@ -6,17 +6,15 @@
 		<allow own="org.freedesktop.NetworkManagerSystemSettings"/>
 
 		<allow send_destination="org.freedesktop.NetworkManagerSystemSettings"/>
-		<allow send_interface="org.freedesktop.NetworkManagerSettings"/>
-		<allow send_interface="org.freedesktop.NetworkManagerSettings.Secrets"/>
 	</policy>
 	<policy context="default">
 		<deny own="org.freedesktop.NetworkManagerSystemSettings"/>
 
 		<allow send_destination="org.freedesktop.NetworkManagerSystemSettings"/>
-		<allow send_interface="org.freedesktop.NetworkManagerSettings"/>
 
 		<!-- Only root can get secrets -->
-		<deny send_interface="org.freedesktop.NetworkManagerSettings.Secrets"/>
+		<deny send_destination="org.freedesktop.NetworkManagerSystemSettings"
+		      send_interface="org.freedesktop.NetworkManagerSettings.Secrets"/>
 	</policy>
 
         <limit name="max_replies_per_connection">512</limit>