rpm-ostree/src/daemon/org.projectatomic.rpmostree1.conf

<?xml version="1.0" encoding="UTF-8"?> <!-- -*- XML -*- -->

<!DOCTYPE busconfig PUBLIC
  "-//freedesktop//DTD D-BUS Bus Configuration 1.0//EN"
  "http://www.freedesktop.org/standards/dbus/1.0/busconfig.dtd">
<busconfig>
  <!-- Only root can own the service -->
  <policy user="root">
    <allow own="org.projectatomic.rpmostree1"/>
    <allow send_destination="org.projectatomic.rpmostree1"/>
  </policy>

  <!-- Allow anyone to call into the service - we'll reject callers using PolicyKit -->
  <policy context="default">
    <deny send_destination="org.projectatomic.rpmostree1"/>

    <allow send_destination="org.projectatomic.rpmostree1"
           send_interface="org.freedesktop.DBus.Introspectable"/>

    <allow send_destination="org.projectatomic.rpmostree1"
           send_interface="org.freedesktop.DBus.ObjectManager"/>

    <allow send_destination="org.projectatomic.rpmostree1"
           send_interface="org.freedesktop.DBus.Peer"/>

    <allow send_destination="org.projectatomic.rpmostree1"
           send_interface="org.freedesktop.DBus.Properties"
           send_member="Get"/>

    <allow send_destination="org.projectatomic.rpmostree1"
           send_interface="org.freedesktop.DBus.Properties"
           send_member="GetAll"/>

    <allow send_destination="org.projectatomic.rpmostree1"
           send_interface="org.projectatomic.rpmostree1.OS"/>

    <allow send_destination="org.projectatomic.rpmostree1"
           send_interface="org.projectatomic.rpmostree1.Sysroot"/>
  </policy>
</busconfig>
daemon: Start of work on daemon 2015-04-28 04:22:58 +03:00			`<?xml version="1.0" encoding="UTF-8"?> <!-- -- XML -- -->`

			`<!DOCTYPE busconfig PUBLIC`
			`"-//freedesktop//DTD D-BUS Bus Configuration 1.0//EN"`
			`"http://www.freedesktop.org/standards/dbus/1.0/busconfig.dtd">`
			`<busconfig>`
daemon: Update D-Bus security policy Poke some holes in the policy so normal users can introspect paths, peek at properties, and run "rpm-ostree status". 2016-01-12 19:50:55 +03:00			`<!-- Only root can own the service -->`
daemon: Start of work on daemon 2015-04-28 04:22:58 +03:00			`<policy user="root">`
			`<allow own="org.projectatomic.rpmostree1"/>`
daemon: Simplify authorization policy The current policy is to only allow the root user access to the Sysroot and OS interfaces, but this can be expressed in the static bus config. The long-term intention is to integrate with PolicyKit. Leave comments in the code stating so but remove the unnecessary authorization handler for the time being, just so there's less code to review. 2015-08-24 17:57:30 +03:00			`<allow send_destination="org.projectatomic.rpmostree1"/>`
daemon: Start of work on daemon 2015-04-28 04:22:58 +03:00			`</policy>`

Add polkit support This allows non-root users access to the rpm-ostree daemon, which is a pre-requirement for gnome-software rpm-ostree support. Closes: #745 Closes: #825 Approved by: cgwalters 2017-06-09 13:52:01 +03:00			`<!-- Allow anyone to call into the service - we'll reject callers using PolicyKit -->`
daemon: Start of work on daemon 2015-04-28 04:22:58 +03:00			`<policy context="default">`
daemon: Simplify authorization policy The current policy is to only allow the root user access to the Sysroot and OS interfaces, but this can be expressed in the static bus config. The long-term intention is to integrate with PolicyKit. Leave comments in the code stating so but remove the unnecessary authorization handler for the time being, just so there's less code to review. 2015-08-24 17:57:30 +03:00			`<deny send_destination="org.projectatomic.rpmostree1"/>`
daemon: Update D-Bus security policy Poke some holes in the policy so normal users can introspect paths, peek at properties, and run "rpm-ostree status". 2016-01-12 19:50:55 +03:00
			`<allow send_destination="org.projectatomic.rpmostree1"`
			`send_interface="org.freedesktop.DBus.Introspectable"/>`

Add polkit support This allows non-root users access to the rpm-ostree daemon, which is a pre-requirement for gnome-software rpm-ostree support. Closes: #745 Closes: #825 Approved by: cgwalters 2017-06-09 13:52:01 +03:00			`<allow send_destination="org.projectatomic.rpmostree1"`
			`send_interface="org.freedesktop.DBus.ObjectManager"/>`

daemon: Update D-Bus security policy Poke some holes in the policy so normal users can introspect paths, peek at properties, and run "rpm-ostree status". 2016-01-12 19:50:55 +03:00			`<allow send_destination="org.projectatomic.rpmostree1"`
			`send_interface="org.freedesktop.DBus.Peer"/>`

			`<allow send_destination="org.projectatomic.rpmostree1"`
			`send_interface="org.freedesktop.DBus.Properties"`
			`send_member="Get"/>`

			`<allow send_destination="org.projectatomic.rpmostree1"`
			`send_interface="org.freedesktop.DBus.Properties"`
			`send_member="GetAll"/>`

Add polkit support This allows non-root users access to the rpm-ostree daemon, which is a pre-requirement for gnome-software rpm-ostree support. Closes: #745 Closes: #825 Approved by: cgwalters 2017-06-09 13:52:01 +03:00			`<allow send_destination="org.projectatomic.rpmostree1"`
			`send_interface="org.projectatomic.rpmostree1.OS"/>`

daemon: Update D-Bus security policy Poke some holes in the policy so normal users can introspect paths, peek at properties, and run "rpm-ostree status". 2016-01-12 19:50:55 +03:00			`<allow send_destination="org.projectatomic.rpmostree1"`
dbus: drop root check on RegisterClient() Drop the root check for RegisterClient() so that any UID can use it to then safely invoke methods. UIDs which already have an active session do not need to authenticate for RegisterClient(). In order to implement this, we move the polkit authority setup into the RpmostreedSysroot object and enable polkit on the interface. Closes: #894 Approved by: cgwalters 2017-07-25 19:58:16 +03:00			`send_interface="org.projectatomic.rpmostree1.Sysroot"/>`
daemon: Start of work on daemon 2015-04-28 04:22:58 +03:00			`</policy>`
			`</busconfig>`