mirror of
https://github.com/systemd/systemd.git
synced 2024-11-07 18:27:04 +03:00
283868e1dc
DBus methods that retrieve information can be called by anyone. DBus methods that modify state of units are verified via polkit action: org.freedesktop.systemd1.manage-units DBus methods that modify state of unit files are verified via polkit action: org.freedesktop.systemd1.manage-unit-files DBus methods that reload the entire daemon state are verified via polkit action: org.freedesktop.systemd1.reload-daemon DBus methods that modify job state are callable from the clients that started the job. root (ie: CAP_SYS_ADMIN) can continue to perform all calls, property access etc. There are several DBus methods that can only be called by root. Open up the dbus1 policy for the above methods. (Heavily modified by Lennart, making use of the new bus_verify_polkit_async() version that doesn't force us to always pass the original callback around. Also, interactive auhentication must be opt-in, not unconditional, hence I turned this off.)
209 lines
9.3 KiB
XML
209 lines
9.3 KiB
XML
<?xml version="1.0"?> <!--*-nxml-*-->
|
|
<!DOCTYPE busconfig PUBLIC "-//freedesktop//DTD D-BUS Bus Configuration 1.0//EN"
|
|
"http://www.freedesktop.org/standards/dbus/1.0/busconfig.dtd">
|
|
|
|
<!--
|
|
This file is part of systemd.
|
|
|
|
systemd is free software; you can redistribute it and/or modify it
|
|
under the terms of the GNU Lesser General Public License as published by
|
|
the Free Software Foundation; either version 2.1 of the License, or
|
|
(at your option) any later version.
|
|
-->
|
|
|
|
<busconfig>
|
|
|
|
<policy user="root">
|
|
<allow own="org.freedesktop.systemd1"/>
|
|
|
|
<!-- Root clients can do everything -->
|
|
<allow send_destination="org.freedesktop.systemd1"/>
|
|
<allow receive_sender="org.freedesktop.systemd1"/>
|
|
|
|
<!-- systemd may receive activator requests -->
|
|
<allow receive_interface="org.freedesktop.systemd1.Activator"
|
|
receive_member="ActivationRequest"/>
|
|
</policy>
|
|
|
|
<policy context="default">
|
|
<deny send_destination="org.freedesktop.systemd1"/>
|
|
|
|
<!-- Completely open to anyone -->
|
|
|
|
<allow send_destination="org.freedesktop.systemd1"
|
|
send_interface="org.freedesktop.DBus.Introspectable"/>
|
|
|
|
<allow send_destination="org.freedesktop.systemd1"
|
|
send_interface="org.freedesktop.DBus.Peer"/>
|
|
|
|
<allow send_destination="org.freedesktop.systemd1"
|
|
send_interface="org.freedesktop.DBus.Properties"
|
|
send_member="Get"/>
|
|
|
|
<allow send_destination="org.freedesktop.systemd1"
|
|
send_interface="org.freedesktop.DBus.Properties"
|
|
send_member="GetAll"/>
|
|
|
|
<allow send_destination="org.freedesktop.systemd1"
|
|
send_interface="org.freedesktop.systemd1.Manager"
|
|
send_member="GetUnit"/>
|
|
|
|
<allow send_destination="org.freedesktop.systemd1"
|
|
send_interface="org.freedesktop.systemd1.Manager"
|
|
send_member="GetUnitByPID"/>
|
|
|
|
<allow send_destination="org.freedesktop.systemd1"
|
|
send_interface="org.freedesktop.systemd1.Manager"
|
|
send_member="LoadUnit"/>
|
|
|
|
<allow send_destination="org.freedesktop.systemd1"
|
|
send_interface="org.freedesktop.systemd1.Manager"
|
|
send_member="GetJob"/>
|
|
|
|
<allow send_destination="org.freedesktop.systemd1"
|
|
send_interface="org.freedesktop.systemd1.Manager"
|
|
send_member="ListUnits"/>
|
|
|
|
<allow send_destination="org.freedesktop.systemd1"
|
|
send_interface="org.freedesktop.systemd1.Manager"
|
|
send_member="ListUnitsFiltered"/>
|
|
|
|
<allow send_destination="org.freedesktop.systemd1"
|
|
send_interface="org.freedesktop.systemd1.Manager"
|
|
send_member="ListUnitFiles"/>
|
|
|
|
<allow send_destination="org.freedesktop.systemd1"
|
|
send_interface="org.freedesktop.systemd1.Manager"
|
|
send_member="GetUnitFileState"/>
|
|
|
|
<allow send_destination="org.freedesktop.systemd1"
|
|
send_interface="org.freedesktop.systemd1.Manager"
|
|
send_member="ListJobs"/>
|
|
|
|
<allow send_destination="org.freedesktop.systemd1"
|
|
send_interface="org.freedesktop.systemd1.Manager"
|
|
send_member="Subscribe"/>
|
|
|
|
<allow send_destination="org.freedesktop.systemd1"
|
|
send_interface="org.freedesktop.systemd1.Manager"
|
|
send_member="Unsubscribe"/>
|
|
|
|
<allow send_destination="org.freedesktop.systemd1"
|
|
send_interface="org.freedesktop.systemd1.Manager"
|
|
send_member="Dump"/>
|
|
|
|
<allow send_destination="org.freedesktop.systemd1"
|
|
send_interface="org.freedesktop.systemd1.Manager"
|
|
send_member="GetDefaultTarget"/>
|
|
|
|
<!-- Managed via polkit or other criteria -->
|
|
|
|
<allow send_destination="org.freedesktop.systemd1"
|
|
send_interface="org.freedesktop.systemd1.Manager"
|
|
send_member="StartUnit"/>
|
|
|
|
<allow send_destination="org.freedesktop.systemd1"
|
|
send_interface="org.freedesktop.systemd1.Manager"
|
|
send_member="StartUnitReplace"/>
|
|
|
|
<allow send_destination="org.freedesktop.systemd1"
|
|
send_interface="org.freedesktop.systemd1.Manager"
|
|
send_member="StopUnit"/>
|
|
|
|
<allow send_destination="org.freedesktop.systemd1"
|
|
send_interface="org.freedesktop.systemd1.Manager"
|
|
send_member="ReloadUnit"/>
|
|
|
|
<allow send_destination="org.freedesktop.systemd1"
|
|
send_interface="org.freedesktop.systemd1.Manager"
|
|
send_member="RestartUnit"/>
|
|
|
|
<allow send_destination="org.freedesktop.systemd1"
|
|
send_interface="org.freedesktop.systemd1.Manager"
|
|
send_member="TryRestartUnit"/>
|
|
|
|
<allow send_destination="org.freedesktop.systemd1"
|
|
send_interface="org.freedesktop.systemd1.Manager"
|
|
send_member="ReloadOrRestartUnit"/>
|
|
|
|
<allow send_destination="org.freedesktop.systemd1"
|
|
send_interface="org.freedesktop.systemd1.Manager"
|
|
send_member="ReloadOrTryRestartUnit"/>
|
|
|
|
<allow send_destination="org.freedesktop.systemd1"
|
|
send_interface="org.freedesktop.systemd1.Manager"
|
|
send_member="KillUnit"/>
|
|
|
|
<allow send_destination="org.freedesktop.systemd1"
|
|
send_interface="org.freedesktop.systemd1.Manager"
|
|
send_member="ResetFailedUnit"/>
|
|
|
|
<allow send_destination="org.freedesktop.systemd1"
|
|
send_interface="org.freedesktop.systemd1.Manager"
|
|
send_member="SetUnitProperties"/>
|
|
|
|
<allow send_destination="org.freedesktop.systemd1"
|
|
send_interface="org.freedesktop.systemd1.Manager"
|
|
send_member="StartTransientUnit"/>
|
|
|
|
<allow send_destination="org.freedesktop.systemd1"
|
|
send_interface="org.freedesktop.systemd1.Manager"
|
|
send_member="CancelJob"/>
|
|
|
|
<allow send_destination="org.freedesktop.systemd1"
|
|
send_interface="org.freedesktop.systemd1.Manager"
|
|
send_member="Reload"/>
|
|
|
|
<allow send_destination="org.freedesktop.systemd1"
|
|
send_interface="org.freedesktop.systemd1.Manager"
|
|
send_member="Reexecute"/>
|
|
|
|
<allow send_destination="org.freedesktop.systemd1"
|
|
send_interface="org.freedesktop.systemd1.Manager"
|
|
send_member="EnableUnitFiles"/>
|
|
|
|
<allow send_destination="org.freedesktop.systemd1"
|
|
send_interface="org.freedesktop.systemd1.Manager"
|
|
send_member="DisableUnitFiles"/>
|
|
|
|
<allow send_destination="org.freedesktop.systemd1"
|
|
send_interface="org.freedesktop.systemd1.Manager"
|
|
send_member="ReenableUnitFiles"/>
|
|
|
|
<allow send_destination="org.freedesktop.systemd1"
|
|
send_interface="org.freedesktop.systemd1.Manager"
|
|
send_member="LinkUnitFiles"/>
|
|
|
|
<allow send_destination="org.freedesktop.systemd1"
|
|
send_interface="org.freedesktop.systemd1.Manager"
|
|
send_member="PresetUnitFiles"/>
|
|
|
|
<allow send_destination="org.freedesktop.systemd1"
|
|
send_interface="org.freedesktop.systemd1.Manager"
|
|
send_member="PresetUnitFilesWithMode"/>
|
|
|
|
<allow send_destination="org.freedesktop.systemd1"
|
|
send_interface="org.freedesktop.systemd1.Manager"
|
|
send_member="MaskUnitFiles"/>
|
|
|
|
<allow send_destination="org.freedesktop.systemd1"
|
|
send_interface="org.freedesktop.systemd1.Manager"
|
|
send_member="UnmaskUnitFiles"/>
|
|
|
|
<allow send_destination="org.freedesktop.systemd1"
|
|
send_interface="org.freedesktop.systemd1.Manager"
|
|
send_member="SetDefaultTarget"/>
|
|
|
|
<allow send_destination="org.freedesktop.systemd1"
|
|
send_interface="org.freedesktop.systemd1.Manager"
|
|
send_member="PresetAllUnitFiles"/>
|
|
|
|
<allow send_destination="org.freedesktop.systemd1"
|
|
send_interface="org.freedesktop.systemd1.Job"
|
|
send_member="Cancel"/>
|
|
|
|
<allow receive_sender="org.freedesktop.systemd1"/>
|
|
</policy>
|
|
|
|
</busconfig>
|