From: kremlin <ian@kremlin.cc>
Date: Fri, 8 Aug 2014 05:21:34 +0000 (-0500)
Subject: add deny clause in hostnamed sysbus policy
X-Git-Tag: gsoc-final~26
X-Git-Url: https://uglyman.kremlin.cc/gitweb/gitweb.cgi?p=systembsd.git;a=commitdiff_plain;h=d26b0b64ec518df3c22ddf7a69e1285c983a42fc;hp=c7028b11306cb1025dd07cb3615d603f65b05ee2

add deny clause in hostnamed sysbus policy

add a <deny> statement to prevent regular users from invoking any
methods on hostname1's interface, which all set details only root
should be able to set
---

diff --git a/conf/sysbus-policy/hostnamed-dbus.conf b/conf/sysbus-policy/hostnamed-dbus.conf
index ea11b9d..9c4fa41 100644
--- a/conf/sysbus-policy/hostnamed-dbus.conf
+++ b/conf/sysbus-policy/hostnamed-dbus.conf
@@ -10,5 +10,9 @@
         <policy context="default">
                 <allow send_destination="org.freedesktop.hostname1"/>
                 <allow receive_sender="org.freedesktop.hostname1"/>
+
+                <deny send_destination="org.freedesktop.hostname1"
+                      send_interface="org.freedesktop.hostname1"
+                      send_type="method_call"/>
         </policy>
 </busconfig>