| 192 |
- |
1 |
<!DOCTYPE busconfig PUBLIC
|
|
|
2 |
"-//freedesktop//DTD D-BUS Bus Configuration 1.0//EN"
|
|
|
3 |
"http://www.freedesktop.org/standards/dbus/1.0/busconfig.dtd">
|
|
|
4 |
<busconfig>
|
|
|
5 |
<policy user="root">
|
|
|
6 |
<allow own="org.freedesktop.NetworkManager"/>
|
|
|
7 |
<allow send_destination="org.freedesktop.NetworkManager"/>
|
|
|
8 |
|
|
|
9 |
<allow send_destination="org.freedesktop.NetworkManager"
|
|
|
10 |
send_interface="org.freedesktop.NetworkManager.PPP"/>
|
|
|
11 |
|
|
|
12 |
<allow send_interface="org.freedesktop.NetworkManager.SecretAgent"/>
|
|
|
13 |
|
|
|
14 |
<!-- These are there because some broken policies do
|
|
|
15 |
<deny send_interface="..." /> (see dbus-daemon(8) for details).
|
|
|
16 |
This seems to override that for the known VPN plugins.
|
|
|
17 |
-->
|
|
|
18 |
<allow send_destination="org.freedesktop.NetworkManager.openconnect"/>
|
|
|
19 |
<allow send_destination="org.freedesktop.NetworkManager.openswan"/>
|
|
|
20 |
<allow send_destination="org.freedesktop.NetworkManager.openvpn"/>
|
|
|
21 |
<allow send_destination="org.freedesktop.NetworkManager.pptp"/>
|
|
|
22 |
<allow send_destination="org.freedesktop.NetworkManager.vpnc"/>
|
|
|
23 |
<allow send_destination="org.freedesktop.NetworkManager.ssh"/>
|
|
|
24 |
<allow send_destination="org.freedesktop.NetworkManager.iodine"/>
|
|
|
25 |
<allow send_destination="org.freedesktop.NetworkManager.l2tp"/>
|
|
|
26 |
<allow send_destination="org.freedesktop.NetworkManager.libreswan"/>
|
|
|
27 |
<allow send_destination="org.freedesktop.NetworkManager.fortisslvpn"/>
|
|
|
28 |
<allow send_destination="org.freedesktop.NetworkManager.strongswan"/>
|
|
|
29 |
<allow send_interface="org.freedesktop.NetworkManager.VPN.Plugin"/>
|
|
|
30 |
|
|
|
31 |
<allow send_destination="org.fedoraproject.FirewallD1"/>
|
|
|
32 |
|
|
|
33 |
<!-- Allow the custom name for the dnsmasq instance spawned by NM
|
|
|
34 |
from the dns dnsmasq plugin to own its dbus name, and for
|
|
|
35 |
messages to be sent to it.
|
|
|
36 |
-->
|
|
|
37 |
<allow own="org.freedesktop.NetworkManager.dnsmasq"/>
|
|
|
38 |
<allow send_destination="org.freedesktop.NetworkManager.dnsmasq"/>
|
|
|
39 |
</policy>
|
|
|
40 |
<policy context="default">
|
|
|
41 |
<deny own="org.freedesktop.NetworkManager"/>
|
|
|
42 |
|
|
|
43 |
<deny send_destination="org.freedesktop.NetworkManager"/>
|
|
|
44 |
|
|
|
45 |
<!-- Basic D-Bus API stuff -->
|
|
|
46 |
<allow send_destination="org.freedesktop.NetworkManager"
|
|
|
47 |
send_interface="org.freedesktop.DBus.Introspectable"/>
|
|
|
48 |
<allow send_destination="org.freedesktop.NetworkManager"
|
|
|
49 |
send_interface="org.freedesktop.DBus.Properties"/>
|
|
|
50 |
<allow send_destination="org.freedesktop.NetworkManager"
|
|
|
51 |
send_interface="org.freedesktop.DBus.ObjectManager"/>
|
|
|
52 |
|
|
|
53 |
<!-- Devices (read-only properties, no methods) -->
|
|
|
54 |
<allow send_destination="org.freedesktop.NetworkManager" send_interface="org.freedesktop.NetworkManager.AccessPoint"/>
|
|
|
55 |
<allow send_destination="org.freedesktop.NetworkManager" send_interface="org.freedesktop.NetworkManager.Device.Adsl"/>
|
|
|
56 |
<allow send_destination="org.freedesktop.NetworkManager" send_interface="org.freedesktop.NetworkManager.Device.Bluetooth"/>
|
|
|
57 |
<allow send_destination="org.freedesktop.NetworkManager" send_interface="org.freedesktop.NetworkManager.Device.Bond"/>
|
|
|
58 |
<allow send_destination="org.freedesktop.NetworkManager" send_interface="org.freedesktop.NetworkManager.Device.Bridge"/>
|
|
|
59 |
<allow send_destination="org.freedesktop.NetworkManager" send_interface="org.freedesktop.NetworkManager.Device.Generic"/>
|
|
|
60 |
<allow send_destination="org.freedesktop.NetworkManager" send_interface="org.freedesktop.NetworkManager.Device.Gre"/>
|
|
|
61 |
<allow send_destination="org.freedesktop.NetworkManager" send_interface="org.freedesktop.NetworkManager.Device.Infiniband"/>
|
|
|
62 |
<allow send_destination="org.freedesktop.NetworkManager" send_interface="org.freedesktop.NetworkManager.Device.Macvlan"/>
|
|
|
63 |
<allow send_destination="org.freedesktop.NetworkManager" send_interface="org.freedesktop.NetworkManager.Device.Modem"/>
|
|
|
64 |
<allow send_destination="org.freedesktop.NetworkManager" send_interface="org.freedesktop.NetworkManager.Device.OlpcMesh"/>
|
|
|
65 |
<allow send_destination="org.freedesktop.NetworkManager" send_interface="org.freedesktop.NetworkManager.Device.Team"/>
|
|
|
66 |
<allow send_destination="org.freedesktop.NetworkManager" send_interface="org.freedesktop.NetworkManager.Device.Tun"/>
|
|
|
67 |
<allow send_destination="org.freedesktop.NetworkManager" send_interface="org.freedesktop.NetworkManager.Device.Veth"/>
|
|
|
68 |
<allow send_destination="org.freedesktop.NetworkManager" send_interface="org.freedesktop.NetworkManager.Device.Vlan"/>
|
|
|
69 |
<allow send_destination="org.freedesktop.NetworkManager" send_interface="org.freedesktop.NetworkManager.Device.Wired"/>
|
|
|
70 |
<allow send_destination="org.freedesktop.NetworkManager" send_interface="org.freedesktop.NetworkManager.WiMax.Nsp"/>
|
|
|
71 |
<allow send_destination="org.freedesktop.NetworkManager" send_interface="org.freedesktop.NetworkManager.WifiP2PPeer"/>
|
|
|
72 |
|
|
|
73 |
<!-- Devices (read-only, no security required) -->
|
|
|
74 |
<allow send_destination="org.freedesktop.NetworkManager" send_interface="org.freedesktop.NetworkManager.Device.WiMax"/>
|
|
|
75 |
|
|
|
76 |
<!-- Devices (read/write, secured with PolicyKit) -->
|
|
|
77 |
<allow send_destination="org.freedesktop.NetworkManager" send_interface="org.freedesktop.NetworkManager.Device.Wireless"/>
|
|
|
78 |
<allow send_destination="org.freedesktop.NetworkManager" send_interface="org.freedesktop.NetworkManager.Device.WifiP2P"/>
|
|
|
79 |
<allow send_destination="org.freedesktop.NetworkManager" send_interface="org.freedesktop.NetworkManager.Device"/>
|
|
|
80 |
|
|
|
81 |
<!-- Core stuff (read-only properties, no methods) -->
|
|
|
82 |
<allow send_destination="org.freedesktop.NetworkManager" send_interface="org.freedesktop.NetworkManager.Connection.Active"/>
|
|
|
83 |
<allow send_destination="org.freedesktop.NetworkManager" send_interface="org.freedesktop.NetworkManager.DHCP4Config"/>
|
|
|
84 |
<allow send_destination="org.freedesktop.NetworkManager" send_interface="org.freedesktop.NetworkManager.DHCP6Config"/>
|
|
|
85 |
<allow send_destination="org.freedesktop.NetworkManager" send_interface="org.freedesktop.NetworkManager.IP4Config"/>
|
|
|
86 |
<allow send_destination="org.freedesktop.NetworkManager" send_interface="org.freedesktop.NetworkManager.IP6Config"/>
|
|
|
87 |
<allow send_destination="org.freedesktop.NetworkManager" send_interface="org.freedesktop.NetworkManager.VPN.Connection"/>
|
|
|
88 |
|
|
|
89 |
<!-- Core stuff (read/write, secured with PolicyKit) -->
|
|
|
90 |
<allow send_destination="org.freedesktop.NetworkManager" send_interface="org.freedesktop.NetworkManager"/>
|
|
|
91 |
<allow send_destination="org.freedesktop.NetworkManager" send_interface="org.freedesktop.NetworkManager.Settings"/>
|
|
|
92 |
<allow send_destination="org.freedesktop.NetworkManager" send_interface="org.freedesktop.NetworkManager.Settings.Connection"/>
|
|
|
93 |
|
|
|
94 |
<!-- Agents; secured with PolicyKit. Any process can talk to
|
|
|
95 |
the AgentManager API, but only NetworkManager can talk
|
|
|
96 |
to the agents themselves. -->
|
|
|
97 |
<allow send_destination="org.freedesktop.NetworkManager" send_interface="org.freedesktop.NetworkManager.AgentManager"/>
|
|
|
98 |
|
|
|
99 |
<!-- Root-only functions -->
|
|
|
100 |
<deny send_destination="org.freedesktop.NetworkManager" send_interface="org.freedesktop.NetworkManager" send_member="SetLogging"/>
|
|
|
101 |
<deny send_destination="org.freedesktop.NetworkManager" send_interface="org.freedesktop.NetworkManager" send_member="Sleep"/>
|
|
|
102 |
<deny send_destination="org.freedesktop.NetworkManager" send_interface="org.freedesktop.NetworkManager.Settings" send_member="LoadConnections"/>
|
|
|
103 |
<deny send_destination="org.freedesktop.NetworkManager" send_interface="org.freedesktop.NetworkManager.Settings" send_member="ReloadConnections"/>
|
|
|
104 |
|
|
|
105 |
<deny own="org.freedesktop.NetworkManager.dnsmasq"/>
|
|
|
106 |
<deny send_destination="org.freedesktop.NetworkManager.dnsmasq"/>
|
|
|
107 |
</policy>
|
|
|
108 |
|
|
|
109 |
<limit name="max_replies_per_connection">1024</limit>
|
|
|
110 |
<limit name="max_match_rules_per_connection">2048</limit>
|
|
|
111 |
</busconfig>
|