etc and var customers

2025-05-16 16:28:02 +02:00
parent 9b8f4871c4
commit ac0d8efa77
922 changed files with 30951 additions and 0 deletions
--- a/etc/dbus-1/system.d/avahi-dbus.conf
+++ b/etc/dbus-1/system.d/avahi-dbus.conf
@@ -0,0 +1,32 @@
+<!DOCTYPE busconfig PUBLIC
+          "-//freedesktop//DTD D-BUS Bus Configuration 1.0//EN"
+          "http://www.freedesktop.org/standards/dbus/1.0/busconfig.dtd">
+<busconfig>
+
+  <!-- Only root or user avahi can own the Avahi service -->
+  <policy user="avahi">
+    <allow own="org.freedesktop.Avahi"/>
+  </policy>
+  <policy user="root">
+    <allow own="org.freedesktop.Avahi"/>
+  </policy>
+
+  <!-- Allow anyone to invoke methods on Avahi server, except SetHostName -->
+  <policy context="default">
+    <allow send_destination="org.freedesktop.Avahi"/>
+    <allow receive_sender="org.freedesktop.Avahi"/>
+
+    <deny send_destination="org.freedesktop.Avahi"
+          send_interface="org.freedesktop.Avahi.Server" send_member="SetHostName"/>
+  </policy>
+
+  <!-- Allow everything, including access to SetHostName to users of the group "netdev" -->
+  <policy group="netdev">
+    <allow send_destination="org.freedesktop.Avahi"/>
+    <allow receive_sender="org.freedesktop.Avahi"/>
+  </policy>
+  <policy user="root">
+    <allow send_destination="org.freedesktop.Avahi"/>
+    <allow receive_sender="org.freedesktop.Avahi"/>
+  </policy>
+</busconfig>
--- a/etc/dbus-1/system.d/net.hadess.SensorProxy.conf
+++ b/etc/dbus-1/system.d/net.hadess.SensorProxy.conf
@@ -0,0 +1,33 @@
+<?xml version="1.0" encoding="UTF-8"?> <!-- -*- XML -*- -->
+
+<!DOCTYPE busconfig PUBLIC
+ "-//freedesktop//DTD D-BUS Bus Configuration 1.0//EN"
+ "http://www.freedesktop.org/standards/dbus/1.0/busconfig.dtd">
+<busconfig>
+
+  <!-- Only root can own the service -->
+  <policy user="root">
+    <allow own="net.hadess.SensorProxy"/>
+  </policy>
+
+  <!-- Only Geoclue can access the compass -->
+  <policy user="geoclue">
+    <allow send_destination="net.hadess.SensorProxy" send_interface="net.hadess.SensorProxy.Compass" send_path="/net/hadess/SensorProxy/Compass"/>
+    <allow send_destination="net.hadess.SensorProxy" send_interface="org.freedesktop.DBus.Introspectable" send_path="/net/hadess/SensorProxy/Compass"/>
+    <allow send_destination="net.hadess.SensorProxy" send_interface="org.freedesktop.DBus.Properties" send_path="/net/hadess/SensorProxy/Compass"/>
+    <allow send_destination="net.hadess.SensorProxy" send_interface="org.freedesktop.DBus.Peer" send_path="/net/hadess/SensorProxy/Compass"/>
+  </policy>
+
+  <!-- Anyone can talk to the main interface -->
+  <policy context="default">
+    <allow send_destination="net.hadess.SensorProxy" send_interface="net.hadess.SensorProxy"/>
+    <allow send_destination="net.hadess.SensorProxy" send_interface="org.freedesktop.DBus.Introspectable"/>
+    <allow send_destination="net.hadess.SensorProxy" send_interface="org.freedesktop.DBus.Properties"/>
+    <allow send_destination="net.hadess.SensorProxy" send_interface="org.freedesktop.DBus.Peer"/>
+    <deny send_destination="net.hadess.SensorProxy" send_interface="org.freedesktop.DBus.Introspectable" send_path="/net/hadess/SensorProxy/Compass"/>
+    <deny send_destination="net.hadess.SensorProxy" send_interface="org.freedesktop.DBus.Properties" send_path="/net/hadess/SensorProxy/Compass"/>
+    <deny send_destination="net.hadess.SensorProxy" send_interface="org.freedesktop.DBus.Peer" send_path="/net/hadess/SensorProxy/Compass"/>
+    <!-- <deny send_destination="net.hadess.SensorProxy" send_interface="net.hadess.SensorProxy.Compass"/> -->
+  </policy>
+
+</busconfig>
--- a/etc/dbus-1/system.d/org.freedesktop.GeoClue2.Agent.conf
+++ b/etc/dbus-1/system.d/org.freedesktop.GeoClue2.Agent.conf
@@ -0,0 +1,18 @@
+<!DOCTYPE busconfig PUBLIC
+ "-//freedesktop//DTD D-BUS Bus Configuration 1.0//EN"
+ "http://www.freedesktop.org/standards/dbus/1.0/busconfig.dtd">
+<busconfig>
+  <policy user="geoclue">
+    <allow send_interface="org.freedesktop.GeoClue2.Agent"
+           send_path="/org/freedesktop/GeoClue2/Agent"/>
+    <allow send_interface="org.freedesktop.DBus.Properties"
+           send_path="/org/freedesktop/GeoClue2/Agent"/>
+  </policy>
+
+  <policy user="root">
+    <allow send_interface="org.freedesktop.GeoClue2.Agent"
+           send_path="/org/freedesktop/GeoClue2/Agent"/>
+    <allow send_interface="org.freedesktop.DBus.Properties"
+           send_path="/org/freedesktop/GeoClue2/Agent"/>
+  </policy>
+</busconfig>
--- a/etc/dbus-1/system.d/org.freedesktop.GeoClue2.conf
+++ b/etc/dbus-1/system.d/org.freedesktop.GeoClue2.conf
@@ -0,0 +1,40 @@
+<!DOCTYPE busconfig PUBLIC
+ "-//freedesktop//DTD D-BUS Bus Configuration 1.0//EN"
+ "http://www.freedesktop.org/standards/dbus/1.0/busconfig.dtd">
+<busconfig>
+  <policy context="default">
+    <!-- Allow everyone to talk to main service. We'll later add an agent to
+         only share the location if user allows it. -->
+    <allow send_destination="org.freedesktop.GeoClue2"/>
+  </policy>
+
+  <policy user="geoclue">
+    <!-- Only allow geoclue to own the name on the bus -->
+    <allow own="org.freedesktop.GeoClue2"/>
+
+    <!-- Also give geoclue access to wpa_supplicant API -->
+    <allow receive_sender="fi.w1.wpa_supplicant1"
+           receive_type="signal"/>
+
+    <allow send_destination="fi.w1.wpa_supplicant1"
+           send_interface="org.freedesktop.DBus.Properties"
+           send_member="Get"/>
+
+    <allow send_destination="fi.w1.wpa_supplicant1"
+           send_interface="org.freedesktop.DBus.Properties"
+           send_member="GetAll"/>
+
+    <allow send_destination="fi.w1.wpa_supplicant1"
+           send_interface="org.freedesktop.DBus.Introspectable"/>
+
+    <allow send_destination="fi.w1.wpa_supplicant1"
+           send_interface="fi.w1.wpa_supplicant1.Interface"
+           send_type="method_call"
+           send_member="Scan"/>
+  </policy>
+
+  <policy user="root">
+    <!-- Allow root to own the name on the bus -->
+    <allow own="org.freedesktop.GeoClue2"/>
+  </policy>
+</busconfig>
--- a/etc/dbus-1/system.d/org.freedesktop.ModemManager1.conf
+++ b/etc/dbus-1/system.d/org.freedesktop.ModemManager1.conf
@@ -0,0 +1,344 @@
+<!DOCTYPE busconfig PUBLIC
+ "-//freedesktop//DTD D-BUS Bus Configuration 1.0//EN"
+ "http://www.freedesktop.org/standards/dbus/1.0/busconfig.dtd">
+<busconfig>
+  <policy context="default">
+    <deny send_destination="org.freedesktop.ModemManager1"
+          send_type="method_call"/>
+
+    <!-- Methods listed here are explicitly allowed or PolicyKit protected.
+         The rest are restricted to root for security.
+      -->
+
+    <!-- org.freedesktop.ModemManager1.xml -->
+
+    <!-- Allowed for everyone -->
+    <allow send_destination="org.freedesktop.ModemManager1"
+           send_interface="org.freedesktop.DBus.Introspectable"/>
+
+    <allow send_destination="org.freedesktop.ModemManager1"
+           send_interface="org.freedesktop.DBus.Properties"/>
+
+    <allow send_destination="org.freedesktop.ModemManager1"
+           send_interface="org.freedesktop.DBus.ObjectManager"/>
+
+    <!-- Protected by the Control policy rule -->
+    <allow send_destination="org.freedesktop.ModemManager1"
+           send_interface="org.freedesktop.ModemManager1"
+           send_member="ScanDevices"/>
+
+    <allow send_destination="org.freedesktop.ModemManager1"
+           send_interface="org.freedesktop.ModemManager1"
+           send_member="SetLogging"/>
+
+    <!-- org.freedesktop.ModemManager1.Modem.xml -->
+
+    <!-- Allowed for everyone -->
+    <allow send_destination="org.freedesktop.ModemManager1"
+           send_interface="org.freedesktop.ModemManager1.Modem"
+           send_member="ListBearers"/>
+
+    <!-- Protected by the Device.Control policy rule -->
+    <allow send_destination="org.freedesktop.ModemManager1"
+           send_interface="org.freedesktop.ModemManager1.Modem"
+           send_member="Enable"/>
+
+    <allow send_destination="org.freedesktop.ModemManager1"
+           send_interface="org.freedesktop.ModemManager1.Modem"
+           send_member="CreateBearer"/>
+
+    <allow send_destination="org.freedesktop.ModemManager1"
+           send_interface="org.freedesktop.ModemManager1.Modem"
+           send_member="DeleteBearer"/>
+
+    <allow send_destination="org.freedesktop.ModemManager1"
+           send_interface="org.freedesktop.ModemManager1.Modem"
+           send_member="SetPowerState"/>
+
+    <allow send_destination="org.freedesktop.ModemManager1"
+           send_interface="org.freedesktop.ModemManager1.Modem"
+           send_member="Reset"/>
+
+    <allow send_destination="org.freedesktop.ModemManager1"
+           send_interface="org.freedesktop.ModemManager1.Modem"
+           send_member="FactoryReset"/>
+
+    <allow send_destination="org.freedesktop.ModemManager1"
+           send_interface="org.freedesktop.ModemManager1.Modem"
+           send_member="SetCurrentCapabilities"/>
+
+    <allow send_destination="org.freedesktop.ModemManager1"
+           send_interface="org.freedesktop.ModemManager1.Modem"
+           send_member="SetCurrentModes"/>
+
+    <allow send_destination="org.freedesktop.ModemManager1"
+           send_interface="org.freedesktop.ModemManager1.Modem"
+           send_member="SetCurrentBands"/>
+
+    <allow send_destination="org.freedesktop.ModemManager1"
+           send_interface="org.freedesktop.ModemManager1.Modem"
+           send_member="Command"/>
+
+    <!-- org.freedesktop.ModemManager1.Modem.Firmware.xml -->
+
+    <!-- Protected by the Device.Control policy rule -->
+    <allow send_destination="org.freedesktop.ModemManager1"
+           send_interface="org.freedesktop.ModemManager1.Modem.Firmware"
+           send_member="List"/>
+    <allow send_destination="org.freedesktop.ModemManager1"
+           send_interface="org.freedesktop.ModemManager1.Modem.Firmware"
+           send_member="Select"/>
+
+    <!-- org.freedesktop.ModemManager1.Modem.Simple.xml -->
+
+    <!-- Allowed for everyone -->
+    <allow send_destination="org.freedesktop.ModemManager1"
+           send_interface="org.freedesktop.ModemManager1.Modem.Simple"
+           send_member="GetStatus"/>
+
+    <!-- Protected by the Device.Control policy rule -->
+    <allow send_destination="org.freedesktop.ModemManager1"
+           send_interface="org.freedesktop.ModemManager1.Modem.Simple"
+           send_member="Connect"/>
+
+    <allow send_destination="org.freedesktop.ModemManager1"
+           send_interface="org.freedesktop.ModemManager1.Modem.Simple"
+           send_member="Disconnect"/>
+
+    <!-- org.freedesktop.ModemManager1.Modem.Modem3gpp.xml -->
+
+    <!-- Protected by the Device.Control policy rule -->
+    <allow send_destination="org.freedesktop.ModemManager1"
+           send_interface="org.freedesktop.ModemManager1.Modem.Modem3gpp"
+           send_member="Register"/>
+
+    <allow send_destination="org.freedesktop.ModemManager1"
+           send_interface="org.freedesktop.ModemManager1.Modem.Modem3gpp"
+           send_member="Scan"/>
+
+    <allow send_destination="org.freedesktop.ModemManager1"
+           send_interface="org.freedesktop.ModemManager1.Modem.Modem3gpp"
+           send_member="SetEpsUeModeOperation"/>
+
+    <allow send_destination="org.freedesktop.ModemManager1"
+           send_interface="org.freedesktop.ModemManager1.Modem.Modem3gpp"
+           send_member="SetInitialEpsBearerSettings"/>
+
+    <!-- org.freedesktop.ModemManager1.Modem.ModemCdma.xml -->
+
+    <!-- Protected by the Device.Control policy rule -->
+    <allow send_destination="org.freedesktop.ModemManager1"
+           send_interface="org.freedesktop.ModemManager1.Modem.ModemCdma"
+           send_member="Activate"/>
+
+    <allow send_destination="org.freedesktop.ModemManager1"
+           send_interface="org.freedesktop.ModemManager1.Modem.ModemCdma"
+           send_member="ActivateManual"/>
+
+    <!-- org.freedesktop.ModemManager1.Modem.Oma.xml -->
+
+    <!-- Protected by the Device.Control policy rule -->
+    <allow send_destination="org.freedesktop.ModemManager1"
+           send_interface="org.freedesktop.ModemManager1.Modem.Oma"
+           send_member="Setup"/>
+
+    <allow send_destination="org.freedesktop.ModemManager1"
+           send_interface="org.freedesktop.ModemManager1.Modem.Oma"
+           send_member="StartClientInitiatedSession"/>
+
+    <allow send_destination="org.freedesktop.ModemManager1"
+           send_interface="org.freedesktop.ModemManager1.Modem.Oma"
+           send_member="AcceptNetworkInitiatedSession"/>
+
+    <allow send_destination="org.freedesktop.ModemManager1"
+           send_interface="org.freedesktop.ModemManager1.Modem.Oma"
+           send_member="CancelSession"/>
+
+    <!-- org.freedesktop.ModemManager1.Sim.xml -->
+
+    <!-- Protected by the Device.Control policy rule -->
+    <allow send_destination="org.freedesktop.ModemManager1"
+           send_interface="org.freedesktop.ModemManager1.Sim"
+           send_member="SendPin"/>
+
+    <allow send_destination="org.freedesktop.ModemManager1"
+           send_interface="org.freedesktop.ModemManager1.Sim"
+           send_member="SendPuk"/>
+
+    <allow send_destination="org.freedesktop.ModemManager1"
+           send_interface="org.freedesktop.ModemManager1.Sim"
+           send_member="EnablePin"/>
+
+    <allow send_destination="org.freedesktop.ModemManager1"
+           send_interface="org.freedesktop.ModemManager1.Sim"
+           send_member="ChangePin"/>
+
+    <!-- org.freedesktop.ModemManager1.Bearer.xml -->
+
+    <!-- Protected by the Device.Control policy rule -->
+    <allow send_destination="org.freedesktop.ModemManager1"
+           send_interface="org.freedesktop.ModemManager1.Bearer"
+           send_member="Connect"/>
+
+    <allow send_destination="org.freedesktop.ModemManager1"
+           send_interface="org.freedesktop.ModemManager1.Bearer"
+           send_member="Disconnect"/>
+
+    <!-- org.freedesktop.ModemManager1.Modem.Modem3gpp.Ussd.xml -->
+
+    <!-- Protected by the USSD policy rule -->
+    <allow send_destination="org.freedesktop.ModemManager1"
+           send_interface="org.freedesktop.ModemManager1.Modem.Modem3gpp.Ussd"
+           send_member="Initiate"/>
+
+    <allow send_destination="org.freedesktop.ModemManager1"
+           send_interface="org.freedesktop.ModemManager1.Modem.Modem3gpp.Ussd"
+           send_member="Respond"/>
+
+    <allow send_destination="org.freedesktop.ModemManager1"
+           send_interface="org.freedesktop.ModemManager1.Modem.Modem3gpp.Ussd"
+           send_member="Cancel"/>
+
+    <!-- org.freedesktop.ModemManager1.Modem.Location.xml -->
+
+    <!-- Protected by the Device.Control policy rule -->
+    <allow send_destination="org.freedesktop.ModemManager1"
+           send_interface="org.freedesktop.ModemManager1.Modem.Location"
+           send_member="Setup"/>
+
+    <allow send_destination="org.freedesktop.ModemManager1"
+           send_interface="org.freedesktop.ModemManager1.Modem.Location"
+           send_member="SetSuplServer"/>
+
+    <allow send_destination="org.freedesktop.ModemManager1"
+           send_interface="org.freedesktop.ModemManager1.Modem.Location"
+           send_member="InjectAssistanceData"/>
+
+    <allow send_destination="org.freedesktop.ModemManager1"
+           send_interface="org.freedesktop.ModemManager1.Modem.Location"
+           send_member="SetGpsRefreshRate"/>
+
+    <!-- Protected by the Location policy rule -->
+    <allow send_destination="org.freedesktop.ModemManager1"
+           send_interface="org.freedesktop.ModemManager1.Modem.Location"
+           send_member="GetLocation"/>
+
+    <!-- org.freedesktop.ModemManager1.Modem.Messaging.xml -->
+
+    <!-- Allowed for everyone -->
+    <allow send_destination="org.freedesktop.ModemManager1"
+           send_interface="org.freedesktop.ModemManager1.Modem.Messaging"
+           send_member="List"/>
+
+    <!-- Protected by the Messaging policy rule -->
+    <allow send_destination="org.freedesktop.ModemManager1"
+           send_interface="org.freedesktop.ModemManager1.Modem.Messaging"
+           send_member="Create"/>
+
+    <allow send_destination="org.freedesktop.ModemManager1"
+           send_interface="org.freedesktop.ModemManager1.Modem.Messaging"
+           send_member="Delete"/>
+
+    <!-- org.freedesktop.ModemManager1.Sms.xml -->
+
+    <!-- Protected by the Messaging policy rule -->
+    <allow send_destination="org.freedesktop.ModemManager1"
+           send_interface="org.freedesktop.ModemManager1.Sms"
+           send_member="Store"/>
+
+    <allow send_destination="org.freedesktop.ModemManager1"
+           send_interface="org.freedesktop.ModemManager1.Sms"
+           send_member="Send"/>
+
+    <!-- org.freedesktop.ModemManager1.Modem.Voice.xml -->
+
+    <!-- Allowed for everyone -->
+    <allow send_destination="org.freedesktop.ModemManager1"
+           send_interface="org.freedesktop.ModemManager1.Modem.Voice"
+           send_member="ListCalls"/>
+
+    <!-- Protected by the Voice policy rule -->
+    <allow send_destination="org.freedesktop.ModemManager1"
+           send_interface="org.freedesktop.ModemManager1.Modem.Voice"
+           send_member="CreateCall"/>
+
+    <allow send_destination="org.freedesktop.ModemManager1"
+           send_interface="org.freedesktop.ModemManager1.Modem.Voice"
+           send_member="DeleteCall"/>
+
+    <allow send_destination="org.freedesktop.ModemManager1"
+           send_interface="org.freedesktop.ModemManager1.Modem.Voice"
+           send_member="HoldAndAccept"/>
+
+    <allow send_destination="org.freedesktop.ModemManager1"
+           send_interface="org.freedesktop.ModemManager1.Modem.Voice"
+           send_member="HangupAndAccept"/>
+
+    <allow send_destination="org.freedesktop.ModemManager1"
+           send_interface="org.freedesktop.ModemManager1.Modem.Voice"
+           send_member="HangupAll"/>
+
+    <allow send_destination="org.freedesktop.ModemManager1"
+           send_interface="org.freedesktop.ModemManager1.Modem.Voice"
+           send_member="Transfer"/>
+
+    <allow send_destination="org.freedesktop.ModemManager1"
+           send_interface="org.freedesktop.ModemManager1.Modem.Voice"
+           send_member="CallWaitingSetup"/>
+
+    <allow send_destination="org.freedesktop.ModemManager1"
+           send_interface="org.freedesktop.ModemManager1.Modem.Voice"
+           send_member="CallWaitingQuery"/>
+
+    <!-- org.freedesktop.ModemManager1.Call.xml -->
+
+    <!-- Protected by the Voice policy rule -->
+    <allow send_destination="org.freedesktop.ModemManager1"
+           send_interface="org.freedesktop.ModemManager1.Call"
+           send_member="Start"/>
+
+    <allow send_destination="org.freedesktop.ModemManager1"
+           send_interface="org.freedesktop.ModemManager1.Call"
+           send_member="Accept"/>
+
+    <allow send_destination="org.freedesktop.ModemManager1"
+           send_interface="org.freedesktop.ModemManager1.Call"
+           send_member="Deflect"/>
+
+    <allow send_destination="org.freedesktop.ModemManager1"
+           send_interface="org.freedesktop.ModemManager1.Call"
+           send_member="JoinMultiparty"/>
+
+    <allow send_destination="org.freedesktop.ModemManager1"
+           send_interface="org.freedesktop.ModemManager1.Call"
+           send_member="LeaveMultiparty"/>
+
+    <allow send_destination="org.freedesktop.ModemManager1"
+           send_interface="org.freedesktop.ModemManager1.Call"
+           send_member="Hangup"/>
+
+    <allow send_destination="org.freedesktop.ModemManager1"
+           send_interface="org.freedesktop.ModemManager1.Call"
+           send_member="SendDtmf"/>
+
+    <!-- org.freedesktop.ModemManager1.Modem.Signal.xml -->
+
+    <!-- Protected by the Device.Control policy rule -->
+    <allow send_destination="org.freedesktop.ModemManager1"
+           send_interface="org.freedesktop.ModemManager1.Modem.Signal"
+           send_member="Setup"/>
+
+    <!-- org.freedesktop.ModemManager1.Modem.Time.xml -->
+
+    <!-- Protected by the Time policy rule -->
+    <allow send_destination="org.freedesktop.ModemManager1"
+           send_interface="org.freedesktop.ModemManager1.Modem.Time"
+           send_member="GetNetworkTime"/>
+
+  </policy>
+
+  <policy user="root">
+    <allow own="org.freedesktop.ModemManager1"/>
+    <allow send_destination="org.freedesktop.ModemManager1"/>
+  </policy>
+</busconfig>
--- a/etc/dbus-1/system.d/wpa_supplicant.conf
+++ b/etc/dbus-1/system.d/wpa_supplicant.conf
@@ -0,0 +1,25 @@
+<!DOCTYPE busconfig PUBLIC
+ "-//freedesktop//DTD D-BUS Bus Configuration 1.0//EN"
+ "http://www.freedesktop.org/standards/dbus/1.0/busconfig.dtd">
+<busconfig>
+        <policy user="root">
+                <allow own="fi.w1.wpa_supplicant1"/>
+
+                <allow send_destination="fi.w1.wpa_supplicant1"/>
+                <allow send_interface="fi.w1.wpa_supplicant1"/>
+                <allow receive_sender="fi.w1.wpa_supplicant1" receive_type="signal"/>
+        </policy>
+        <policy group="netdev">
+                <allow send_destination="fi.epitest.hostap.WPASupplicant"/>
+                <allow send_interface="fi.epitest.hostap.WPASupplicant"/>
+
+                <allow send_destination="fi.w1.wpa_supplicant1"/>
+                <allow send_interface="fi.w1.wpa_supplicant1"/>
+                <allow receive_sender="fi.w1.wpa_supplicant1" receive_type="signal"/>
+        </policy>
+        <policy context="default">
+                <deny own="fi.w1.wpa_supplicant1"/>
+                <deny send_destination="fi.w1.wpa_supplicant1"/>
+                <deny receive_sender="fi.w1.wpa_supplicant1" receive_type="signal"/>
+        </policy>
+</busconfig>