From 33491bc4279481db8ae47213e34a6d695a0e8830 Mon Sep 17 00:00:00 2001
From: Michael Biebl <biebl@debian.org>
Date: Sun, 6 Jul 2014 02:16:10 +0200
Subject: Imported Upstream version 0.9.10.0

---
 src/org.freedesktop.NetworkManager.conf | 114 +++++++++++++++++---------------
 1 file changed, 60 insertions(+), 54 deletions(-)

(limited to 'src/org.freedesktop.NetworkManager.conf')

diff --git a/src/org.freedesktop.NetworkManager.conf b/src/org.freedesktop.NetworkManager.conf
index db68374c..bdfe3e67 100644
--- a/src/org.freedesktop.NetworkManager.conf
+++ b/src/org.freedesktop.NetworkManager.conf
@@ -26,93 +26,99 @@
                 <allow send_destination="org.freedesktop.NetworkManager.ssh"/>
                 <allow send_destination="org.freedesktop.NetworkManager.iodine"/>
         </policy>
-        <policy at_console="true">
-                <allow send_destination="org.freedesktop.NetworkManager"/>
+        <policy context="default">
+                <deny own="org.freedesktop.NetworkManager"/>
 
+                <deny send_destination="org.freedesktop.NetworkManager"/>
+
+		<!-- Basic D-Bus API stuff -->
                 <allow send_destination="org.freedesktop.NetworkManager"
                        send_interface="org.freedesktop.DBus.Introspectable"/>
-
                 <allow send_destination="org.freedesktop.NetworkManager"
                        send_interface="org.freedesktop.DBus.Properties"/>
 
+		<!-- Devices (read-only properties, no methods) -->
                 <allow send_destination="org.freedesktop.NetworkManager"
-                       send_interface="org.freedesktop.NetworkManager"/>
-
+                       send_interface="org.freedesktop.NetworkManager.Device.Adsl"/>
                 <allow send_destination="org.freedesktop.NetworkManager"
-                       send_interface="org.freedesktop.NetworkManager.AccessPoint"/>
-
+                       send_interface="org.freedesktop.NetworkManager.Device.Bond"/>
                 <allow send_destination="org.freedesktop.NetworkManager"
-                       send_interface="org.freedesktop.NetworkManager.Connection.Active"/>
-
+                       send_interface="org.freedesktop.NetworkManager.Device.Bridge"/>
                 <allow send_destination="org.freedesktop.NetworkManager"
-                       send_interface="org.freedesktop.NetworkManager.Device.Modem"/>
-
+                       send_interface="org.freedesktop.NetworkManager.Device.Bluetooth"/>
                 <allow send_destination="org.freedesktop.NetworkManager"
                        send_interface="org.freedesktop.NetworkManager.Device.Wired"/>
+                <allow send_destination="org.freedesktop.NetworkManager"
+                       send_interface="org.freedesktop.NetworkManager.Device.Generic"/>
+                <allow send_destination="org.freedesktop.NetworkManager"
+                       send_interface="org.freedesktop.NetworkManager.Device.Gre"/>
+                <allow send_destination="org.freedesktop.NetworkManager"
+                       send_interface="org.freedesktop.NetworkManager.Device.Infiniband"/>
+                <allow send_destination="org.freedesktop.NetworkManager"
+                       send_interface="org.freedesktop.NetworkManager.Device.Macvlan"/>
+                <allow send_destination="org.freedesktop.NetworkManager"
+                       send_interface="org.freedesktop.NetworkManager.Device.Modem"/>
+                <allow send_destination="org.freedesktop.NetworkManager"
+                       send_interface="org.freedesktop.NetworkManager.Device.OlpcMesh"/>
+                <allow send_destination="org.freedesktop.NetworkManager"
+                       send_interface="org.freedesktop.NetworkManager.Device.Team"/>
+                <allow send_destination="org.freedesktop.NetworkManager"
+                       send_interface="org.freedesktop.NetworkManager.Device.Tun"/>
+                <allow send_destination="org.freedesktop.NetworkManager"
+                       send_interface="org.freedesktop.NetworkManager.Device.Veth"/>
+                <allow send_destination="org.freedesktop.NetworkManager"
+                       send_interface="org.freedesktop.NetworkManager.Device.Vlan"/>
+                <allow send_destination="org.freedesktop.NetworkManager"
+                       send_interface="org.freedesktop.NetworkManager.WiMax.Nsp"/>
+                <allow send_destination="org.freedesktop.NetworkManager"
+                       send_interface="org.freedesktop.NetworkManager.AccessPoint"/>
 
+		<!-- Devices (read-only, no security required) -->
                 <allow send_destination="org.freedesktop.NetworkManager"
-                       send_interface="org.freedesktop.NetworkManager.Device.Serial"/>
+                       send_interface="org.freedesktop.NetworkManager.Device.WiMax"/>
 
+		<!-- Devices (read/write, secured with PolicyKit) -->
                 <allow send_destination="org.freedesktop.NetworkManager"
                        send_interface="org.freedesktop.NetworkManager.Device.Wireless"/>
-
                 <allow send_destination="org.freedesktop.NetworkManager"
                        send_interface="org.freedesktop.NetworkManager.Device"/>
 
+		<!-- Core stuff (read-only properties, no methods) -->
+                <allow send_destination="org.freedesktop.NetworkManager"
+                       send_interface="org.freedesktop.NetworkManager.Connection.Active"/>
                 <allow send_destination="org.freedesktop.NetworkManager"
                        send_interface="org.freedesktop.NetworkManager.DHCP4Config"/>
-
+                <allow send_destination="org.freedesktop.NetworkManager"
+                       send_interface="org.freedesktop.NetworkManager.DHCP6Config"/>
                 <allow send_destination="org.freedesktop.NetworkManager"
                        send_interface="org.freedesktop.NetworkManager.IP4Config"/>
-
+                <allow send_destination="org.freedesktop.NetworkManager"
+                       send_interface="org.freedesktop.NetworkManager.IP6Config"/>
                 <allow send_destination="org.freedesktop.NetworkManager"
                        send_interface="org.freedesktop.NetworkManager.VPN.Connection"/>
 
+		<!-- Core stuff (read/write, secured with PolicyKit) -->
                 <allow send_destination="org.freedesktop.NetworkManager"
-                       send_interface="org.freedesktop.NetworkManager.AgentManager"/>
-
-                <deny send_destination="org.freedesktop.NetworkManager"
-                       send_interface="org.freedesktop.NetworkManager"
-                       send_member="SetLogging"/>
-
-                <deny send_destination="org.freedesktop.NetworkManager"
-                       send_interface="org.freedesktop.NetworkManager"
-                       send_member="Sleep"/>
-
-                <deny send_destination="org.freedesktop.NetworkManager"
-                       send_interface="org.freedesktop.NetworkManager"
-                       send_member="sleep"/>
-
-                <deny send_destination="org.freedesktop.NetworkManager"
-                       send_interface="org.freedesktop.NetworkManager"
-                       send_member="wake"/>
-        </policy>
-        <policy context="default">
-                <deny own="org.freedesktop.NetworkManager"/>
-
-                <deny send_destination="org.freedesktop.NetworkManager"/>
-
+                       send_interface="org.freedesktop.NetworkManager"/>
                 <allow send_destination="org.freedesktop.NetworkManager"
                        send_interface="org.freedesktop.NetworkManager.Settings"/>
+                <allow send_destination="org.freedesktop.NetworkManager"
+                       send_interface="org.freedesktop.NetworkManager.Settings.Connection"/>
 
+		<!-- Agents; secured with PolicyKit.  Any process can talk to
+		     the AgentManager API, but only NetworkManager can talk
+		     to the agents themselves. -->
                 <allow send_destination="org.freedesktop.NetworkManager"
                        send_interface="org.freedesktop.NetworkManager.AgentManager"/>
-
-                <deny send_destination="org.freedesktop.NetworkManager"
-                       send_interface="org.freedesktop.NetworkManager"
-                       send_member="SetLogging"/>
-
-                <deny send_destination="org.freedesktop.NetworkManager"
-                       send_interface="org.freedesktop.NetworkManager"
-                       send_member="Sleep"/>
-
-                <deny send_destination="org.freedesktop.NetworkManager"
-                       send_interface="org.freedesktop.NetworkManager"
-                       send_member="sleep"/>
-
-                <deny send_destination="org.freedesktop.NetworkManager"
-                       send_interface="org.freedesktop.NetworkManager"
-                       send_member="wake"/>
+                <deny send_interface="org.freedesktop.NetworkManager.SecretAgent"/>
+
+		<!-- Root-only functions -->
+                <deny send_interface="org.freedesktop.NetworkManager" send_member="SetLogging"/>
+                <deny send_interface="org.freedesktop.NetworkManager" send_member="Sleep"/>
+                <deny send_interface="org.freedesktop.NetworkManager.Settings" send_member="LoadConnections"/>
+                <deny send_interface="org.freedesktop.NetworkManager.Settings" send_member="ReloadConnections"/>
+                <deny send_interface="org.freedesktop.NetworkManager.VPN.Plugin"/>
+                <deny send_interface="org.freedesktop.NetworkManager.PPP"/>
         </policy>
 </busconfig>
 
-- 
cgit 1.3.0-6-gf8a5