mirror of
https://git.kernel.org/pub/scm/network/wireless/iwd.git
synced 2024-11-07 12:39:23 +01:00
010b0e27f9
The 'at_console' D-Bus policy setting has been deprecated for more then 10 years and could be ignored at any time in the future. Moreover, while the intend was to allow locally logged on users to interact with iwd, it didn't actually do that. More info at https://www.spinics.net/lists/linux-bluetooth/msg75267.html and https://gitlab.freedesktop.org/dbus/dbus/-/issues/52 Therefor remove the 'at_console' setting block. On Debian (based) systems, there is a standard defined group which is allowed to manage network interfaces, and that is the 'netdev' group. So add a D-Bus setting block to grant the 'netdev' group that access.
31 lines
896 B
Plaintext
31 lines
896 B
Plaintext
<!-- This configuration file specifies the required security policies
|
|
for Wireless daemon to work. -->
|
|
|
|
<!DOCTYPE busconfig PUBLIC "-//freedesktop//DTD D-BUS Bus Configuration 1.0//EN"
|
|
"http://www.freedesktop.org/standards/dbus/1.0/busconfig.dtd">
|
|
<busconfig>
|
|
|
|
<!-- ../system.conf have denied everything, so we just punch some holes -->
|
|
|
|
<policy user="root">
|
|
<allow own="net.connman.iwd"/>
|
|
<allow send_destination="net.connman.iwd"/>
|
|
<allow send_interface="net.connman.iwd.Agent"/>
|
|
</policy>
|
|
|
|
<policy group="wheel">
|
|
<allow send_destination="net.connman.iwd"/>
|
|
<allow send_interface="net.connman.iwd.Agent"/>
|
|
</policy>
|
|
|
|
<policy group="netdev">
|
|
<allow send_destination="net.connman.iwd"/>
|
|
<allow send_interface="net.connman.iwd.Agent"/>
|
|
</policy>
|
|
|
|
<policy context="default">
|
|
<deny send_destination="net.connman.iwd"/>
|
|
</policy>
|
|
|
|
</busconfig>
|