<allow send_destination="org.freedesktop.NetworkManager.ssh"/>
<allow send_destination="org.freedesktop.NetworkManager.iodine"/>
</policy>
- <policy at_console="true">
- <allow send_destination="org.freedesktop.NetworkManager"/>
+ <policy context="default">
+ <deny own="org.freedesktop.NetworkManager"/>
+ <deny send_destination="org.freedesktop.NetworkManager"/>
+
+ <!-- Basic D-Bus API stuff -->
<allow send_destination="org.freedesktop.NetworkManager"
send_interface="org.freedesktop.DBus.Introspectable"/>
-
<allow send_destination="org.freedesktop.NetworkManager"
send_interface="org.freedesktop.DBus.Properties"/>
+ <!-- Devices (read-only properties, no methods) -->
<allow send_destination="org.freedesktop.NetworkManager"
- send_interface="org.freedesktop.NetworkManager"/>
-
+ send_interface="org.freedesktop.NetworkManager.Device.Adsl"/>
<allow send_destination="org.freedesktop.NetworkManager"
- send_interface="org.freedesktop.NetworkManager.AccessPoint"/>
-
+ send_interface="org.freedesktop.NetworkManager.Device.Bond"/>
<allow send_destination="org.freedesktop.NetworkManager"
- send_interface="org.freedesktop.NetworkManager.Connection.Active"/>
-
+ send_interface="org.freedesktop.NetworkManager.Device.Bridge"/>
<allow send_destination="org.freedesktop.NetworkManager"
- send_interface="org.freedesktop.NetworkManager.Device.Modem"/>
-
+ send_interface="org.freedesktop.NetworkManager.Device.Bluetooth"/>
<allow send_destination="org.freedesktop.NetworkManager"
send_interface="org.freedesktop.NetworkManager.Device.Wired"/>
+ <allow send_destination="org.freedesktop.NetworkManager"
+ send_interface="org.freedesktop.NetworkManager.Device.Generic"/>
+ <allow send_destination="org.freedesktop.NetworkManager"
+ send_interface="org.freedesktop.NetworkManager.Device.Gre"/>
+ <allow send_destination="org.freedesktop.NetworkManager"
+ send_interface="org.freedesktop.NetworkManager.Device.Infiniband"/>
+ <allow send_destination="org.freedesktop.NetworkManager"
+ send_interface="org.freedesktop.NetworkManager.Device.Macvlan"/>
+ <allow send_destination="org.freedesktop.NetworkManager"
+ send_interface="org.freedesktop.NetworkManager.Device.Modem"/>
+ <allow send_destination="org.freedesktop.NetworkManager"
+ send_interface="org.freedesktop.NetworkManager.Device.OlpcMesh"/>
+ <allow send_destination="org.freedesktop.NetworkManager"
+ send_interface="org.freedesktop.NetworkManager.Device.Team"/>
+ <allow send_destination="org.freedesktop.NetworkManager"
+ send_interface="org.freedesktop.NetworkManager.Device.Tun"/>
+ <allow send_destination="org.freedesktop.NetworkManager"
+ send_interface="org.freedesktop.NetworkManager.Device.Veth"/>
+ <allow send_destination="org.freedesktop.NetworkManager"
+ send_interface="org.freedesktop.NetworkManager.Device.Vlan"/>
+ <allow send_destination="org.freedesktop.NetworkManager"
+ send_interface="org.freedesktop.NetworkManager.WiMax.Nsp"/>
+ <allow send_destination="org.freedesktop.NetworkManager"
+ send_interface="org.freedesktop.NetworkManager.AccessPoint"/>
+ <!-- Devices (read-only, no security required) -->
<allow send_destination="org.freedesktop.NetworkManager"
- send_interface="org.freedesktop.NetworkManager.Device.Serial"/>
+ send_interface="org.freedesktop.NetworkManager.Device.WiMax"/>
+ <!-- Devices (read/write, secured with PolicyKit) -->
<allow send_destination="org.freedesktop.NetworkManager"
send_interface="org.freedesktop.NetworkManager.Device.Wireless"/>
-
<allow send_destination="org.freedesktop.NetworkManager"
send_interface="org.freedesktop.NetworkManager.Device"/>
+ <!-- Core stuff (read-only properties, no methods) -->
+ <allow send_destination="org.freedesktop.NetworkManager"
+ send_interface="org.freedesktop.NetworkManager.Connection.Active"/>
<allow send_destination="org.freedesktop.NetworkManager"
send_interface="org.freedesktop.NetworkManager.DHCP4Config"/>
-
+ <allow send_destination="org.freedesktop.NetworkManager"
+ send_interface="org.freedesktop.NetworkManager.DHCP6Config"/>
<allow send_destination="org.freedesktop.NetworkManager"
send_interface="org.freedesktop.NetworkManager.IP4Config"/>
-
+ <allow send_destination="org.freedesktop.NetworkManager"
+ send_interface="org.freedesktop.NetworkManager.IP6Config"/>
<allow send_destination="org.freedesktop.NetworkManager"
send_interface="org.freedesktop.NetworkManager.VPN.Connection"/>
+ <!-- Core stuff (read/write, secured with PolicyKit) -->
<allow send_destination="org.freedesktop.NetworkManager"
- send_interface="org.freedesktop.NetworkManager.AgentManager"/>
-
- <deny send_destination="org.freedesktop.NetworkManager"
- send_interface="org.freedesktop.NetworkManager"
- send_member="SetLogging"/>
-
- <deny send_destination="org.freedesktop.NetworkManager"
- send_interface="org.freedesktop.NetworkManager"
- send_member="Sleep"/>
-
- <deny send_destination="org.freedesktop.NetworkManager"
- send_interface="org.freedesktop.NetworkManager"
- send_member="sleep"/>
-
- <deny send_destination="org.freedesktop.NetworkManager"
- send_interface="org.freedesktop.NetworkManager"
- send_member="wake"/>
- </policy>
- <policy context="default">
- <deny own="org.freedesktop.NetworkManager"/>
-
- <deny send_destination="org.freedesktop.NetworkManager"/>
-
+ send_interface="org.freedesktop.NetworkManager"/>
<allow send_destination="org.freedesktop.NetworkManager"
send_interface="org.freedesktop.NetworkManager.Settings"/>
+ <allow send_destination="org.freedesktop.NetworkManager"
+ send_interface="org.freedesktop.NetworkManager.Settings.Connection"/>
+ <!-- Agents; secured with PolicyKit. Any process can talk to
+ the AgentManager API, but only NetworkManager can talk
+ to the agents themselves. -->
<allow send_destination="org.freedesktop.NetworkManager"
send_interface="org.freedesktop.NetworkManager.AgentManager"/>
-
- <deny send_destination="org.freedesktop.NetworkManager"
- send_interface="org.freedesktop.NetworkManager"
- send_member="SetLogging"/>
-
- <deny send_destination="org.freedesktop.NetworkManager"
- send_interface="org.freedesktop.NetworkManager"
- send_member="Sleep"/>
-
- <deny send_destination="org.freedesktop.NetworkManager"
- send_interface="org.freedesktop.NetworkManager"
- send_member="sleep"/>
-
- <deny send_destination="org.freedesktop.NetworkManager"
- send_interface="org.freedesktop.NetworkManager"
- send_member="wake"/>
+ <deny send_interface="org.freedesktop.NetworkManager.SecretAgent"/>
+
+ <!-- Root-only functions -->
+ <deny send_interface="org.freedesktop.NetworkManager" send_member="SetLogging"/>
+ <deny send_interface="org.freedesktop.NetworkManager" send_member="Sleep"/>
+ <deny send_interface="org.freedesktop.NetworkManager.Settings" send_member="LoadConnections"/>
+ <deny send_interface="org.freedesktop.NetworkManager.Settings" send_member="ReloadConnections"/>
+ <deny send_interface="org.freedesktop.NetworkManager.VPN.Plugin"/>
+ <deny send_interface="org.freedesktop.NetworkManager.PPP"/>
</policy>
</busconfig>