From 5aebf2a92db63c8fa0412a09433dfd9b11cb3b9b Mon Sep 17 00:00:00 2001
From: Lennart Poettering <lennart@poettering.net>
Date: Wed, 23 Aug 2006 23:04:46 +0000
Subject: - allow access to the DBUS SetHostName method only to users in the
 group "netdev" (and make that group name configurable on ./configure - bump
 version number

git-svn-id: file:///home/lennart/svn/public/avahi/trunk@1265 941a03a8-eaeb-0310-b9a0-b1bbd8fe43fe
---
 avahi-daemon/avahi-dbus.conf.in | 16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)

(limited to 'avahi-daemon')

diff --git a/avahi-daemon/avahi-dbus.conf.in b/avahi-daemon/avahi-dbus.conf.in
index 416c8dc..c570754 100644
--- a/avahi-daemon/avahi-dbus.conf.in
+++ b/avahi-daemon/avahi-dbus.conf.in
@@ -11,15 +11,17 @@
     <allow own="org.freedesktop.Avahi"/>
   </policy>
 
-  <!-- Allow anyone to invoke methods on the Manager and Device interfaces -->
+  <!-- Allow anyone to invoke methods on Avahi server, except SetHostName -->
   <policy context="default">
-    <allow send_interface="org.freedesktop.Avahi"/>
+    <allow send_destination="org.freedesktop.Avahi"/>
+    <allow receive_sender="org.freedesktop.Avahi"/>
 
-    <allow receive_interface="org.freedesktop.Avahi"
-           receive_sender="org.freedesktop.Avahi"/>
+    <deny send_interface="org.freedesktop.Avahi.Server" send_member="SetHostName"/>
   </policy>
 
-  <limit name="max_match_rules_per_connection">512</limit>
-  <limit name="max_connections_per_user">20</limit>
-
+  <!-- Allow everything, including access to SetHostName to users of the group "netdev" -->
+  <policy group="@AVAHI_PRIV_ACCESS_GROUP@">
+    <allow send_destination="org.freedesktop.Avahi"/>
+    <allow receive_sender="org.freedesktop.Avahi"/>
+  </policy>
 </busconfig>
-- 
cgit