policy: add <check> element

The new <check> element is almost the same as <allow> and <deny>. The
difference is that it has an additional "privilege" parameter which
will be tested at runtime. Depending on the outcome of the check, the
rule turns into an allow or deny rule.

Executing these checks will be implemented separately. At the moment,
a <check> is basically the same as <deny>.

The representation of a rule grows by one additional pointer and needs
one additional bit to represent <check> in addition to <allow>/<deny>.
Reordering elements might mitigate this effect.

Change-Id: I25baa802fdf41413a78200273c3a0b17ae7f1cfa

diff --git a/bus/config-parser-common.c b/bus/config-parser-common.c
index 5db6b2891f8cf3714dac2d2577c8615bffff1609..ea25f5e6f122ed9042277b6ad3e114f2b5280c39 100644 (file)
--- a/bus/config-parser-common.c
+++ b/bus/config-parser-common.c
@@ -75,6 +75,10 @@ bus_config_parser_element_name_to_type (const char *name)
     {
       return ELEMENT_DENY;
     }
+  else if (strcmp (name, "check") == 0)
+    {
+      return ELEMENT_CHECK;
+    }
   else if (strcmp (name, "servicehelper") == 0)
     {
       return ELEMENT_SERVICEHELPER;
@@ -159,6 +163,8 @@ bus_config_parser_element_type_to_name (ElementType type)
       return "allow";
     case ELEMENT_DENY:
       return "deny";
+    case ELEMENT_CHECK:
+      return "check";
     case ELEMENT_FORK:
       return "fork";
     case ELEMENT_PIDFILE:

diff --git a/bus/config-parser-common.h b/bus/config-parser-common.h
index 382a0141fe48716b9f5ca6fed4b2722a8b1bec57..9e026d1019739712e7f8a9fc9049647be16227ec 100644 (file)
--- a/bus/config-parser-common.h
+++ b/bus/config-parser-common.h
@@ -36,6 +36,7 @@ typedef enum
   ELEMENT_LIMIT,
   ELEMENT_ALLOW,
   ELEMENT_DENY,
+  ELEMENT_CHECK,
   ELEMENT_FORK,
   ELEMENT_PIDFILE,
   ELEMENT_SERVICEDIR,

diff --git a/bus/config-parser.c b/bus/config-parser.c
index 80ba9e738fb95e1c531297554225f96f20a909a3..208f65b155b3edbad195c82812608b36d02df4aa 100644 (file)
--- a/bus/config-parser.c
+++ b/bus/config-parser.c
@@ -1186,7 +1186,7 @@ append_rule_from_element (BusConfigParser   *parser,
                           const char        *element_name,
                           const char       **attribute_names,
                           const char       **attribute_values,
-                          dbus_bool_t        allow,
+                          BusPolicyRuleAccess access,
                           DBusError         *error)
 {
   const char *log;
@@ -1209,6 +1209,7 @@ append_rule_from_element (BusConfigParser   *parser,
   const char *own_prefix;
   const char *user;
   const char *group;
+  const char *privilege;
 
   BusPolicyRule *rule;
   
@@ -1236,6 +1237,7 @@ append_rule_from_element (BusConfigParser   *parser,
                           "user", &user,
                           "group", &group,
                           "log", &log,
+                          "privilege", &privilege,
                           NULL))
     return FALSE;
 
@@ -1244,6 +1246,7 @@ append_rule_from_element (BusConfigParser   *parser,
         receive_interface || receive_member || receive_error || receive_sender ||
         receive_type || receive_path || eavesdrop ||
         send_requested_reply || receive_requested_reply ||
+        privilege ||
         own || own_prefix || user || group))
     {
       dbus_set_error (error, DBUS_ERROR_FAILED,
@@ -1260,7 +1263,30 @@ append_rule_from_element (BusConfigParser   *parser,
                       element_name);
       return FALSE;
     }
-  
+
+  if (access == BUS_POLICY_RULE_ACCESS_CHECK)
+    {
+      if (privilege == NULL || !*privilege)
+        {
+          dbus_set_error (error, DBUS_ERROR_FAILED,
+                          "On element <%s>, you must specify the privilege to be checked.",
+                          element_name);
+          return FALSE;
+        }
+    }
+  else
+    {
+      if (privilege != NULL && *privilege)
+        {
+          dbus_set_error (error, DBUS_ERROR_FAILED,
+                          "On element <%s>, privilege %s is used outside of a check rule.",
+                          element_name, privilege);
+          return FALSE;
+        }
+      else
+        privilege = NULL; /* replace (potentially) empty string with NULL pointer, it wouldn't be used anyway */
+    }
+
   /* Allowed combinations of elements are:
    *
    *   base, must be all send or all receive:
@@ -1434,7 +1460,7 @@ append_rule_from_element (BusConfigParser   *parser,
           return FALSE;
         }
       
-      rule = bus_policy_rule_new (BUS_POLICY_RULE_SEND, allow); 
+      rule = bus_policy_rule_new (BUS_POLICY_RULE_SEND, access);
       if (rule == NULL)
         goto nomem;
       
@@ -1516,7 +1542,7 @@ append_rule_from_element (BusConfigParser   *parser,
           return FALSE;
         }
       
-      rule = bus_policy_rule_new (BUS_POLICY_RULE_RECEIVE, allow); 
+      rule = bus_policy_rule_new (BUS_POLICY_RULE_RECEIVE, access);
       if (rule == NULL)
         goto nomem;
 
@@ -1546,7 +1572,7 @@ append_rule_from_element (BusConfigParser   *parser,
     }
   else if (own || own_prefix)
     {
-      rule = bus_policy_rule_new (BUS_POLICY_RULE_OWN, allow); 
+      rule = bus_policy_rule_new (BUS_POLICY_RULE_OWN, access);
       if (rule == NULL)
         goto nomem;
 
@@ -1572,7 +1598,7 @@ append_rule_from_element (BusConfigParser   *parser,
     {      
       if (IS_WILDCARD (user))
         {
-          rule = bus_policy_rule_new (BUS_POLICY_RULE_USER, allow); 
+          rule = bus_policy_rule_new (BUS_POLICY_RULE_USER, access);
           if (rule == NULL)
             goto nomem;
 
@@ -1587,7 +1613,7 @@ append_rule_from_element (BusConfigParser   *parser,
       
           if (_dbus_parse_unix_user_from_config (&username, &uid))
             {
-              rule = bus_policy_rule_new (BUS_POLICY_RULE_USER, allow); 
+              rule = bus_policy_rule_new (BUS_POLICY_RULE_USER, access);
               if (rule == NULL)
                 goto nomem;
 
@@ -1604,7 +1630,7 @@ append_rule_from_element (BusConfigParser   *parser,
     {
       if (IS_WILDCARD (group))
         {
-          rule = bus_policy_rule_new (BUS_POLICY_RULE_GROUP, allow); 
+          rule = bus_policy_rule_new (BUS_POLICY_RULE_GROUP, access);
           if (rule == NULL)
             goto nomem;
 
@@ -1619,7 +1645,7 @@ append_rule_from_element (BusConfigParser   *parser,
           
           if (_dbus_parse_unix_group_from_config (&groupname, &gid))
             {
-              rule = bus_policy_rule_new (BUS_POLICY_RULE_GROUP, allow); 
+              rule = bus_policy_rule_new (BUS_POLICY_RULE_GROUP, access);
               if (rule == NULL)
                 goto nomem;
 
@@ -1643,6 +1669,10 @@ append_rule_from_element (BusConfigParser   *parser,
       _dbus_assert (pe != NULL);
       _dbus_assert (pe->type == ELEMENT_POLICY);
 
+      rule->privilege = _dbus_strdup (privilege);
+      if (privilege && !rule->privilege)
+        goto nomem;
+
       switch (pe->d.policy.type)
         {
         case POLICY_IGNORED:
@@ -1719,7 +1749,7 @@ start_policy_child (BusConfigParser   *parser,
     {
       if (!append_rule_from_element (parser, element_name,
                                      attribute_names, attribute_values,
-                                     TRUE, error))
+                                     BUS_POLICY_RULE_ACCESS_ALLOW, error))
         return FALSE;
       
       if (push_element (parser, ELEMENT_ALLOW) == NULL)
@@ -1734,7 +1764,7 @@ start_policy_child (BusConfigParser   *parser,
     {
       if (!append_rule_from_element (parser, element_name,
                                      attribute_names, attribute_values,
-                                     FALSE, error))
+                                     BUS_POLICY_RULE_ACCESS_DENY, error))
         return FALSE;
       
       if (push_element (parser, ELEMENT_DENY) == NULL)
@@ -1743,6 +1773,21 @@ start_policy_child (BusConfigParser   *parser,
           return FALSE;
         }
       
+      return TRUE;
+    }
+  else if (strcmp (element_name, "check") == 0)
+    {
+      if (!append_rule_from_element (parser, element_name,
+                                     attribute_names, attribute_values,
+                                     BUS_POLICY_RULE_ACCESS_CHECK, error))
+        return FALSE;
+
+      if (push_element (parser, ELEMENT_CHECK) == NULL)
+        {
+          BUS_SET_OOM (error);
+          return FALSE;
+        }
+
       return TRUE;
     }
   else
@@ -2104,6 +2149,7 @@ bus_config_parser_end_element (BusConfigParser   *parser,
     case ELEMENT_POLICY:
     case ELEMENT_ALLOW:
     case ELEMENT_DENY:
+    case ELEMENT_CHECK:
     case ELEMENT_FORK:
     case ELEMENT_SYSLOG:
     case ELEMENT_KEEP_UMASK:
@@ -2413,6 +2459,7 @@ bus_config_parser_content (BusConfigParser   *parser,
     case ELEMENT_POLICY:
     case ELEMENT_ALLOW:
     case ELEMENT_DENY:
+    case ELEMENT_CHECK:
     case ELEMENT_FORK:
     case ELEMENT_SYSLOG:
     case ELEMENT_KEEP_UMASK:
@@ -2878,6 +2925,8 @@ do_load (const DBusString *full_path,
   dbus_error_init (&error);
 
   parser = bus_config_load (full_path, TRUE, NULL, &error);
+  if (dbus_error_is_set (&error))
+    _dbus_verbose ("Failed to load file: %s\n", error.message);
   if (parser == NULL)
     {
       _DBUS_ASSERT_ERROR_IS_SET (&error);

diff --git a/bus/policy.c b/bus/policy.c
index 567d3c136eedbaea4b23731a87e87f9be7c3d3f4..5af5b6b3d883175fc444742098dfe199c358bd58 100644 (file)
--- a/bus/policy.c
+++ b/bus/policy.c
@@ -33,7 +33,7 @@
 
 BusPolicyRule*
 bus_policy_rule_new (BusPolicyRuleType type,
-                     dbus_bool_t       allow)
+                     BusPolicyRuleAccess access)
 {
   BusPolicyRule *rule;
 
@@ -43,7 +43,7 @@ bus_policy_rule_new (BusPolicyRuleType type,
 
   rule->type = type;
   rule->refcount = 1;
-  rule->allow = allow;
+  rule->access = access;
 
   switch (rule->type)
     {
@@ -55,18 +55,19 @@ bus_policy_rule_new (BusPolicyRuleType type,
       break;
     case BUS_POLICY_RULE_SEND:
       rule->d.send.message_type = DBUS_MESSAGE_TYPE_INVALID;
-
       /* allow rules default to TRUE (only requested replies allowed)
+       * check rules default to TRUE (only requested replies are checked)
        * deny rules default to FALSE (only unrequested replies denied)
        */
-      rule->d.send.requested_reply = rule->allow;
+      rule->d.send.requested_reply = rule->access != BUS_POLICY_RULE_ACCESS_DENY;
       break;
     case BUS_POLICY_RULE_RECEIVE:
       rule->d.receive.message_type = DBUS_MESSAGE_TYPE_INVALID;
       /* allow rules default to TRUE (only requested replies allowed)
+       * check rules default to TRUE (only requested replies are checked)
        * deny rules default to FALSE (only unrequested replies denied)
        */
-      rule->d.receive.requested_reply = rule->allow;
+      rule->d.receive.requested_reply = rule->access != BUS_POLICY_RULE_ACCESS_DENY;
       break;
     case BUS_POLICY_RULE_OWN:
       break;
@@ -118,7 +119,8 @@ bus_policy_rule_unref (BusPolicyRule *rule)
         case BUS_POLICY_RULE_GROUP:
           break;
         }
-      
+
+      dbus_free (rule->privilege);
       dbus_free (rule);
     }
 }
@@ -461,7 +463,10 @@ list_allows_user (dbus_bool_t           def,
       else
         continue;
 
-      allowed = rule->allow;
+      /* We don't intend to support <check user="..." /> and <check group="..." />
+         rules. They are treated like deny.
+      */
+      allowed = rule->access == BUS_POLICY_RULE_ACCESS_ALLOW;
     }
   
   return allowed;
@@ -1037,13 +1042,14 @@ bus_client_policy_check_can_send (BusClientPolicy *policy,
       /* If it's a reply, the requested_reply flag kicks in */
       if (dbus_message_get_reply_serial (message) != 0)
         {
-          /* for allow, requested_reply=true means the rule applies
-           * only when reply was requested. requested_reply=false means
-           * always allow.
+          /* for allow or check requested_reply=true means the rule applies
+           * only when reply was requested. requested_reply=false means the
+           * rule always applies
            */
-          if (!requested_reply && rule->allow && rule->d.send.requested_reply && !rule->d.send.eavesdrop)
+          if (!requested_reply && rule->access != BUS_POLICY_RULE_ACCESS_DENY && rule->d.send.requested_reply && !rule->d.send.eavesdrop)
             {
-              _dbus_verbose ("  (policy) skipping allow rule since it only applies to requested replies and does not allow eavesdropping\n");
+              _dbus_verbose ("  (policy) skipping %s rule since it only applies to requested replies and does not allow eavesdropping\n",
+                  rule->access == BUS_POLICY_RULE_ACCESS_ALLOW ? "allow" : "check");
               continue;
             }
 
@@ -1051,7 +1057,7 @@ bus_client_policy_check_can_send (BusClientPolicy *policy,
            * when the reply was not requested. requested_reply=true means the
            * rule always applies.
            */
-          if (requested_reply && !rule->allow && !rule->d.send.requested_reply)
+          if (requested_reply && rule->access == BUS_POLICY_RULE_ACCESS_DENY && !rule->d.send.requested_reply)
             {
               _dbus_verbose ("  (policy) skipping deny rule since it only applies to unrequested replies\n");
               continue;
@@ -1074,13 +1080,15 @@ bus_client_policy_check_can_send (BusClientPolicy *policy,
           /* The interface is optional in messages. For allow rules, if the message
            * has no interface we want to skip the rule (and thus not allow);
            * for deny rules, if the message has no interface we want to use the
-           * rule (and thus deny).
+           * rule (and thus deny). Check rules are meant to be used like allow
+           * rules (they can grant access, but not remove it), so we treat it like
+           * allow here.
            */
           dbus_bool_t no_interface;
 
           no_interface = dbus_message_get_interface (message) == NULL;
           
-          if ((no_interface && rule->allow) ||
+          if ((no_interface && rule->access != BUS_POLICY_RULE_ACCESS_DENY) ||
               (!no_interface && 
                strcmp (dbus_message_get_interface (message),
                        rule->d.send.interface) != 0))
@@ -1154,7 +1162,7 @@ bus_client_policy_check_can_send (BusClientPolicy *policy,
         }
 
       /* Use this rule */
-      allowed = rule->allow;
+      allowed = rule->access == BUS_POLICY_RULE_ACCESS_ALLOW;
       *log = rule->d.send.log;
       (*toggles)++;
 
@@ -1216,19 +1224,21 @@ bus_client_policy_check_can_receive (BusClientPolicy *policy,
             }
         }
 
-      /* for allow, eavesdrop=false means the rule doesn't apply when
-       * eavesdropping. eavesdrop=true means always allow.
+
+      /* for allow or check, eavesdrop=false means the rule doesn't apply when
+       * eavesdropping. eavesdrop=true means the rule always applies
        */
-      if (eavesdropping && rule->allow && !rule->d.receive.eavesdrop)
+      if (eavesdropping && rule->access != BUS_POLICY_RULE_ACCESS_DENY && !rule->d.receive.eavesdrop)
         {
-          _dbus_verbose ("  (policy) skipping allow rule since it doesn't apply to eavesdropping\n");
+          _dbus_verbose ("  (policy) skipping %s rule since it doesn't apply to eavesdropping\n",
+              rule->access == BUS_POLICY_RULE_ACCESS_ALLOW ? "allow" : "check");
           continue;
         }
 
       /* for deny, eavesdrop=true means the rule applies only when
        * eavesdropping; eavesdrop=false means always deny.
        */
-      if (!eavesdropping && !rule->allow && rule->d.receive.eavesdrop)
+      if (!eavesdropping && rule->access == BUS_POLICY_RULE_ACCESS_DENY && rule->d.receive.eavesdrop)
         {
           _dbus_verbose ("  (policy) skipping deny rule since it only applies to eavesdropping\n");
           continue;
@@ -1237,13 +1247,14 @@ bus_client_policy_check_can_receive (BusClientPolicy *policy,
       /* If it's a reply, the requested_reply flag kicks in */
       if (dbus_message_get_reply_serial (message) != 0)
         {
-          /* for allow, requested_reply=true means the rule applies
-           * only when reply was requested. requested_reply=false means
-           * always allow.
+          /* for allow or check requested_reply=true means the rule applies
+           * only when reply was requested. requested_reply=false means the
+           * rule always applies
            */
-          if (!requested_reply && rule->allow && rule->d.receive.requested_reply && !rule->d.receive.eavesdrop)
+          if (!requested_reply && rule->access != BUS_POLICY_RULE_ACCESS_DENY && rule->d.send.requested_reply && !rule->d.send.eavesdrop)
             {
-              _dbus_verbose ("  (policy) skipping allow rule since it only applies to requested replies and does not allow eavesdropping\n");
+              _dbus_verbose ("  (policy) skipping %s rule since it only applies to requested replies and does not allow eavesdropping\n",
+                  rule->access == BUS_POLICY_RULE_ACCESS_DENY ? "allow" : "deny");
               continue;
             }
 
@@ -1251,7 +1262,7 @@ bus_client_policy_check_can_receive (BusClientPolicy *policy,
            * when the reply was not requested. requested_reply=true means the
            * rule always applies.
            */
-          if (requested_reply && !rule->allow && !rule->d.receive.requested_reply)
+          if (requested_reply && rule->access == BUS_POLICY_RULE_ACCESS_DENY && !rule->d.receive.requested_reply)
             {
               _dbus_verbose ("  (policy) skipping deny rule since it only applies to unrequested replies\n");
               continue;
@@ -1274,13 +1285,13 @@ bus_client_policy_check_can_receive (BusClientPolicy *policy,
           /* The interface is optional in messages. For allow rules, if the message
            * has no interface we want to skip the rule (and thus not allow);
            * for deny rules, if the message has no interface we want to use the
-           * rule (and thus deny).
+           * rule (and thus deny). Check rules are treated like allow rules.
            */
           dbus_bool_t no_interface;
 
           no_interface = dbus_message_get_interface (message) == NULL;
           
-          if ((no_interface && rule->allow) ||
+          if ((no_interface && rule->access != BUS_POLICY_RULE_ACCESS_DENY) ||
               (!no_interface &&
                strcmp (dbus_message_get_interface (message),
                        rule->d.receive.interface) != 0))
@@ -1355,7 +1366,7 @@ bus_client_policy_check_can_receive (BusClientPolicy *policy,
         }
       
       /* Use this rule */
-      allowed = rule->allow;
+      allowed = rule->access == BUS_POLICY_RULE_ACCESS_ALLOW;
       (*toggles)++;
 
       _dbus_verbose ("  (policy) used rule, allow now = %d\n",
@@ -1414,7 +1425,7 @@ bus_rules_check_can_own (DBusList *rules,
         }
 
       /* Use this rule */
-      allowed = rule->allow;
+      allowed = rule->access == BUS_POLICY_RULE_ACCESS_ALLOW;
     }
 
   return allowed;

diff --git a/bus/policy.h b/bus/policy.h
index effa2c647b07f2898299595f8566bd0a791b6bef..fd66bcb53df86862700d254b2a70dce89fb7ff52 100644 (file)
--- a/bus/policy.h
+++ b/bus/policy.h
@@ -39,6 +39,14 @@ typedef enum
   BUS_POLICY_RULE_GROUP
 } BusPolicyRuleType;
 
+typedef enum
+{
+  BUS_POLICY_RULE_ACCESS_DENY,
+  BUS_POLICY_RULE_ACCESS_ALLOW,
+  /** runtime check resulting in allow or deny */
+  BUS_POLICY_RULE_ACCESS_CHECK
+} BusPolicyRuleAccess;
+
 /** determines whether the rule affects a connection, or some global item */
 #define BUS_POLICY_RULE_IS_PER_CLIENT(rule) (!((rule)->type == BUS_POLICY_RULE_USER || \
                                                (rule)->type == BUS_POLICY_RULE_GROUP))
@@ -49,8 +57,9 @@ struct BusPolicyRule
   
   BusPolicyRuleType type;
 
-  unsigned int allow : 1; /**< #TRUE if this allows, #FALSE if it denies */
-  
+  unsigned int access : 2; /**< BusPolicyRuleAccess */
+  char *privilege; /**< for BUS_POLICY_RULE_ACCESS_CHECK */
+
   union
   {
     struct
@@ -106,7 +115,7 @@ struct BusPolicyRule
 };
 
 BusPolicyRule* bus_policy_rule_new   (BusPolicyRuleType type,
-                                      dbus_bool_t       allow);
+                                      BusPolicyRuleAccess access);
 BusPolicyRule* bus_policy_rule_ref   (BusPolicyRule    *rule);
 void           bus_policy_rule_unref (BusPolicyRule    *rule);
 

diff --git a/configure.ac b/configure.ac
index 5fca17b8d98cfedde5ac7cc1c05f29accb7159c3..1361b280024eed45733436ee61987f2284ecd15c 100644 (file)
--- a/configure.ac
+++ b/configure.ac
@@ -1915,6 +1915,25 @@ doc/dbus-update-activation-environment.1.xml
 doc/dbus-uuidgen.1.xml
 dbus-1.pc
 dbus-1-uninstalled.pc
+test/data/valid-config-files/debug-allow-all.conf
+test/data/valid-config-files/debug-allow-all-sha1.conf
+test/data/valid-config-files/debug-check-some.conf
+test/data/valid-config-files/incoming-limit.conf
+test/data/valid-config-files-system/debug-allow-all-pass.conf
+test/data/valid-config-files-system/debug-allow-all-fail.conf
+test/data/valid-service-files/org.freedesktop.DBus.TestSuite.PrivServer.service
+test/data/valid-service-files/org.freedesktop.DBus.TestSuiteEchoService.service
+test/data/valid-service-files/org.freedesktop.DBus.TestSuiteForkingEchoService.service
+test/data/valid-service-files/org.freedesktop.DBus.TestSuiteSegfaultService.service
+test/data/valid-service-files/org.freedesktop.DBus.TestSuiteShellEchoServiceSuccess.service
+test/data/valid-service-files/org.freedesktop.DBus.TestSuiteShellEchoServiceFail.service
+test/data/valid-service-files-system/org.freedesktop.DBus.TestSuiteEchoService.service
+test/data/valid-service-files-system/org.freedesktop.DBus.TestSuiteSegfaultService.service
+test/data/valid-service-files-system/org.freedesktop.DBus.TestSuiteShellEchoServiceSuccess.service
+test/data/valid-service-files-system/org.freedesktop.DBus.TestSuiteShellEchoServiceFail.service
+test/data/invalid-service-files-system/org.freedesktop.DBus.TestSuiteNoExec.service
+test/data/invalid-service-files-system/org.freedesktop.DBus.TestSuiteNoUser.service
+test/data/invalid-service-files-system/org.freedesktop.DBus.TestSuiteNoService.service
 ])
 AC_OUTPUT
 

diff --git a/test/Makefile.am b/test/Makefile.am
index b7f40bb01dd625a2c07c2abbf4ad0a79c1853692..1f4c8fe77c50b4c43730548b3243096fe3f7bb44 100644 (file)
--- a/test/Makefile.am
+++ b/test/Makefile.am
@@ -304,6 +304,7 @@ in_data = \
        data/valid-config-files/debug-allow-all.conf.in \
        data/valid-config-files/finite-timeout.conf.in \
        data/valid-config-files/forbidding.conf.in \
+       data/valid-config-files/debug-check-some.conf.in \
        data/valid-config-files/incoming-limit.conf.in \
        data/valid-config-files/multi-user.conf.in \
        data/valid-config-files/systemd-activation.conf.in \

diff --git a/test/data/invalid-config-files/badcheck-1.conf b/test/data/invalid-config-files/badcheck-1.conf
new file mode 100644 (file)
index 0000000..fad9f50
--- /dev/null
+++ b/test/data/invalid-config-files/badcheck-1.conf
@@ -0,0 +1,9 @@
+<!DOCTYPE busconfig PUBLIC "-//freedesktop//DTD D-BUS Bus Configuration 1.0//EN"
+ "http://www.freedesktop.org/standards/dbus/1.0/busconfig.dtd">
+<busconfig>
+  <user>mybususer</user>
+  <listen>unix:path=/foo/bar</listen>
+  <policy context="default">
+    <allow privilege="foo" send_destination="*"/> <!-- extra privilege="foo" -->
+  </policy>
+</busconfig>

diff --git a/test/data/invalid-config-files/badcheck-2.conf b/test/data/invalid-config-files/badcheck-2.conf
new file mode 100644 (file)
index 0000000..63c7ef2
--- /dev/null
+++ b/test/data/invalid-config-files/badcheck-2.conf
@@ -0,0 +1,9 @@
+<!DOCTYPE busconfig PUBLIC "-//freedesktop//DTD D-BUS Bus Configuration 1.0//EN"
+ "http://www.freedesktop.org/standards/dbus/1.0/busconfig.dtd">
+<busconfig>
+  <user>mybususer</user>
+  <listen>unix:path=/foo/bar</listen>
+  <policy context="default">
+    <check send_destination="*"/> <!-- missing privilege="foo" -->
+  </policy>
+</busconfig>

diff --git a/test/data/valid-config-files/check-1.conf b/test/data/valid-config-files/check-1.conf
new file mode 100644 (file)
index 0000000..ad71473
--- /dev/null
+++ b/test/data/valid-config-files/check-1.conf
@@ -0,0 +1,9 @@
+<!DOCTYPE busconfig PUBLIC "-//freedesktop//DTD D-BUS Bus Configuration 1.0//EN"
+ "http://www.freedesktop.org/standards/dbus/1.0/busconfig.dtd">
+<busconfig>
+  <user>mybususer</user>
+  <listen>unix:path=/foo/bar</listen>
+  <policy context="default">
+    <check privilege="foo" send_destination="*"/>
+  </policy>
+</busconfig>

diff --git a/test/data/valid-config-files/debug-check-some.conf.in b/test/data/valid-config-files/debug-check-some.conf.in
new file mode 100644 (file)
index 0000000..47ee854
--- /dev/null
+++ b/test/data/valid-config-files/debug-check-some.conf.in
@@ -0,0 +1,18 @@
+<!-- Bus that listens on a debug pipe and doesn't create any restrictions -->
+
+<!DOCTYPE busconfig PUBLIC "-//freedesktop//DTD D-BUS Bus Configuration 1.0//EN"
+ "http://www.freedesktop.org/standards/dbus/1.0/busconfig.dtd">
+<busconfig>
+  <listen>debug-pipe:name=test-server</listen>
+  <listen>@TEST_LISTEN@</listen>
+  <servicedir>@DBUS_TEST_DATA@/valid-service-files</servicedir>
+  <policy context="default">
+    <allow send_interface="*"/>
+    <allow receive_interface="*"/>
+    <allow own="*"/>
+    <allow user="*"/>
+
+    <deny send_interface="org.freedesktop.TestSuite" send_member="Echo"/>
+    <check privilege="foo" send_interface="org.freedesktop.TestSuite" send_member="Echo"/>
+  </policy>
+</busconfig>