Revert "Perform Cynara runtime policy checks by default"

This reverts commit e8610297cf7031e94eb314a2e8c11246f4405403.

Change-Id: Ifb60464c705f5b4e92f02f9e809d23e982d31c3d
Signed-off-by: Lukasz Skalski <l.skalski@samsung.com>

diff --git a/bus/session.conf.in b/bus/session.conf.in
index fa5c232..74d9d1f 100644 (file)
--- a/bus/session.conf.in
+++ b/bus/session.conf.in
@@ -17,32 +17,12 @@
   <standard_session_servicedirs />
 
   <policy context="default">
-    <!-- By default clients require internal/dbus privilege to communicate
-         with D-Bus services and to claim name ownership. This is internal privilege that
-         is only accessible to trusted system services -->
-    <check own="*"                  privilege="http://tizen.org/privilege/internal/dbus" />
-    <check send_type="method_call"  privilege="http://tizen.org/privilege/internal/dbus" />
-    <check send_type="signal"       privilege="http://tizen.org/privilege/internal/dbus" />
-    <check receive_type="signal"    privilege="http://tizen.org/privilege/internal/dbus" />
-
-    <!-- Reply messages (method returns, errors) are allowed
-         by default -->
-    <allow send_requested_reply="true" send_type="method_return"/>
-    <allow send_requested_reply="true" send_type="error"/>
-
-    <!-- All messages but signals may be received by default -->
-    <allow receive_type="method_call"/>
-    <allow receive_type="method_return"/>
-    <allow receive_type="error"/>
-
-    <!-- Allow anyone to talk to the message bus -->
-    <allow send_destination="org.freedesktop.DBus"/>
-    <allow receive_sender="org.freedesktop.DBus"/>
-
-    <!-- But disallow some specific bus services -->
-    <deny send_destination="org.freedesktop.DBus"
-          send_interface="org.freedesktop.DBus"
-          send_member="UpdateActivationEnvironment"/>
+    <!-- Allow everything to be sent -->
+    <allow send_destination="*" eavesdrop="true"/>
+    <!-- Allow everything to be received -->
+    <allow eavesdrop="true"/>
+    <!-- Allow anyone to own anything -->
+    <allow own="*"/>
   </policy>
 
   <!-- Config files are placed here that among other things, 

diff --git a/bus/system.conf.in b/bus/system.conf.in
index dd16947..92f4cc4 100644 (file)
--- a/bus/system.conf.in
+++ b/bus/system.conf.in
@@ -50,31 +50,21 @@
     <deny own="*"/>
     <deny send_type="method_call"/>
 
-    <!-- By default clients require internal/dbus privilege to send and receive signaks.
-         This is internal privilege that is only accessible to trusted system services -->
-    <check send_type="signal"       privilege="http://tizen.org/privilege/internal/dbus" />
-    <check receive_type="signal"    privilege="http://tizen.org/privilege/internal/dbus" />
-
-    <!-- Reply messages (method returns, errors) are allowed
+    <!-- Signals and reply messages (method returns, errors) are allowed
          by default -->
+    <allow send_type="signal"/>
     <allow send_requested_reply="true" send_type="method_return"/>
     <allow send_requested_reply="true" send_type="error"/>
 
-    <!-- All messages but signals may be received by default -->
+    <!-- All messages may be received by default -->
     <allow receive_type="method_call"/>
     <allow receive_type="method_return"/>
     <allow receive_type="error"/>
+    <allow receive_type="signal"/>
 
-    <!-- If there is a need specific bus services could be protected by Cynara as well.
-         However, this can lead to deadlock during the boot process when such check is made and
-         Cynara is not yet activated (systemd calls protected method synchronously,
-         dbus daemon tries to consult Cynara, Cynara waits for systemd activation).
-         Therefore it is advised to allow root processes to use bus services.
-         Currently anyone is allowed to talk to the message bus -->
+    <!-- Allow anyone to talk to the message bus -->
     <allow send_destination="org.freedesktop.DBus"/>
-    <allow receive_sender="org.freedesktop.DBus"/>
-
-    <!-- Disallow some specific bus services -->
+    <!-- But disallow some specific bus services -->
     <deny send_destination="org.freedesktop.DBus"
           send_interface="org.freedesktop.DBus"
           send_member="UpdateActivationEnvironment"/>