policychecker: allow i-dont-need-any-name configs

This allows configurations that do not concern any owned names, e.g.
configurations for specifying who can receive some specific signals.

Without this change, the checking rules ensure that every policy
configuration file contains at least one <deny send_destination/prefix>
and one <deny own> policy rule. This was introduced when there
was "global default allow" policy in some uses. Nowadays, such policies
are probably long gone.

Anyway, there are still other checking rules present, which complain for
not having proper <deny> rules in default context, if <allow>
rules for a name are present in the configuration file.

Change-Id: Ic4eeee3ff5c8524fda58d17874fe6fdb37fb4d1c

diff --git a/policychecker/rules.xsl b/policychecker/rules.xsl
index 0d13fb9e96cdc8d8613a04ae960e4bb22e59cdbe..188a5720effaa7fe77b2997a67c214f5b2e71eac 100644 (file)
--- a/policychecker/rules.xsl
+++ b/policychecker/rules.xsl
@@ -96,16 +96,9 @@
        </sch:pattern>
        <!-- additional rule -->
        <sch:pattern name="Don't depend on global deny-own and deny-method-call">
-               <!-- TODO maybe we can guess somehow the exact dbus name? -->
                <sch:rule context="busconfig">
                        <sch:assert test="policy[@context='default']">You must provide a policy context-default section.</sch:assert>
                </sch:rule>
-               <sch:rule context="policy[@context='default']">
-                       <sch:assert test="deny[@own] or deny[@own_prefix]">You must define a 'deny own="yourname"' or 'deny own_prefix="yourname"' rule in context-default policy to avoid depending on a global 'deny own="*"'.</sch:assert>
-                       <sch:assert test="deny[@send_destination] or deny[@send_destination_prefix]">You must define a 'deny send_destination="yourname"' or 'deny send_destination_prefix="yourname"' rule in context-default policy to avoid depending on a global deny.</sch:assert>
-
-                       <!-- TODO what constraints should be made on send_destination and receive sender? -->
-               </sch:rule>
        </sch:pattern>
        <!-- -->