From: Lukasz Wojciechowski <l.wojciechow@partner.samsung.com>
Date: Fri, 15 May 2015 07:49:48 +0000 (+0200)
Subject: Apply cynara security checks on DBUS interface
X-Git-Tag: submit/tizen/20150907.114932^0
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=b7e16c1c6319439d0a307d3a909a3255b4423f3c;p=platform%2Fcore%2Fconnectivity%2Fnet-config.git

Apply cynara security checks on DBUS interface

Configured access:
* full access for root user
* cynara checks in all other cases:
    * allinterfaces of net.netconfig needs "http://tizen.org/privilege/network.set"
    * with exception for Get* methods on net.netconfig.network_statistics interface for which
      "http://tizen.org/privilege/network.get" is enough.

Change-Id: I7ca8551afaddad32c79e8fa05c06f6bc74b40705
---

diff --git a/resources/etc/dbus-1/system.d/net-config.conf b/resources/etc/dbus-1/system.d/net-config.conf
index 5b15ee0..67d2760 100644
--- a/resources/etc/dbus-1/system.d/net-config.conf
+++ b/resources/etc/dbus-1/system.d/net-config.conf
@@ -1,24 +1,15 @@
 <!DOCTYPE busconfig PUBLIC "-//freedesktop//DTD D-BUS Bus Configuration 1.0//EN"
 	"http://www.freedesktop.org/standards/dbus/1.0/busconfig.dtd">
 <busconfig>
-	<policy user="0">
+	<policy user="root">
 		<allow own="net.netconfig"/>
 		<allow send_destination="net.netconfig"/>
-		<allow send_interface="net.netconfig.network"/>
-		<allow send_interface="net.netconfig.wifi"/>
-		<allow send_interface="net.netconfig.wifi.Firmware"/>
-	</policy>
-	<policy user="5000">
-		<allow own="net.netconfig"/>
-		<allow send_destination="net.netconfig"/>
-		<allow send_interface="net.netconfig.network"/>
-		<allow send_interface="net.netconfig.wifi"/>
-		<allow send_interface="net.netconfig.wifi.Firmware"/>
-	</policy>
-	<policy at_console="true">
-		<allow send_destination="net.netconfig"/>
 	</policy>
 	<policy context="default">
-		<deny send_destination="net.netconfig"/>
+		<check send_destination="net.netconfig" privilege="http://tizen.org/privilege/network.set" />
+		<check send_destination="net.netconfig" send_interface="net.netconfig.network_statistics" send_member="GetWifiTotalTxBytes" privilege="http://tizen.org/privilege/network.get" />
+		<check send_destination="net.netconfig" send_interface="net.netconfig.network_statistics" send_member="GetWifiTotalRxBytes" privilege="http://tizen.org/privilege/network.get" />
+		<check send_destination="net.netconfig" send_interface="net.netconfig.network_statistics" send_member="GetWifiLastTxBytes" privilege="http://tizen.org/privilege/network.get" />
+		<check send_destination="net.netconfig" send_interface="net.netconfig.network_statistics" send_member="GetWifiLastRxBytes" privilege="http://tizen.org/privilege/network.get" />
 	</policy>
 </busconfig>