From e010afa3b7a0ce634ffd2e946c45ea2ba8bc4b15 Mon Sep 17 00:00:00 2001
From: Hurnjoo Lee <hurnjoo.lee@samsung.com>
Date: Wed, 29 Apr 2015 21:03:59 +0900
Subject: [PATCH] Apply D-bus service policy

* Apply D-bus service policy.
* Add privilege checks.

Change-Id: I4603e710e8aaf863bb51f0a42487fc31386080c6
Signed-off-by: Hurnjoo Lee <hurnjoo.lee@samsung.com>
---
 src/daemon/dbus/gumd-dbus.conf.in | 63 +++++++++++++++++++++++++++++++++++++--
 1 file changed, 61 insertions(+), 2 deletions(-)

diff --git a/src/daemon/dbus/gumd-dbus.conf.in b/src/daemon/dbus/gumd-dbus.conf.in
index a7266a2..c49824a 100644
--- a/src/daemon/dbus/gumd-dbus.conf.in
+++ b/src/daemon/dbus/gumd-dbus.conf.in
@@ -10,9 +10,68 @@
         <allow own="org.O1.SecurityAccounts.gUserManagement"/>
         <allow send_destination="org.O1.SecurityAccounts.gUserManagement"/>
     </policy>
-    
+
     <policy context="default">
         <deny send_destination="org.O1.SecurityAccounts.gUserManagement"/>
-    </policy>
+        <allow receive_sender="org.O1.SecurityAccounts.gUserManagement" receive_type="signal"/>
+
+        <check send_destination="org.O1.SecurityAccounts.gUserManagement"
+         send_interface="org.freedesktop.DBus.Properties" send_member="Get"
+         privilege="http://tizen.org/privilege/usermanagement.get"/>
+        <check send_destination="org.O1.SecurityAccounts.gUserManagement"
+         send_interface="org.freedesktop.DBus.Properties" send_member="GetAll"
+         privilege="http://tizen.org/privilege/usermanagement.get"/>
+        <check send_destination="org.O1.SecurityAccounts.gUserManagement"
+         send_interface="org.freedesktop.DBus.Properties" send_member="Set"
+         privilege="http://tizen.org/privilege/usermanagement.set"/>
+
+        <check send_destination="org.O1.SecurityAccounts.gUserManagement"
+         send_interface="org.O1.SecurityAccounts.gUserManagement.User" send_member="addUser"
+         privilege="http://tizen.org/privilege/usermanagement.set"/>
+        <check send_destination="org.O1.SecurityAccounts.gUserManagement"
+         send_interface="org.O1.SecurityAccounts.gUserManagement.User" send_member="deleteUser"
+         privilege="http://tizen.org/privilege/usermanagement.set"/>
+        <check send_destination="org.O1.SecurityAccounts.gUserManagement"
+         send_interface="org.O1.SecurityAccounts.gUserManagement.User" send_member="updateUser"
+         privilege="http://tizen.org/privilege/usermanagement.set"/>
 
+        <check send_destination="org.O1.SecurityAccounts.gUserManagement"
+         send_interface="org.O1.SecurityAccounts.gUserManagement.UserService" send_member="createNewUser"
+         privilege="http://tizen.org/privilege/usermanagement.set"/>
+        <check send_destination="org.O1.SecurityAccounts.gUserManagement"
+         send_interface="org.O1.SecurityAccounts.gUserManagement.UserService" send_member="getUser"
+         privilege="http://tizen.org/privilege/usermanagement.get"/>
+        <check send_destination="org.O1.SecurityAccounts.gUserManagement"
+         send_interface="org.O1.SecurityAccounts.gUserManagement.UserService" send_member="getUserByName"
+         privilege="http://tizen.org/privilege/usermanagement.get"/>
+        <check send_destination="org.O1.SecurityAccounts.gUserManagement"
+         send_interface="org.O1.SecurityAccounts.gUserManagement.UserService" send_member="getUserList"
+         privilege="http://tizen.org/privilege/usermanagement.get"/>
+
+        <check send_destination="org.O1.SecurityAccounts.gUserManagement"
+         send_interface="org.O1.SecurityAccounts.gUserManagement.Group" send_member="addGroup"
+         privilege="http://tizen.org/privilege/usermanagement.set"/>
+        <check send_destination="org.O1.SecurityAccounts.gUserManagement"
+         send_interface="org.O1.SecurityAccounts.gUserManagement.Group" send_member="deleteGroup"
+         privilege="http://tizen.org/privilege/usermanagement.set"/>
+        <check send_destination="org.O1.SecurityAccounts.gUserManagement"
+         send_interface="org.O1.SecurityAccounts.gUserManagement.Group" send_member="updateGroup"
+         privilege="http://tizen.org/privilege/usermanagement.set"/>
+        <check send_destination="org.O1.SecurityAccounts.gUserManagement"
+         send_interface="org.O1.SecurityAccounts.gUserManagement.Group" send_member="addMember"
+         privilege="http://tizen.org/privilege/usermanagement.set"/>
+        <check send_destination="org.O1.SecurityAccounts.gUserManagement"
+         send_interface="org.O1.SecurityAccounts.gUserManagement.Group" send_member="deleteMember"
+         privilege="http://tizen.org/privilege/usermanagement.set"/>
+
+        <check send_destination="org.O1.SecurityAccounts.gUserManagement"
+         send_interface="org.O1.SecurityAccounts.gUserManagement.GroupService" send_member="createNewGroup"
+         privilege="http://tizen.org/privilege/usermanagement.set"/>
+        <check send_destination="org.O1.SecurityAccounts.gUserManagement"
+         send_interface="org.O1.SecurityAccounts.gUserManagement.GroupService" send_member="getGroup"
+         privilege="http://tizen.org/privilege/usermanagement.get"/>
+        <check send_destination="org.O1.SecurityAccounts.gUserManagement"
+         send_interface="org.O1.SecurityAccounts.gUserManagement.GroupService" send_member="getGroupByName"
+         privilege="http://tizen.org/privilege/usermanagement.get"/>
+    </policy>
 </busconfig>
-- 
2.7.4