From ff9878c95efc12d4a4495153ab51e3a09f8d3c01 Mon Sep 17 00:00:00 2001
From: Wootak Jung <wootak.jung@samsung.com>
Date: Fri, 4 May 2018 13:20:41 +0900
Subject: [PATCH] Fix privilege violations

Need to check privilege for direct method call

Change-Id: Ic3bc8f74207cf46d56e8dab66ceb13b0cc86e6f4
---
 src/bluetooth.conf | 74 +++++++++++++++++++++++++++---------------------------
 1 file changed, 37 insertions(+), 37 deletions(-)

diff --git a/src/bluetooth.conf b/src/bluetooth.conf
index c1bac97..df19910 100755
--- a/src/bluetooth.conf
+++ b/src/bluetooth.conf
@@ -65,29 +65,6 @@
     <allow send_destination="org.bluez.Profile1"/>
   </policy>
 
-  <policy users="owner">
-    <allow receive_sender="org.projectx.bluetooth"/>
-    <allow send_destination="org.projectx.bluetooth"/>
-    <allow receive_sender="org.bluez.frwk_agent"/>
-    <allow send_destination="org.bluez.frwk_agent"/>
-    <allow receive_sender="org.bluez.Agent1"/>
-    <allow send_destination="org.bluez.Agent1"/>
-    <allow receive_sender="org.bluez.Adapter1"/>
-    <allow send_destination="org.bluez.Adapter1"/>
-    <allow receive_sender="org.bluez.Manager"/>
-    <allow send_destination="org.bluez.Manager"/>
-    <allow receive_sender="org.bluez.Device1"/>
-    <allow send_destination="org.bluez.Device1"/>
-    <allow receive_sender="org.bluez.MediaEndpoint1"/>
-    <allow send_destination="org.bluez.MediaEndpoint1"/>
-    <allow receive_sender="org.bluez.MediaTransport1"/>
-    <allow send_destination="org.bluez.MediaTransport1"/>
-    <allow receive_sender="org.bluez.MediaPlayer1"/>
-    <allow send_destination="org.bluez.MediaPlayer1"/>
-    <allow receive_sender="org.bluez.Profile1"/>
-    <allow send_destination="org.bluez.Profile1"/>
-  </policy>
-
   <!-- allow users of lp group (printing subsystem) to
        communicate with bluetoothd -->
   <policy group="lp">
@@ -148,34 +125,57 @@
 
   <policy context="default">
     <deny own="org.projectx.bluetooth"/>
-    <deny receive_sender="org.projectx.bluetooth"/>
+    <allow receive_sender="org.projectx.bluetooth"/>
     <deny send_destination="org.projectx.bluetooth"/>
     <deny own="org.bluez.frwk_agent"/>
-    <deny receive_sender="org.bluez.frwk_agent"/>
+    <allow receive_sender="org.bluez.frwk_agent"/>
     <deny send_destination="org.bluez.frwk_agent"/>
     <deny own="org.bluez.Agent1"/>
-    <deny receive_sender="org.bluez.Agent1"/>
+    <allow receive_sender="org.bluez.Agent1"/>
     <deny send_destination="org.bluez.Agent1"/>
-    <deny own="org.bluez.Adapter1"/>
-    <deny receive_sender="org.bluez.Adapter1"/>
-    <deny send_destination="org.bluez.Adapter1"/>
     <deny own="org.bluez.Manager"/>
-    <deny receive_sender="org.bluez.Manager"/>
+    <allow receive_sender="org.bluez.Manager"/>
     <deny send_destination="org.bluez.Manager"/>
-    <deny own="org.bluez.Device1"/>
-    <deny receive_sender="org.bluez.Device1"/>
-    <deny send_destination="org.bluez.Device1"/>
     <deny own="org.bluez.MediaEndpoint1"/>
-    <deny receive_sender="org.bluez.MediaEndpoint1"/>
+    <allow receive_sender="org.bluez.MediaEndpoint1"/>
     <deny send_destination="org.bluez.MediaEndpoint1"/>
     <deny own="org.bluez.MediaTransport1"/>
-    <deny receive_sender="org.bluez.MediaTransport1"/>
+    <allow receive_sender="org.bluez.MediaTransport1"/>
     <deny send_destination="org.bluez.MediaTransport1"/>
     <deny own="org.bluez.MediaPlayer1"/>
-    <deny receive_sender="org.bluez.MediaPlayer1"/>
+    <allow receive_sender="org.bluez.MediaPlayer1"/>
     <deny send_destination="org.bluez.MediaPlayer1"/>
     <deny own="org.bluez.Profile1"/>
-    <deny receive_sender="org.bluez.Profile1"/>
+    <allow receive_sender="org.bluez.Profile1"/>
     <deny send_destination="org.bluez.Profile1"/>
+    <allow send_destination="org.bluez" send_interface="org.freedesktop.DBus.Properties" send_member="Get"/>
+    <allow send_destination="org.bluez" send_interface="org.freedesktop.DBus.Properties" send_member="GetAll"/>
+    <allow send_destination="org.bluez" send_interface="org.freedesktop.DBus.ObjectManager" send_member="DefaultAdapter"/>
+    <allow send_destination="org.bluez" send_interface="org.freedesktop.DBus.ObjectManager" send_member="GetManagedObjects"/>
+    <deny own="org.bluez.Adapter1"/>
+    <allow receive_sender="org.bluez.Adapter1"/>
+    <deny send_destination="org.bluez.Adapter1"/>
+    <check send_destination="org.bluez" send_interface="org.bluez.Adapter1" send_member="CreateDevice" privilege="http://tizen.org/privilege/bluetooth"/>
+    <deny own="org.bluez.Device1"/>
+    <allow receive_sender="org.bluez.Device1"/>
+    <deny send_destination="org.bluez.Device1"/>
+    <allow send_destination="org.bluez" send_interface="org.bluez.Device1" send_member="DiscoverServices"/>
+    <check send_destination="org.bluez" send_interface="org.bluez.Device1" send_member="ConnectProfile" privilege="http://tizen.org/privilege/bluetooth"/>
+    <check send_destination="org.bluez" send_interface="org.bluez.Device1" send_member="DisconnectProfile" privilege="http://tizen.org/privilege/bluetooth"/>
+    <check send_destination="org.bluez" send_interface="org.bluez.Device1" send_member="DisconnectExtProfile" privilege="http://tizen.org/privilege/bluetooth"/>
+    <check send_destination="org.bluez" send_interface="org.bluez.Device1" send_member="CancelDiscovery" privilege="http://tizen.org/privilege/bluetooth"/>
+    <deny own="org.bluez.GattManager1"/>
+    <allow receive_sender="org.bluez.GattManager1"/>
+    <deny send_destination="org.bluez.GattManager1"/>
+    <allow send_destination="org.bluez" send_interface="org.bluez.GattManager1" send_member="GetService"/>
+    <check send_destination="org.bluez" send_interface="org.bluez.GattManager1" send_member="RegisterApplication" privilege="http://tizen.org/privilege/bluetooth"/>
+    <check send_destination="org.bluez" send_interface="org.bluez.GattManager1" send_member="UnregisterApplication" privilege="http://tizen.org/privilege/bluetooth"/>
+    <deny own="org.bluez.ProfileManager1"/>
+    <allow receive_sender="org.bluez.ProfileManager1"/>
+    <deny send_destination="org.bluez.ProfileManager1"/>
+    <check send_destination="org.bluez" send_interface="org.bluez.ProfileManager1" send_member="RegisterProfile" privilege="http://tizen.org/privilege/bluetooth"/>
+    <check send_destination="org.bluez" send_interface="org.bluez.ProfileManager1" send_member="RegisterProfile1" privilege="http://tizen.org/privilege/bluetooth.admin"/>
+    <check send_destination="org.bluez" send_interface="org.bluez.ProfileManager1" send_member="RegisterProfile2" privilege="http://tizen.org/privilege/bluetooth.admin"/>
+    <check send_destination="org.bluez" send_interface="org.bluez.ProfileManager1" send_member="UnregisterProfile" privilege="http://tizen.org/privilege/bluetooth"/>
   </policy>
 </busconfig>
-- 
2.7.4