From 41a3944f11beea2b5de2dc4a918769cdc7493663 Mon Sep 17 00:00:00 2001
From: Wootak Jung <wootak.jung@samsung.com>
Date: Mon, 27 Aug 2018 10:54:42 +0900
Subject: [PATCH] Modify dbus policies based on default deny

Change-Id: I6df07a1032f1d3cd58ea68ae87323f9095143619
---
 bt-api/bt-common.c                                   |  2 +-
 bt-oal/bluez_hal/bluetooth-frwk-gap-agent.conf       | 16 +++++++++++-----
 bt-oal/bluez_hal/src/bt-hal-dbus-common-utils.c      |  2 +-
 bt-service-adaptation/bluetooth-frwk-service.conf.in | 19 ++++++++++++++-----
 4 files changed, 27 insertions(+), 12 deletions(-)

diff --git a/bt-api/bt-common.c b/bt-api/bt-common.c
index 8b134c2..d9ab407 100644
--- a/bt-api/bt-common.c
+++ b/bt-api/bt-common.c
@@ -1304,7 +1304,7 @@ void _bt_unregister_profile(char *path)
 GDBusNodeInfo * _bt_get_gdbus_node(const gchar *xml_data)
 {
 	if (bus_id == 0) {
-		char *name = g_strdup_printf("org.bt.frwk%d", getpid());
+		char *name = g_strdup_printf("org.bt.frwk.p%d", getpid());
 
 		bus_id = g_bus_own_name(G_BUS_TYPE_SYSTEM,
 						name,
diff --git a/bt-oal/bluez_hal/bluetooth-frwk-gap-agent.conf b/bt-oal/bluez_hal/bluetooth-frwk-gap-agent.conf
index d75e874..635b385 100644
--- a/bt-oal/bluez_hal/bluetooth-frwk-gap-agent.conf
+++ b/bt-oal/bluez_hal/bluetooth-frwk-gap-agent.conf
@@ -2,14 +2,20 @@
  "http://www.freedesktop.org/standards/dbus/1.0/busconfig.dtd">
 <busconfig>
     <policy user="root">
-        <allow send_destination="org.projectx.bt" send_interface="org.bluez.Agent1"/>
-	<allow send_interface="org.bluez.Profile1"/>
+        <!-- service name(org.bt.frwk.p<pid>) is changeable by pid -->
+        <allow own_prefix="org.bt.frwk"/>
+        <allow send_interface="org.bluez.Profile1" send_member="NewConnection"/>
+        <allow send_interface="org.bluez.Profile1" send_member="RequestDisconnection"/>
     </policy>
     <policy group="network_fw">
-        <allow send_destination="org.projectx.bt" send_interface="org.bluez.Agent1"/>
-	<allow send_interface="org.bluez.Profile1"/>
+        <!-- service name(org.bt.frwk.p<pid>) is changeable by pid -->
+        <allow own_prefix="org.bt.frwk"/>
+        <allow send_interface="org.bluez.Profile1" send_member="NewConnection"/>
+        <allow send_interface="org.bluez.Profile1" send_member="RequestDisconnection"/>
     </policy>
     <policy context="default">
-        <check send_destination="org.projectx.bt" send_interface="org.bluez.Agent1" privilege="http://tizen.org/privilege/bluetooth.admin"/>
+        <deny own_prefix="org.bt.frwk"/>
+        <deny send_interface="org.bluez.Profile1" send_member="NewConnection"/>
+        <deny send_interface="org.bluez.Profile1" send_member="RequestDisconnection"/>
     </policy>
 </busconfig>
diff --git a/bt-oal/bluez_hal/src/bt-hal-dbus-common-utils.c b/bt-oal/bluez_hal/src/bt-hal-dbus-common-utils.c
index 5134b2f..c9a7812 100644
--- a/bt-oal/bluez_hal/src/bt-hal-dbus-common-utils.c
+++ b/bt-oal/bluez_hal/src/bt-hal-dbus-common-utils.c
@@ -1477,7 +1477,7 @@ static void __hal_new_connection_method(GDBusConnection *connection,
 static GDBusNodeInfo *_bt_hal_get_gdbus_node(const gchar *xml_data)
 {
 	if (bus_id == 0) {
-		char *name = g_strdup_printf("org.bt.frwk%d", getpid());
+		char *name = g_strdup_printf("org.bt.frwk.p%d", getpid());
 
 		bus_id = g_bus_own_name(G_BUS_TYPE_SYSTEM,
 				name,
diff --git a/bt-service-adaptation/bluetooth-frwk-service.conf.in b/bt-service-adaptation/bluetooth-frwk-service.conf.in
index f592662..17eecaa 100644
--- a/bt-service-adaptation/bluetooth-frwk-service.conf.in
+++ b/bt-service-adaptation/bluetooth-frwk-service.conf.in
@@ -3,19 +3,28 @@
 <busconfig>
     <policy user="root">
         <allow own="org.projectx.bt"/>
+        <allow send_destination="org.projectx.bt"/>
+        <allow own="org.bluez.obex"/>
+        <allow send_destination="org.bluez.obex"/>
     </policy>
-    <policy user="network_fw">
+    <policy group="network_fw">
         <allow own="org.projectx.bt"/>
-	<allow send_destination="org.bluez.obex"/>
-	<allow send_destination="org.bluez.obex" send_interface="org.freedesktop.DBus.Properties"/>
-	<allow send_destination="org.projectx.bt" send_interface="org.bluez.obex.Agent1"/>
+        <allow send_destination="org.projectx.bt"/>
+        <allow own="org.bluez.obex"/>
+        <allow send_destination="org.bluez.obex"/>
     </policy>
     <policy context="default">
         <deny own="org.projectx.bt"/>
+        <deny send_destination="org.projectx.bt"/>
+        <deny own="org.bluez.obex"/>
+        <deny send_destination="org.bluez.obex"/>
+
         <allow send_destination="org.projectx.bt" send_interface="org.projectx.bt"/>
+        <allow send_destination="org.projectx.bt" send_interface="org.freedesktop.DBus.Properties" send_member="GetAll"/>
+        <check send_destination="org.projectx.bt" send_interface="org.bluez.Agent1" privilege="http://tizen.org/privilege/bluetooth.admin"/>
+        <allow send_destination="org.projectx.bt" send_interface="org.bluez.obex.reply"/>
         <allow send_destination="org.projectx.bt_event"/>
         <allow send_destination="org.projectx.bluetooth.share"/>
         <allow send_destination="org.tizen.csd.Call.Instance"/>
-	<allow send_destination="org.projectx.bt" send_interface="org.bluez.obex.reply"/>
     </policy>
 </busconfig>
-- 
2.7.4