picnoir/Systemd
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity
Systemd/src/login/org.freedesktop.login1.conf

325 lines
14 KiB
Plaintext
Raw Normal View History

logind: implement GC
2011-05-25 00:55:58 +02:00
<?xml version="1.0"?> <!--*-nxml-*-->
<!DOCTYPE busconfig PUBLIC "-//freedesktop//DTD D-BUS Bus Configuration 1.0//EN"
"http://www.freedesktop.org/standards/dbus/1.0/busconfig.dtd">
<!--
license: LGPL-2.1+ -> LGPL-2.1-or-later
2020-11-09 05:23:58 +01:00
SPDX-License-Identifier: LGPL-2.1-or-later
Add SPDX license headers to various assorted files
2017-11-18 18:18:16 +01:00
logind: implement GC
2011-05-25 00:55:58 +02:00
This file is part of systemd.
systemd is free software; you can redistribute it and/or modify it
relicense to LGPLv2.1 (with exceptions) We finally got the OK from all contributors with non-trivial commits to relicense systemd from GPL2+ to LGPL2.1+. Some udev bits continue to be GPL2+ for now, but we are looking into relicensing them too, to allow free copy/paste of all code within systemd. The bits that used to be MIT continue to be MIT. The big benefit of the relicensing is that closed source code may now link against libsystemd-login.so and friends.
2012-04-12 00:20:58 +02:00
under the terms of the GNU Lesser General Public License as published by
the Free Software Foundation; either version 2.1 of the License, or
logind: implement GC
2011-05-25 00:55:58 +02:00
(at your option) any later version.
-->
<busconfig>
<policy user="root">
<allow own="org.freedesktop.login1"/>
<allow send_destination="org.freedesktop.login1"/>
<allow receive_sender="org.freedesktop.login1"/>
</policy>
<policy context="default">
logind: supply default bus policy with minimal access
2011-06-28 21:56:41 +02:00
<deny send_destination="org.freedesktop.login1"/>
<allow send_destination="org.freedesktop.login1"
send_interface="org.freedesktop.DBus.Introspectable"/>
<allow send_destination="org.freedesktop.login1"
send_interface="org.freedesktop.DBus.Peer"/>
<allow send_destination="org.freedesktop.login1"
send_interface="org.freedesktop.DBus.Properties"
send_member="Get"/>
<allow send_destination="org.freedesktop.login1"
send_interface="org.freedesktop.DBus.Properties"
send_member="GetAll"/>
<allow send_destination="org.freedesktop.login1"
send_interface="org.freedesktop.login1.Manager"
send_member="GetSession"/>
logind: add GetSessionByPID() bus call
2012-02-01 19:04:54 +01:00
<allow send_destination="org.freedesktop.login1"
send_interface="org.freedesktop.login1.Manager"
send_member="GetSessionByPID"/>
logind: supply default bus policy with minimal access
2011-06-28 21:56:41 +02:00
<allow send_destination="org.freedesktop.login1"
send_interface="org.freedesktop.login1.Manager"
send_member="GetUser"/>
<allow send_destination="org.freedesktop.login1"
send_interface="org.freedesktop.login1.Manager"
bus: introduce "trusted" bus concept and encode access control in object vtables Introduces a new concept of "trusted" vs. "untrusted" busses. For the latter libsystemd-bus will automatically do per-method access control, for the former all access is automatically granted. Per-method access control is encoded in the vtables: by default all methods are only accessible to privileged clients. If the SD_BUS_VTABLE_UNPRIVILEGED flag is set for a method it is accessible to unprivileged clients too. By default whether a client is privileged is determined via checking for its CAP_SYS_ADMIN capability, but this can be altered via the SD_BUS_VTABLE_CAPABILITY() macro that can be ORed into the flags field of the method. Writable properties are also subject to SD_BUS_VTABLE_UNPRIVILEGED and SD_BUS_VTABLE_CAPABILITY() for controlling write access to them. Note however that read access is unrestricted, as PropertiesChanged messages might send out the values anyway as an unrestricted broadcast. By default the system bus is set to "untrusted" and the user bus is "trusted" since per-method access control on the latter is unnecessary. On dbus1 busses we check the UID of the caller rather than the configured capability since the capability cannot be determined without race. On kdbus the capability is checked if possible from the attached meta-data of a message and otherwise queried from the sending peer. This also decorates the vtables of the various daemons we ship with these flags.
2013-12-10 17:41:39 +01:00
send_member="GetUserByPID"/>
logind: supply default bus policy with minimal access
2011-06-28 21:56:41 +02:00
<allow send_destination="org.freedesktop.login1"
send_interface="org.freedesktop.login1.Manager"
bus: introduce "trusted" bus concept and encode access control in object vtables Introduces a new concept of "trusted" vs. "untrusted" busses. For the latter libsystemd-bus will automatically do per-method access control, for the former all access is automatically granted. Per-method access control is encoded in the vtables: by default all methods are only accessible to privileged clients. If the SD_BUS_VTABLE_UNPRIVILEGED flag is set for a method it is accessible to unprivileged clients too. By default whether a client is privileged is determined via checking for its CAP_SYS_ADMIN capability, but this can be altered via the SD_BUS_VTABLE_CAPABILITY() macro that can be ORed into the flags field of the method. Writable properties are also subject to SD_BUS_VTABLE_UNPRIVILEGED and SD_BUS_VTABLE_CAPABILITY() for controlling write access to them. Note however that read access is unrestricted, as PropertiesChanged messages might send out the values anyway as an unrestricted broadcast. By default the system bus is set to "untrusted" and the user bus is "trusted" since per-method access control on the latter is unnecessary. On dbus1 busses we check the UID of the caller rather than the configured capability since the capability cannot be determined without race. On kdbus the capability is checked if possible from the attached meta-data of a message and otherwise queried from the sending peer. This also decorates the vtables of the various daemons we ship with these flags.
2013-12-10 17:41:39 +01:00
send_member="GetSeat"/>
logind: supply default bus policy with minimal access
2011-06-28 21:56:41 +02:00
<allow send_destination="org.freedesktop.login1"
send_interface="org.freedesktop.login1.Manager"
bus: introduce "trusted" bus concept and encode access control in object vtables Introduces a new concept of "trusted" vs. "untrusted" busses. For the latter libsystemd-bus will automatically do per-method access control, for the former all access is automatically granted. Per-method access control is encoded in the vtables: by default all methods are only accessible to privileged clients. If the SD_BUS_VTABLE_UNPRIVILEGED flag is set for a method it is accessible to unprivileged clients too. By default whether a client is privileged is determined via checking for its CAP_SYS_ADMIN capability, but this can be altered via the SD_BUS_VTABLE_CAPABILITY() macro that can be ORed into the flags field of the method. Writable properties are also subject to SD_BUS_VTABLE_UNPRIVILEGED and SD_BUS_VTABLE_CAPABILITY() for controlling write access to them. Note however that read access is unrestricted, as PropertiesChanged messages might send out the values anyway as an unrestricted broadcast. By default the system bus is set to "untrusted" and the user bus is "trusted" since per-method access control on the latter is unnecessary. On dbus1 busses we check the UID of the caller rather than the configured capability since the capability cannot be determined without race. On kdbus the capability is checked if possible from the attached meta-data of a message and otherwise queried from the sending peer. This also decorates the vtables of the various daemons we ship with these flags.
2013-12-10 17:41:39 +01:00
send_member="ListSessions"/>
logind: supply default bus policy with minimal access
2011-06-28 21:56:41 +02:00
logind: make ListMachines bus call public
2013-06-20 04:00:28 +02:00
<allow send_destination="org.freedesktop.login1"
send_interface="org.freedesktop.login1.Manager"
bus: introduce "trusted" bus concept and encode access control in object vtables Introduces a new concept of "trusted" vs. "untrusted" busses. For the latter libsystemd-bus will automatically do per-method access control, for the former all access is automatically granted. Per-method access control is encoded in the vtables: by default all methods are only accessible to privileged clients. If the SD_BUS_VTABLE_UNPRIVILEGED flag is set for a method it is accessible to unprivileged clients too. By default whether a client is privileged is determined via checking for its CAP_SYS_ADMIN capability, but this can be altered via the SD_BUS_VTABLE_CAPABILITY() macro that can be ORed into the flags field of the method. Writable properties are also subject to SD_BUS_VTABLE_UNPRIVILEGED and SD_BUS_VTABLE_CAPABILITY() for controlling write access to them. Note however that read access is unrestricted, as PropertiesChanged messages might send out the values anyway as an unrestricted broadcast. By default the system bus is set to "untrusted" and the user bus is "trusted" since per-method access control on the latter is unnecessary. On dbus1 busses we check the UID of the caller rather than the configured capability since the capability cannot be determined without race. On kdbus the capability is checked if possible from the attached meta-data of a message and otherwise queried from the sending peer. This also decorates the vtables of the various daemons we ship with these flags.
2013-12-10 17:41:39 +01:00
send_member="ListUsers"/>
logind: make ListMachines bus call public
2013-06-20 04:00:28 +02:00
logind: supply default bus policy with minimal access
2011-06-28 21:56:41 +02:00
<allow send_destination="org.freedesktop.login1"
send_interface="org.freedesktop.login1.Manager"
send_member="ListSeats"/>
logind: add shutdown/suspend/idle inhibition framework
2012-04-16 16:47:33 +02:00
<allow send_destination="org.freedesktop.login1"
send_interface="org.freedesktop.login1.Manager"
send_member="ListInhibitors"/>
<allow send_destination="org.freedesktop.login1"
send_interface="org.freedesktop.login1.Manager"
send_member="Inhibit"/>
logind: supply default bus policy with minimal access
2011-06-28 21:56:41 +02:00
<allow send_destination="org.freedesktop.login1"
send_interface="org.freedesktop.login1.Manager"
send_member="SetUserLinger"/>
<allow send_destination="org.freedesktop.login1"
send_interface="org.freedesktop.login1.Manager"
send_member="ActivateSession"/>
logind: introduce ActivateSessionOnSeat()
2012-02-07 20:12:13 +01:00
<allow send_destination="org.freedesktop.login1"
send_interface="org.freedesktop.login1.Manager"
send_member="ActivateSessionOnSeat"/>
logind: bring bus policy up-to-date A while back we opened up all of logind's bus calls to unprivileged users, via PK. However, the dbus1 policy wasn't updated accordingly. With this change, the dbus1 policy is opened up for all bus calls that should be available to unprivileged clients. (also rearranges some calls in the vtable, to make more sense, and be in line with the order in the bus policy file) Fixes #471.
2015-07-11 22:00:26 +02:00
<allow send_destination="org.freedesktop.login1"
send_interface="org.freedesktop.login1.Manager"
send_member="LockSession"/>
<allow send_destination="org.freedesktop.login1"
send_interface="org.freedesktop.login1.Manager"
send_member="UnlockSession"/>
<allow send_destination="org.freedesktop.login1"
send_interface="org.freedesktop.login1.Manager"
send_member="LockSessions"/>
<allow send_destination="org.freedesktop.login1"
send_interface="org.freedesktop.login1.Manager"
send_member="UnlockSessions"/>
<allow send_destination="org.freedesktop.login1"
send_interface="org.freedesktop.login1.Manager"
send_member="KillSession"/>
<allow send_destination="org.freedesktop.login1"
send_interface="org.freedesktop.login1.Manager"
send_member="KillUser"/>
<allow send_destination="org.freedesktop.login1"
send_interface="org.freedesktop.login1.Manager"
send_member="TerminateSession"/>
<allow send_destination="org.freedesktop.login1"
send_interface="org.freedesktop.login1.Manager"
send_member="TerminateUser"/>
<allow send_destination="org.freedesktop.login1"
send_interface="org.freedesktop.login1.Manager"
send_member="TerminateSeat"/>
logind: Allow PowerOff/Reboot in default context
2012-02-10 00:56:44 +01:00
<allow send_destination="org.freedesktop.login1"
send_interface="org.freedesktop.login1.Manager"
send_member="PowerOff"/>
<allow send_destination="org.freedesktop.login1"
send_interface="org.freedesktop.login1.Manager"
send_member="Reboot"/>
logind: add Halt() and CanHalt() APIs This adds new method calls Halt() and CanHalt() to the logind bus APIs. They aren't overly useful (as the whole concept of halting isn't really too useful), however they clean up one major asymmetry: currently, using the "shutdown" legacy commands it is possibly to enqueue a "halt" operation through logind, while logind officially doesn't actually support this. Moreover, the path through "shutdown" currently ultimately fails, since the referenced "halt" action isn't actually defined in PolicyKit. Finally, the current logic results in an unexpected asymmetry in systemctl: "systemctl poweroff", "systemctl reboot" are currently asynchronous (due to the logind involvement) while "systemctl halt" isnt. Let's clean this up, and make all three APIs implemented by logind natively, and all three hence asynchronous in "systemctl". Moreover, let's add the missing PK action. Fixes: #6957
2017-10-02 16:03:55 +02:00
<allow send_destination="org.freedesktop.login1"
send_interface="org.freedesktop.login1.Manager"
send_member="Halt"/>
logind: implement suspend/hibernate calls with inhibition logic
2012-05-08 19:02:25 +02:00
<allow send_destination="org.freedesktop.login1"
send_interface="org.freedesktop.login1.Manager"
send_member="Suspend"/>
<allow send_destination="org.freedesktop.login1"
send_interface="org.freedesktop.login1.Manager"
send_member="Hibernate"/>
logind: allow HybridSleep methods in default DBus context
2012-12-17 21:32:21 +01:00
<allow send_destination="org.freedesktop.login1"
send_interface="org.freedesktop.login1.Manager"
send_member="HybridSleep"/>
Introduce suspend-to-hibernate (#8274) Suspend to Hibernate is a new sleep method that invokes suspend for a predefined period of time before automatically waking up and hibernating the system. It's similar to HybridSleep however there isn't a performance impact on every suspend cycle. It's intended to use with systems that may have a higher power drain in their supported suspend states to prevent battery and data loss over an extended suspend cycle. Signed-off-by: Mario Limonciello <mario.limonciello@dell.com>
2018-03-08 14:17:33 +01:00
<allow send_destination="org.freedesktop.login1"
send_interface="org.freedesktop.login1.Manager"
Rename suspend-to-hibernate to suspend-then-hibernate Per some discussion with Gnome folks, they would prefer this name as it's more descriptive of what's happening.
2018-03-28 18:00:06 +02:00
send_member="SuspendThenHibernate"/>
Introduce suspend-to-hibernate (#8274) Suspend to Hibernate is a new sleep method that invokes suspend for a predefined period of time before automatically waking up and hibernating the system. It's similar to HybridSleep however there isn't a performance impact on every suspend cycle. It's intended to use with systems that may have a higher power drain in their supported suspend states to prevent battery and data loss over an extended suspend cycle. Signed-off-by: Mario Limonciello <mario.limonciello@dell.com>
2018-03-08 14:17:33 +01:00
logind: make seat device management accessible to normal users/via polkit
2012-02-10 02:35:48 +01:00
<allow send_destination="org.freedesktop.login1"
logind: introduce CanReboot/CanPowerOff bus calls
2012-02-11 00:13:10 +01:00
send_interface="org.freedesktop.login1.Manager"
send_member="CanPowerOff"/>
<allow send_destination="org.freedesktop.login1"
send_interface="org.freedesktop.login1.Manager"
send_member="CanReboot"/>
logind: add Halt() and CanHalt() APIs This adds new method calls Halt() and CanHalt() to the logind bus APIs. They aren't overly useful (as the whole concept of halting isn't really too useful), however they clean up one major asymmetry: currently, using the "shutdown" legacy commands it is possibly to enqueue a "halt" operation through logind, while logind officially doesn't actually support this. Moreover, the path through "shutdown" currently ultimately fails, since the referenced "halt" action isn't actually defined in PolicyKit. Finally, the current logic results in an unexpected asymmetry in systemctl: "systemctl poweroff", "systemctl reboot" are currently asynchronous (due to the logind involvement) while "systemctl halt" isnt. Let's clean this up, and make all three APIs implemented by logind natively, and all three hence asynchronous in "systemctl". Moreover, let's add the missing PK action. Fixes: #6957
2017-10-02 16:03:55 +02:00
<allow send_destination="org.freedesktop.login1"
send_interface="org.freedesktop.login1.Manager"
send_member="CanHalt"/>
logind: introduce CanReboot/CanPowerOff bus calls
2012-02-11 00:13:10 +01:00
<allow send_destination="org.freedesktop.login1"
logind: implement suspend/hibernate calls with inhibition logic
2012-05-08 19:02:25 +02:00
send_interface="org.freedesktop.login1.Manager"
send_member="CanSuspend"/>
<allow send_destination="org.freedesktop.login1"
send_interface="org.freedesktop.login1.Manager"
send_member="CanHibernate"/>
<allow send_destination="org.freedesktop.login1"
logind: allow HybridSleep methods in default DBus context
2012-12-17 21:32:21 +01:00
send_interface="org.freedesktop.login1.Manager"
send_member="CanHybridSleep"/>
Introduce suspend-to-hibernate (#8274) Suspend to Hibernate is a new sleep method that invokes suspend for a predefined period of time before automatically waking up and hibernating the system. It's similar to HybridSleep however there isn't a performance impact on every suspend cycle. It's intended to use with systems that may have a higher power drain in their supported suspend states to prevent battery and data loss over an extended suspend cycle. Signed-off-by: Mario Limonciello <mario.limonciello@dell.com>
2018-03-08 14:17:33 +01:00
<allow send_destination="org.freedesktop.login1"
send_interface="org.freedesktop.login1.Manager"
Rename suspend-to-hibernate to suspend-then-hibernate Per some discussion with Gnome folks, they would prefer this name as it's more descriptive of what's happening.
2018-03-28 18:00:06 +02:00
send_member="CanSuspendThenHibernate"/>
Introduce suspend-to-hibernate (#8274) Suspend to Hibernate is a new sleep method that invokes suspend for a predefined period of time before automatically waking up and hibernating the system. It's similar to HybridSleep however there isn't a performance impact on every suspend cycle. It's intended to use with systems that may have a higher power drain in their supported suspend states to prevent battery and data loss over an extended suspend cycle. Signed-off-by: Mario Limonciello <mario.limonciello@dell.com>
2018-03-08 14:17:33 +01:00
logind: bring bus policy up-to-date A while back we opened up all of logind's bus calls to unprivileged users, via PK. However, the dbus1 policy wasn't updated accordingly. With this change, the dbus1 policy is opened up for all bus calls that should be available to unprivileged clients. (also rearranges some calls in the vtable, to make more sense, and be in line with the order in the bus policy file) Fixes #471.
2015-07-11 22:00:26 +02:00
<allow send_destination="org.freedesktop.login1"
send_interface="org.freedesktop.login1.Manager"
send_member="ScheduleShutdown"/>
<allow send_destination="org.freedesktop.login1"
send_interface="org.freedesktop.login1.Manager"
send_member="CancelScheduledShutdown"/>
logind: Add support for RebootParameter This adds support for user to set & get reboot parameter for reboot. As callee would be next issuing Reboot call same policy checks are being used. If unit file issuing the reboot action defines RebootArgument (or similar) that setting takes precedence.
2019-03-09 21:30:58 +01:00
<allow send_destination="org.freedesktop.login1"
send_interface="org.freedesktop.login1.Manager"
send_member="CanRebootParameter"/>
<allow send_destination="org.freedesktop.login1"
send_interface="org.freedesktop.login1.Manager"
send_member="SetRebootParameter"/>
logind,systemctl: add reboot to EFI firmware support
2015-04-03 18:03:06 +02:00
<allow send_destination="org.freedesktop.login1"
send_interface="org.freedesktop.login1.Manager"
send_member="CanRebootToFirmwareSetup"/>
<allow send_destination="org.freedesktop.login1"
send_interface="org.freedesktop.login1.Manager"
send_member="SetRebootToFirmwareSetup"/>
logind/systemctl: introduce SetWallMessage and --message Enable unprivileged users to set wall message on a shutdown operation. When the message is set via the --message option, it is logged together with the default shutdown message. $ systemctl reboot --message "Applied kernel updates." $ journalctl -b -1 ... systemd-logind[27]: System is rebooting. (Applied kernel updates.) ...
2015-08-24 14:54:22 +02:00
<allow send_destination="org.freedesktop.login1"
send_interface="org.freedesktop.login1.Manager"
logind: add support for booting into the boot menu or a specific boot menu entry This behaves similar to the "boot into firmware" logic, and also allows either direct EFI operation (which sd-boot supports and others might support eventually too) or override through env var.
2018-10-22 20:06:52 +02:00
send_member="CanRebootToBootLoaderMenu"/>
<allow send_destination="org.freedesktop.login1"
send_interface="org.freedesktop.login1.Manager"
send_member="SetRebootToBootLoaderMenu"/>
<allow send_destination="org.freedesktop.login1"
send_interface="org.freedesktop.login1.Manager"
send_member="CanRebootToBootLoaderEntry"/>
<allow send_destination="org.freedesktop.login1"
send_interface="org.freedesktop.login1.Manager"
send_member="SetRebootToBootLoaderEntry"/>
<allow send_destination="org.freedesktop.login1"
send_interface="org.freedesktop.login1.Manager"
logind/systemctl: introduce SetWallMessage and --message Enable unprivileged users to set wall message on a shutdown operation. When the message is set via the --message option, it is logged together with the default shutdown message. $ systemctl reboot --message "Applied kernel updates." $ journalctl -b -1 ... systemd-logind[27]: System is rebooting. (Applied kernel updates.) ...
2015-08-24 14:54:22 +02:00
send_member="SetWallMessage"/>
logind: allow HybridSleep methods in default DBus context
2012-12-17 21:32:21 +01:00
<allow send_destination="org.freedesktop.login1"
logind: make seat device management accessible to normal users/via polkit
2012-02-10 02:35:48 +01:00
send_interface="org.freedesktop.login1.Manager"
send_member="AttachDevice"/>
<allow send_destination="org.freedesktop.login1"
send_interface="org.freedesktop.login1.Manager"
send_member="FlushDevices"/>
logind: bring bus policy up-to-date A while back we opened up all of logind's bus calls to unprivileged users, via PK. However, the dbus1 policy wasn't updated accordingly. With this change, the dbus1 policy is opened up for all bus calls that should be available to unprivileged clients. (also rearranges some calls in the vtable, to make more sense, and be in line with the order in the bus policy file) Fixes #471.
2015-07-11 22:00:26 +02:00
<allow send_destination="org.freedesktop.login1"
send_interface="org.freedesktop.login1.Seat"
send_member="Terminate"/>
logind: supply default bus policy with minimal access
2011-06-28 21:56:41 +02:00
<allow send_destination="org.freedesktop.login1"
send_interface="org.freedesktop.login1.Seat"
send_member="ActivateSession"/>
login: Allow calling org.freedesktop.login1.Seat.SwitchTo
2014-02-22 00:23:17 +01:00
<allow send_destination="org.freedesktop.login1"
send_interface="org.freedesktop.login1.Seat"
send_member="SwitchTo"/>
<allow send_destination="org.freedesktop.login1"
send_interface="org.freedesktop.login1.Seat"
send_member="SwitchToPrevious"/>
<allow send_destination="org.freedesktop.login1"
send_interface="org.freedesktop.login1.Seat"
send_member="SwitchToNext"/>
logind: bring bus policy up-to-date A while back we opened up all of logind's bus calls to unprivileged users, via PK. However, the dbus1 policy wasn't updated accordingly. With this change, the dbus1 policy is opened up for all bus calls that should be available to unprivileged clients. (also rearranges some calls in the vtable, to make more sense, and be in line with the order in the bus policy file) Fixes #471.
2015-07-11 22:00:26 +02:00
<allow send_destination="org.freedesktop.login1"
send_interface="org.freedesktop.login1.Session"
send_member="Terminate"/>
logind: supply default bus policy with minimal access
2011-06-28 21:56:41 +02:00
<allow send_destination="org.freedesktop.login1"
send_interface="org.freedesktop.login1.Session"
send_member="Activate"/>
logind: bring bus policy up-to-date A while back we opened up all of logind's bus calls to unprivileged users, via PK. However, the dbus1 policy wasn't updated accordingly. With this change, the dbus1 policy is opened up for all bus calls that should be available to unprivileged clients. (also rearranges some calls in the vtable, to make more sense, and be in line with the order in the bus policy file) Fixes #471.
2015-07-11 22:00:26 +02:00
<allow send_destination="org.freedesktop.login1"
send_interface="org.freedesktop.login1.Session"
send_member="Lock"/>
<allow send_destination="org.freedesktop.login1"
send_interface="org.freedesktop.login1.Session"
send_member="Unlock"/>
logind: allow access to SetIdleHint() to owner of the session
2011-06-29 19:53:27 +02:00
<allow send_destination="org.freedesktop.login1"
send_interface="org.freedesktop.login1.Session"
send_member="SetIdleHint"/>
logind: introduce LockedHint and SetLockedHint (#3238) Desktop environments can keep this property up to date to allow applications to easily track session's Lock status.
2016-05-11 19:34:13 +02:00
<allow send_destination="org.freedesktop.login1"
send_interface="org.freedesktop.login1.Session"
send_member="SetLockedHint"/>
logind: bring bus policy up-to-date A while back we opened up all of logind's bus calls to unprivileged users, via PK. However, the dbus1 policy wasn't updated accordingly. With this change, the dbus1 policy is opened up for all bus calls that should be available to unprivileged clients. (also rearranges some calls in the vtable, to make more sense, and be in line with the order in the bus policy file) Fixes #471.
2015-07-11 22:00:26 +02:00
<allow send_destination="org.freedesktop.login1"
send_interface="org.freedesktop.login1.Session"
send_member="Kill"/>
logind: allow unprivileged session-device access The session-device/control API was introduced for unprivileged device access from within a session. Add the required dbus policy to the default logind policies. Note: logind validates that only root and the user of a session can use the API. Furthermore, only a single API user gets access at a time.
2013-10-15 21:13:39 +02:00
<allow send_destination="org.freedesktop.login1"
send_interface="org.freedesktop.login1.Session"
send_member="TakeControl"/>
<allow send_destination="org.freedesktop.login1"
send_interface="org.freedesktop.login1.Session"
send_member="ReleaseControl"/>
Add SetType method to login Session interface
2020-02-23 04:44:42 +01:00
<allow send_destination="org.freedesktop.login1"
send_interface="org.freedesktop.login1.Session"
send_member="SetType"/>
logind: allow unprivileged session-device access The session-device/control API was introduced for unprivileged device access from within a session. Add the required dbus policy to the default logind policies. Note: logind validates that only root and the user of a session can use the API. Furthermore, only a single API user gets access at a time.
2013-10-15 21:13:39 +02:00
<allow send_destination="org.freedesktop.login1"
send_interface="org.freedesktop.login1.Session"
send_member="TakeDevice"/>
<allow send_destination="org.freedesktop.login1"
send_interface="org.freedesktop.login1.Session"
send_member="ReleaseDevice"/>
<allow send_destination="org.freedesktop.login1"
send_interface="org.freedesktop.login1.Session"
send_member="PauseDeviceComplete"/>
logind: add SetBrightness() bus call for setting brightness of leds/backlight devices associated with a seat This augments the drm/input device management by adding a single method call for setting the brightness of an "leds" or "backlight" kernel class device. This method call requires no privileges to call, but a caller can only change the brightness on sessions that are currently active, and they must own the session. This does not do enumeration of such class devices, feature or range probing, chnage notification; it doesn't help associating graphics or input devices with their backlight or leds devices. For all that clients should go directly to udev/sysfs. The SetBrightness() call is just for executing the actual change operation, that is otherwise privileged. Example line: busctl call org.freedesktop.login1 /org/freedesktop/login1/session/self org.freedesktop.login1.Session SetBrightness ssu "backlight" "intel_backlight" 200 The parameter the SetBrightness() call takes are the kernel subsystem (i.e. "leds" or "backlight"), the device name, and the brightness value. On some hw setting the brightness is slow, and implementation and write access to the sysfs knobs exposes this slowness. Due to this we'll fork off a writer process in the background so that logind doesn't have to block. Moreover, write requestes are coalesced: when a write request is enqueued while one is already being executed it is queued. When another write reques is then enqueued the earlier one is replaced by the newer one, so that only one queued write request per device remains at any time. Method replies are sent as soon as the first write request that happens after the request was received is completed. It is recommended that bus clients turn off the "expect_reply" flag on the dbus messages they send though, that relieves logind from sending completion notification and is particularly a good idea if clients implement reactive UI sliders that send a quick secession of write requests. Replaces: #12413
2019-04-28 11:07:56 +02:00
<allow send_destination="org.freedesktop.login1"
send_interface="org.freedesktop.login1.Session"
send_member="SetBrightness"/>
logind: bring bus policy up-to-date A while back we opened up all of logind's bus calls to unprivileged users, via PK. However, the dbus1 policy wasn't updated accordingly. With this change, the dbus1 policy is opened up for all bus calls that should be available to unprivileged clients. (also rearranges some calls in the vtable, to make more sense, and be in line with the order in the bus policy file) Fixes #471.
2015-07-11 22:00:26 +02:00
<allow send_destination="org.freedesktop.login1"
send_interface="org.freedesktop.login1.User"
send_member="Terminate"/>
<allow send_destination="org.freedesktop.login1"
send_interface="org.freedesktop.login1.User"
send_member="Kill"/>
logind: implement GC
2011-05-25 00:55:58 +02:00
<allow receive_sender="org.freedesktop.login1"/>
</policy>
</busconfig>
Reference in a new issue Copy permalink