Attachment 889786 Details for Bug 1091068 – patch

[patch] patch

info.patch (text/plain), 16.77 KB, created by Jiri Popelka on 2014-04-25 15:03:47 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Jiri Popelka

Created: 2014-04-25 15:03:47 UTC

Size: 16.77 KB

patch

obsolete

>diff --git a/config/org.fedoraproject.FirewallD1.policy.in b/config/org.fedoraproject.FirewallD1.policy.in
>index 4a0c777..bb975fb 100644
>--- a/config/org.fedoraproject.FirewallD1.policy.in
>+++ b/config/org.fedoraproject.FirewallD1.policy.in
>@@ -15,7 +15,7 @@
>       <allow_inactive>auth_admin_keep</allow_inactive>
>       <allow_active>auth_admin_keep</allow_active>
>     </defaults>
>-    <annotate key="org.freedesktop.policykit.imply">org.fedoraproject.FirewallD1.info org.fedoraproject.FirewallD1.config org.fedoraproject.FirewallD1.direct org.fedoraproject.FirewallD1.policies</annotate>
>+    <annotate key="org.freedesktop.policykit.imply">org.fedoraproject.FirewallD1.info org.fedoraproject.FirewallD1.config org.fedoraproject.FirewallD1.config.info org.fedoraproject.FirewallD1.direct org.fedoraproject.FirewallD1.direct.info org.fedoraproject.FirewallD1.policies org.fedoraproject.FirewallD1.policies.info</annotate>
>   </action>
> 
>   <action id="org.fedoraproject.FirewallD1.info">
>@@ -36,6 +36,17 @@
>       <allow_inactive>auth_admin_keep</allow_inactive>
>       <allow_active>auth_admin_keep</allow_active>
>     </defaults>
>+    <annotate key="org.freedesktop.policykit.imply">org.fedoraproject.FirewallD1.config.info</annotate>
>+  </action>
>+
>+  <action id="org.fedoraproject.FirewallD1.config.info">
>+    <description>Firewall configuration</description>
>+    <message>System policy prevents inspecting the firewall configuration</message>
>+    <defaults>
>+      <allow_any>auth_admin_keep</allow_any>
>+      <allow_inactive>auth_admin_keep</allow_inactive>
>+      <allow_active>auth_admin_keep</allow_active>
>+    </defaults>
>   </action>
> 
>   <action id="org.fedoraproject.FirewallD1.direct">
>@@ -46,6 +57,17 @@
>       <allow_inactive>auth_admin_keep</allow_inactive>
>       <allow_active>auth_admin_keep</allow_active>
>     </defaults>
>+    <annotate key="org.freedesktop.policykit.imply">org.fedoraproject.FirewallD1.direct.info</annotate>
>+  </action>
>+
>+  <action id="org.fedoraproject.FirewallD1.direct.info">
>+    <description>Firewall direct interface</description>
>+    <message>System policy prevents inspecting the firewall direct interface</message>
>+    <defaults>
>+      <allow_any>auth_admin_keep</allow_any>
>+      <allow_inactive>auth_admin_keep</allow_inactive>
>+      <allow_active>auth_admin_keep</allow_active>
>+    </defaults>
>   </action>
> 
>   <action id="org.fedoraproject.FirewallD1.policies">
>@@ -56,6 +78,17 @@
>       <allow_inactive>auth_admin_keep</allow_inactive>
>       <allow_active>auth_admin_keep</allow_active>
>     </defaults>
>+    <annotate key="org.freedesktop.policykit.imply">org.fedoraproject.FirewallD1.policies.info</annotate>
>+  </action>
>+
>+  <action id="org.fedoraproject.FirewallD1.policies.info">
>+    <description>Firewall policies interface</description>
>+    <message>System policy prevents inspecting the firewall policies interface</message>
>+    <defaults>
>+      <allow_any>auth_admin_keep</allow_any>
>+      <allow_inactive>auth_admin_keep</allow_inactive>
>+      <allow_active>auth_admin_keep</allow_active>
>+    </defaults>
>   </action>
> 
> </policyconfig>
>diff --git a/src/firewall/config/dbus.py b/src/firewall/config/dbus.py
>index fb29206..6aa785b 100644
>--- a/src/firewall/config/dbus.py
>+++ b/src/firewall/config/dbus.py
>@@ -42,7 +42,10 @@ DBUS_PATH_CONFIG_ZONE = DBUS_PATH+"/config/zone"
> # Polkit actions
> _PK_ACTION = "org.fedoraproject.FirewallD%d" % DBUS_INTERFACE_VERSION
> PK_ACTION_POLICIES = _PK_ACTION+".policies"
>+PK_ACTION_POLICIES_INFO = PK_ACTION_POLICIES+".info"
> PK_ACTION_CONFIG = _PK_ACTION+".config"
>+PK_ACTION_CONFIG_INFO = PK_ACTION_CONFIG+".info"
> PK_ACTION_DIRECT = _PK_ACTION+".direct"
>+PK_ACTION_DIRECT_INFO = PK_ACTION_DIRECT+".info"
> PK_ACTION_INFO = _PK_ACTION+".info"
> PK_ACTION_ALL = _PK_ACTION+".all" # implies all other actions
>diff --git a/src/firewall/server/firewalld.py b/src/firewall/server/firewalld.py
>index ce102fc..9419128 100644
>--- a/src/firewall/server/firewalld.py
>+++ b/src/firewall/server/firewalld.py
>@@ -289,7 +289,7 @@ class FirewallD(slip.dbus.service.Object):
>         self.fw.policies.disable_lockdown()
>         self.LockdownDisabled()
> 
>-    @slip.dbus.polkit.require_auth(PK_ACTION_INFO)
>+    @slip.dbus.polkit.require_auth(PK_ACTION_POLICIES_INFO)
>     @dbus_service_method(DBUS_INTERFACE_POLICIES, in_signature='',
>                          out_signature='b')
>     @dbus_handle_exceptions
>@@ -340,7 +340,7 @@ class FirewallD(slip.dbus.service.Object):
>         self.fw.policies.lockdown_whitelist.remove_command(command)
>         self.LockdownWhitelistCommandRemoved(command)
> 
>-    @slip.dbus.polkit.require_auth(PK_ACTION_INFO)
>+    @slip.dbus.polkit.require_auth(PK_ACTION_POLICIES_INFO)
>     @dbus_service_method(DBUS_INTERFACE_POLICIES, in_signature='s',
>                          out_signature='b')
>     @dbus_handle_exceptions
>@@ -352,7 +352,7 @@ class FirewallD(slip.dbus.service.Object):
>         # no access check here
>         return self.fw.policies.lockdown_whitelist.has_command(command)
> 
>-    @slip.dbus.polkit.require_auth(PK_ACTION_INFO)
>+    @slip.dbus.polkit.require_auth(PK_ACTION_POLICIES_INFO)
>     @dbus_service_method(DBUS_INTERFACE_POLICIES, in_signature='',
>                          out_signature='as')
>     @dbus_handle_exceptions
>@@ -401,7 +401,7 @@ class FirewallD(slip.dbus.service.Object):
>         self.fw.policies.lockdown_whitelist.remove_uid(uid)
>         self.LockdownWhitelistUidRemoved(uid)
> 
>-    @slip.dbus.polkit.require_auth(PK_ACTION_INFO)
>+    @slip.dbus.polkit.require_auth(PK_ACTION_POLICIES_INFO)
>     @dbus_service_method(DBUS_INTERFACE_POLICIES, in_signature='i',
>                          out_signature='b')
>     @dbus_handle_exceptions
>@@ -413,7 +413,7 @@ class FirewallD(slip.dbus.service.Object):
>         # no access check here
>         return self.fw.policies.lockdown_whitelist.has_uid(uid)
> 
>-    @slip.dbus.polkit.require_auth(PK_ACTION_INFO)
>+    @slip.dbus.polkit.require_auth(PK_ACTION_POLICIES_INFO)
>     @dbus_service_method(DBUS_INTERFACE_POLICIES, in_signature='',
>                          out_signature='ai')
>     @dbus_handle_exceptions
>@@ -462,7 +462,7 @@ class FirewallD(slip.dbus.service.Object):
>         self.fw.policies.lockdown_whitelist.remove_user(user)
>         self.LockdownWhitelistUserRemoved(user)
> 
>-    @slip.dbus.polkit.require_auth(PK_ACTION_INFO)
>+    @slip.dbus.polkit.require_auth(PK_ACTION_POLICIES_INFO)
>     @dbus_service_method(DBUS_INTERFACE_POLICIES, in_signature='s',
>                          out_signature='b')
>     @dbus_handle_exceptions
>@@ -474,7 +474,7 @@ class FirewallD(slip.dbus.service.Object):
>         # no access check here
>         return self.fw.policies.lockdown_whitelist.has_user(user)
> 
>-    @slip.dbus.polkit.require_auth(PK_ACTION_INFO)
>+    @slip.dbus.polkit.require_auth(PK_ACTION_POLICIES_INFO)
>     @dbus_service_method(DBUS_INTERFACE_POLICIES, in_signature='',
>                          out_signature='as')
>     @dbus_handle_exceptions
>@@ -523,7 +523,7 @@ class FirewallD(slip.dbus.service.Object):
>         self.fw.policies.lockdown_whitelist.remove_context(context)
>         self.LockdownWhitelistContextRemoved(context)
> 
>-    @slip.dbus.polkit.require_auth(PK_ACTION_INFO)
>+    @slip.dbus.polkit.require_auth(PK_ACTION_POLICIES_INFO)
>     @dbus_service_method(DBUS_INTERFACE_POLICIES, in_signature='s',
>                          out_signature='b')
>     @dbus_handle_exceptions
>@@ -535,7 +535,7 @@ class FirewallD(slip.dbus.service.Object):
>         # no access check here
>         return self.fw.policies.lockdown_whitelist.has_context(context)
> 
>-    @slip.dbus.polkit.require_auth(PK_ACTION_INFO)
>+    @slip.dbus.polkit.require_auth(PK_ACTION_POLICIES_INFO)
>     @dbus_service_method(DBUS_INTERFACE_POLICIES, in_signature='',
>                          out_signature='as')
>     @dbus_handle_exceptions
>@@ -755,7 +755,7 @@ class FirewallD(slip.dbus.service.Object):
>             return zone
>         return ""
> 
>-    @slip.dbus.polkit.require_auth(PK_ACTION_INFO)
>+    @slip.dbus.polkit.require_auth(PK_ACTION_CONFIG_INFO)
>     @dbus_service_method(DBUS_INTERFACE_ZONE, in_signature='s',
>                          out_signature='b')
>     @dbus_handle_exceptions
>@@ -832,7 +832,7 @@ class FirewallD(slip.dbus.service.Object):
>         self.InterfaceRemoved(_zone, interface)
>         return _zone
> 
>-    @slip.dbus.polkit.require_auth(PK_ACTION_INFO)
>+    @slip.dbus.polkit.require_auth(PK_ACTION_CONFIG_INFO)
>     @dbus_service_method(DBUS_INTERFACE_ZONE, in_signature='ss',
>                          out_signature='b')
>     @dbus_handle_exceptions
>@@ -845,7 +845,7 @@ class FirewallD(slip.dbus.service.Object):
>         log.debug1("zone.queryInterface('%s', '%s')" % (zone, interface))
>         return self.fw.zone.query_interface(zone, interface)
> 
>-    @slip.dbus.polkit.require_auth(PK_ACTION_INFO)
>+    @slip.dbus.polkit.require_auth(PK_ACTION_CONFIG_INFO)
>     @dbus_service_method(DBUS_INTERFACE_ZONE, in_signature='s',
>                          out_signature='as')
>     @dbus_handle_exceptions
>@@ -939,7 +939,7 @@ class FirewallD(slip.dbus.service.Object):
>         self.SourceRemoved(_zone, source)
>         return _zone
> 
>-    @slip.dbus.polkit.require_auth(PK_ACTION_INFO)
>+    @slip.dbus.polkit.require_auth(PK_ACTION_CONFIG_INFO)
>     @dbus_service_method(DBUS_INTERFACE_ZONE, in_signature='ss',
>                          out_signature='b')
>     @dbus_handle_exceptions
>@@ -952,7 +952,7 @@ class FirewallD(slip.dbus.service.Object):
>         log.debug1("zone.querySource('%s', '%s')" % (zone, source))
>         return self.fw.zone.query_source(zone, source)
> 
>-    @slip.dbus.polkit.require_auth(PK_ACTION_INFO)
>+    @slip.dbus.polkit.require_auth(PK_ACTION_CONFIG_INFO)
>     @dbus_service_method(DBUS_INTERFACE_ZONE, in_signature='s',
>                          out_signature='as')
>     @dbus_handle_exceptions
>@@ -1029,7 +1029,7 @@ class FirewallD(slip.dbus.service.Object):
>         self.RichRuleRemoved(_zone, rule)
>         return _zone
> 
>-    @slip.dbus.polkit.require_auth(PK_ACTION_INFO)
>+    @slip.dbus.polkit.require_auth(PK_ACTION_CONFIG_INFO)
>     @dbus_service_method(DBUS_INTERFACE_ZONE, in_signature='ss',
>                          out_signature='b')
>     @dbus_handle_exceptions
>@@ -1041,7 +1041,7 @@ class FirewallD(slip.dbus.service.Object):
>         obj = Rich_Rule(rule_str=rule)
>         return self.fw.zone.query_rule(zone, obj)
> 
>-    @slip.dbus.polkit.require_auth(PK_ACTION_INFO)
>+    @slip.dbus.polkit.require_auth(PK_ACTION_CONFIG_INFO)
>     @dbus_service_method(DBUS_INTERFACE_ZONE, in_signature='s',
>                          out_signature='as')
>     @dbus_handle_exceptions
>@@ -1113,7 +1113,7 @@ class FirewallD(slip.dbus.service.Object):
>         self.ServiceRemoved(_zone, service)
>         return _zone
> 
>-    @slip.dbus.polkit.require_auth(PK_ACTION_INFO)
>+    @slip.dbus.polkit.require_auth(PK_ACTION_CONFIG_INFO)
>     @dbus_service_method(DBUS_INTERFACE_ZONE, in_signature='ss',
>                          out_signature='b')
>     @dbus_handle_exceptions
>@@ -1124,7 +1124,7 @@ class FirewallD(slip.dbus.service.Object):
>         log.debug1("zone.queryService('%s', '%s')" % (zone, service))
>         return self.fw.zone.query_service(zone, service)
> 
>-    @slip.dbus.polkit.require_auth(PK_ACTION_INFO)
>+    @slip.dbus.polkit.require_auth(PK_ACTION_CONFIG_INFO)
>     @dbus_service_method(DBUS_INTERFACE_ZONE, in_signature='s',
>                          out_signature='as')
>     @dbus_handle_exceptions
>@@ -1200,7 +1200,7 @@ class FirewallD(slip.dbus.service.Object):
>         self.PortRemoved(_zone, port, protocol)
>         return _zone
> 
>-    @slip.dbus.polkit.require_auth(PK_ACTION_INFO)
>+    @slip.dbus.polkit.require_auth(PK_ACTION_CONFIG_INFO)
>     @dbus_service_method(DBUS_INTERFACE_ZONE, in_signature='sss',
>                          out_signature='b')
>     @dbus_handle_exceptions
>@@ -1212,7 +1212,7 @@ class FirewallD(slip.dbus.service.Object):
>         log.debug1("zone.queryPort('%s', '%s', '%s')" % (zone, port, protocol))
>         return self.fw.zone.query_port(zone, port, protocol)
> 
>-    @slip.dbus.polkit.require_auth(PK_ACTION_INFO)
>+    @slip.dbus.polkit.require_auth(PK_ACTION_CONFIG_INFO)
>     @dbus_service_method(DBUS_INTERFACE_ZONE, in_signature='s',
>                          out_signature='aas')
>     @dbus_handle_exceptions
>@@ -1281,7 +1281,7 @@ class FirewallD(slip.dbus.service.Object):
>         self.MasqueradeRemoved(_zone)
>         return _zone
> 
>-    @slip.dbus.polkit.require_auth(PK_ACTION_INFO)
>+    @slip.dbus.polkit.require_auth(PK_ACTION_CONFIG_INFO)
>     @dbus_service_method(DBUS_INTERFACE_ZONE, in_signature='s',
>                          out_signature='b')
>     @dbus_handle_exceptions
>@@ -1362,7 +1362,7 @@ class FirewallD(slip.dbus.service.Object):
>         self.ForwardPortRemoved(_zone, port, protocol, toport, toaddr)
>         return _zone
> 
>-    @slip.dbus.polkit.require_auth(PK_ACTION_INFO)
>+    @slip.dbus.polkit.require_auth(PK_ACTION_CONFIG_INFO)
>     @dbus_service_method(DBUS_INTERFACE_ZONE, in_signature='sssss',
>                          out_signature='b')
>     @dbus_handle_exceptions
>@@ -1379,7 +1379,7 @@ class FirewallD(slip.dbus.service.Object):
>         return self.fw.zone.query_forward_port(zone, port, protocol, toport,
>                                                toaddr)
> 
>-    @slip.dbus.polkit.require_auth(PK_ACTION_INFO)
>+    @slip.dbus.polkit.require_auth(PK_ACTION_CONFIG_INFO)
>     @dbus_service_method(DBUS_INTERFACE_ZONE, in_signature='s',
>                          out_signature='aas')
>     @dbus_handle_exceptions
>@@ -1452,7 +1452,7 @@ class FirewallD(slip.dbus.service.Object):
>         self.IcmpBlockRemoved(_zone, icmp)
>         return _zone
> 
>-    @slip.dbus.polkit.require_auth(PK_ACTION_INFO)
>+    @slip.dbus.polkit.require_auth(PK_ACTION_CONFIG_INFO)
>     @dbus_service_method(DBUS_INTERFACE_ZONE, in_signature='ss',
>                          out_signature='b')
>     @dbus_handle_exceptions
>@@ -1463,7 +1463,7 @@ class FirewallD(slip.dbus.service.Object):
>         log.debug1("zone.queryIcmpBlock('%s', '%s')" % (zone, icmp))
>         return self.fw.zone.query_icmp_block(zone, icmp)
> 
>-    @slip.dbus.polkit.require_auth(PK_ACTION_INFO)
>+    @slip.dbus.polkit.require_auth(PK_ACTION_CONFIG_INFO)
>     @dbus_service_method(DBUS_INTERFACE_ZONE, in_signature='s',
>                          out_signature='as')
>     @dbus_handle_exceptions
>@@ -1520,7 +1520,7 @@ class FirewallD(slip.dbus.service.Object):
>         self.fw.direct.remove_chain(ipv, table, chain)
>         self.ChainRemoved(ipv, table, chain)
>     
>-    @slip.dbus.polkit.require_auth(PK_ACTION_INFO)
>+    @slip.dbus.polkit.require_auth(PK_ACTION_DIRECT_INFO)
>     @dbus_service_method(DBUS_INTERFACE_DIRECT, in_signature='sss',
>                          out_signature='b')
>     @dbus_handle_exceptions
>@@ -1532,7 +1532,7 @@ class FirewallD(slip.dbus.service.Object):
>         log.debug1("direct.queryChain('%s', '%s', '%s')" % (ipv, table, chain))
>         return self.fw.direct.query_chain(ipv, table, chain)
> 
>-    @slip.dbus.polkit.require_auth(PK_ACTION_INFO)
>+    @slip.dbus.polkit.require_auth(PK_ACTION_DIRECT_INFO)
>     @dbus_service_method(DBUS_INTERFACE_DIRECT, in_signature='ss',
>                          out_signature='as')
>     @dbus_handle_exceptions
>@@ -1543,7 +1543,7 @@ class FirewallD(slip.dbus.service.Object):
>         log.debug1("direct.getChains('%s', '%s')" % (ipv, table))
>         return self.fw.direct.get_chains(ipv, table)
> 
>-    @slip.dbus.polkit.require_auth(PK_ACTION_INFO)
>+    @slip.dbus.polkit.require_auth(PK_ACTION_DIRECT_INFO)
>     @dbus_service_method(DBUS_INTERFACE_DIRECT, in_signature='',
>                          out_signature='a(sss)')
>     @dbus_handle_exceptions
>@@ -1615,7 +1615,7 @@ class FirewallD(slip.dbus.service.Object):
>             self.fw.direct.remove_rule(ipv, table, chain, priority, args)
>             self.RuleRemoved(ipv, table, chain, priority, args)
> 
>-    @slip.dbus.polkit.require_auth(PK_ACTION_INFO)
>+    @slip.dbus.polkit.require_auth(PK_ACTION_DIRECT_INFO)
>     @dbus_service_method(DBUS_INTERFACE_DIRECT, in_signature='sssias',
>                          out_signature='b')
>     @dbus_handle_exceptions
>@@ -1630,7 +1630,7 @@ class FirewallD(slip.dbus.service.Object):
>                        (table, chain, priority, "','".join(args)))
>         return self.fw.direct.query_rule(ipv, table, chain, priority, args)
> 
>-    @slip.dbus.polkit.require_auth(PK_ACTION_INFO)
>+    @slip.dbus.polkit.require_auth(PK_ACTION_DIRECT_INFO)
>     @dbus_service_method(DBUS_INTERFACE_DIRECT, in_signature='sss',
>                          out_signature='a(ias)')
>     @dbus_handle_exceptions
>@@ -1642,7 +1642,7 @@ class FirewallD(slip.dbus.service.Object):
>         log.debug1("direct.getRules('%s', '%s', '%s')" % (ipv, table, chain))
>         return self.fw.direct.get_rules(ipv, table, chain)
> 
>-    @slip.dbus.polkit.require_auth(PK_ACTION_INFO)
>+    @slip.dbus.polkit.require_auth(PK_ACTION_DIRECT_INFO)
>     @dbus_service_method(DBUS_INTERFACE_DIRECT, in_signature='',
>                          out_signature='a(sssias)')
>     @dbus_handle_exceptions

Actions: View | Diff

Attachments on bug 1091068: 889786