New policy type to check client credentials?

[Michael Biebl]

2009/1/30 Colin Walters <walters at verbum.org>:
> On Fri, Jan 30, 2009 at 5:17 AM, Markku Savela <msa at moth.iki.fi> wrote:
>>
>> - there are large number of services using the DBus, none of which
>>  makes any access control (does Telepathy framework do any nowadays?)
>
> Telepathy is a session service, and as far as I'm aware no one is
> doing access control on the session bus, at least in scale.  Since
> everything runs as the same uid, the only option is SELinux policy.
>
> Many services on the system bus do make use of the current dbus policy
> language and/or PolicyKit.
>
> Is your goal mainly to increase session bus security?  You also
> mention small devices and policy automation.
>
> I guess I'd like to step back and just ask what are the high level
> problems we're trying to solve?  What specific programs would need to
> be modified?  Are there any other, simpler ways we could address these
> problems?
>

One complaint I heard a few times already, is that the dbus group
policy does not work with dynamically assigned groups, i.e. pam_group.

Apparently this is used by admins with larger installations (mostly
ldap backed), where they assign group membership on login via
pam_group and current dbus fails for that.
And while PolicyKit is nice, I don't think that each and every small
system bus service will be patched to use PolicyKit.

Markku, would your patches support such dynamically assigned groups?
If so I'd welcome this more featureful  authentication checks.

Cheers,
Michael


-- 
Why is it that all of the instruments seeking intelligent life in the
universe are pointed away from Earth?