From: Simon McVittie Date: Wed, 19 Jul 2017 14:46:13 +0000 (+0100) Subject: dbus-daemon(1): Clarify how user, group rules work X-Git-Tag: dbus-1.11.18~22 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=ff09f3ba7099aeb3394b04ef5b78928dcd94a71e;p=thirdparty%2Fdbus.git dbus-daemon(1): Clarify how user, group rules work Signed-off-by: Simon McVittie Reviewed-by: Thiago Macieira Bug: https://bugs.freedesktop.org/show_bug.cgi?id=92853 --- diff --git a/doc/dbus-daemon.1.xml.in b/doc/dbus-daemon.1.xml.in index be4e1aa8b..447b7fd26 100644 --- a/doc/dbus-daemon.1.xml.in +++ b/doc/dbus-daemon.1.xml.in @@ -929,14 +929,18 @@ requested. [send|receive]_requested_reply="true" indicates that the rule applies always, regardless of pending reply state. -user and group denials mean that the given user or group may -not connect to the message bus. - - -For "name", "username", "groupname", etc. -the character "*" can be substituted, meaning "any." Complex globs -like "foo.bar.*" aren't allowed for now because they'd be work to -implement and maybe encourage sloppy security anyway. + + Rules with the user or group + attribute are checked when a new connection to the message bus is + established, and control whether the connection can continue. + Each of these attributes cannot be combined with any other + attribute. As a special case, both user="*" and + group="*" match any connection. If there are + no rules of this form, the default is to allow connections from the same + user ID that owns the dbus-daemon process. The well-known + session bus normally uses that default behaviour, while the well-known + system bus normally allows any connection. + Rules with the own or own_prefix