Uploaded image for project: ' AGL Development'
  1. AGL Development
  2. SPEC-374

dbus accessDenied

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Fixed
    • Icon: Minor Minor
    • None
    • Chinook
    • Security
    • None

      root@nitrogen6x:/usr/AGL/ces2017-demo# ./installAllApps.sh

      Error org.freedesktop.DBus.Error.AccessDenied: Rejected send message, 1 matched rules; type="method_call", sender=":1.18" (uid=0 pid=608 comm="dbus-send --session --print-reply --dest=org.AGL.a") interface="org.AGL.afm.user" member="install" error name="(unset)" requested_reply="0" destination="org.AGL.afm.user" (uid=0 pid=504 comm="/usr/bin/afm-user-daemon --user-dbus=unix:path=/ru") privilege="http://tizen.org/privilege/internal/dbus"

      Error org.freedesktop.DBus.Error.AccessDenied: Rejected send message, 1 matched rules; type="method_call", sender=":1.19" (uid=0 pid=613 comm="dbus-send --session --print-reply --dest=org.AGL.a") interface="org.AGL.afm.user" member="install" error name="(unset)" requested_reply="0" destination="org.AGL.afm.user" (uid=0 pid=504 comm="/usr/bin/afm-user-daemon --user-dbus=unix:path=/ru") privilege="http://tizen.org/privilege/internal/dbus"

      Error org.freedesktop.DBus.Error.AccessDenied: Rejected send message, 1 matched rules; type="method_call", sender=":1.20" (uid=0 pid=618 comm="dbus-send --session --print-reply --dest=org.AGL.a") interface="org.AGL.afm.user" member="install" error name="(unset)" requested_reply="0" destination="org.AGL.afm.user" (uid=0 pid=504 comm="/usr/bin/afm-user-daemon --user-dbus=unix:path=/ru") privilege="http://tizen.org/privilege/internal/dbus"

      Error org.freedesktop.DBus.Error.AccessDenied: Rejected send message, 1 matched rules; type="method_call", sender=":1.21" (uid=0 pid=623 comm="dbus-send --session --print-reply --dest=org.AGL.a") interface="org.AGL.afm.user" member="install" error name="(unset)" requested_reply="0" destination="org.AGL.afm.user" (uid=0 pid=504 comm="/usr/bin/afm-user-daemon --user-dbus=unix:path=/ru") privilege="http://tizen.org/privilege/internal/dbus"

      Error org.freedesktop.DBus.Error.AccessDenied: Rejected send message, 1 matched rules; type="method_call", sender=":1.22" (uid=0 pid=628 comm="dbus-send --session --print-reply --dest=org.AGL.a") interface="org.AGL.afm.user" member="install" error name="(unset)" requested_reply="0" destination="org.AGL.afm.user" (uid=0 pid=504 comm="/usr/bin/afm-user-daemon --user-dbus=unix:path=/ru") privilege="http://tizen.org/privilege/internal/dbus"

      Error org.freedesktop.DBus.Error.AccessDenied: Rejected send message, 1 matched rules; type="method_call", sender=":1.23" (uid=0 pid=633 comm="dbus-send --session --print-reply --dest=org.AGL.a") interface="org.AGL.afm.user" member="install" error name="(unset)" requested_reply="0" destination="org.AGL.afm.user" (uid=0 pid=504 comm="/usr/bin/afm-user-daemon --user-dbus=unix:path=/ru") privilege="http://tizen.org/privilege/internal/dbus"

      Error org.freedesktop.DBus.Error.AccessDenied: Rejected send message, 1 matched rules; type="method_call", sender=":1.24" (uid=0 pid=638 comm="dbus-send --session --print-reply --dest=org.AGL.a") interface="org.AGL.afm.user" member="install" error name="(unset)" requested_reply="0" destination="org.AGL.afm.user" (uid=0 pid=504 comm="/usr/bin/afm-user-daemon --user-dbus=unix:path=/ru") privilege="http://tizen.org/privilege/internal/dbus"
      root@nitrogen6x:/usr/AGL/ces2017-demo# cat /etc/dbus-1/s

      session.conf session.d/ system.conf system.d/

      ----------------------------------------------------------------------------------------------------------------

      root@nitrogen6x:/usr/AGL/ces2017-demo# cat /etc/dbus-1/system.conf

      <!-- This configuration file controls the systemwide message bus.
      Add a system-local.conf and edit that rather than changing this
      file directly. -->

      <!-- Note that there are any number of ways you can hose yourself
      security-wise by screwing up this file; in particular, you
      probably don't want to listen on any more addresses, add any more
      auth mechanisms, run as a different user, etc. -->

      <!DOCTYPE busconfig PUBLIC "-//freedesktop//DTD D-Bus Bus Configuration 1.0//EN"
      "http://www.freedesktop.org/standards/dbus/1.0/busconfig.dtd">
      <busconfig>

      <!-- Our well-known bus type, do not change this -->
      <type>system</type>

      <!-- Run as special user -->
      <user>messagebus</user>

      <!-- Fork into daemon mode -->
      <fork/>

      <!-- We use system service launching using a helper -->
      <standard_system_servicedirs/>

      <!-- This is a setuid helper that is used to launch system services -->
      <servicehelper>/usr/lib/dbus/dbus-daemon-launch-helper</servicehelper>

      <!-- Write a pid file -->
      <pidfile>/var/run/messagebus.pid</pidfile>

      <!-- Enable logging to syslog -->
      <syslog/>

      <!-- Only allow socket-credentials-based authentication -->
      <auth>EXTERNAL</auth>

      <!-- Only listen on a local socket. (abstract=/path/to/socket
      means use abstract namespace, don't really create filesystem
      file; only Linux supports this. Use path=/whatever on other
      systems.) -->
      <listen>unix:path=/var/run/dbus/system_bus_socket</listen>

      <policy context="default">
      <!-- All users can connect to system bus -->
      <allow user="*"/>

      <!-- Holes must be punched in service configuration files for
      name ownership and sending method calls -->
      <deny own="*"/>
      <deny send_type="method_call"/>

      <!-- By default clients require internal/dbus privilege to send and receive signaks.
      This is internal privilege that is only accessible to trusted system services -->
      <check send_type="signal" privilege="http://tizen.org/privilege/internal/dbus" />
      <check receive_type="signal" privilege="http://tizen.org/privilege/internal/dbus" />

      <!-- Reply messages (method returns, errors) are allowed
      by default -->
      <allow send_requested_reply="true" send_type="method_return"/>
      <allow send_requested_reply="true" send_type="error"/>

      <!-- All messages but signals may be received by default -->
      <allow receive_type="method_call"/>
      <allow receive_type="method_return"/>
      <allow receive_type="error"/>

      <!-- If there is a need specific bus services could be protected by Cynara as well.
      However, this can lead to deadlock during the boot process when such check is made and
      Cynara is not yet activated (systemd calls protected method synchronously,
      dbus daemon tries to consult Cynara, Cynara waits for systemd activation).
      Therefore it is advised to allow root processes to use bus services.
      Currently anyone is allowed to talk to the message bus -->
      <allow send_destination="org.freedesktop.DBus"/>
      <allow receive_sender="org.freedesktop.DBus"/>

      <!-- Disallow some specific bus services -->
      <deny send_destination="org.freedesktop.DBus"
      send_interface="org.freedesktop.DBus"
      send_member="UpdateActivationEnvironment"/>
      <deny send_destination="org.freedesktop.DBus"
      send_interface="org.freedesktop.systemd1.Activator"/>
      </policy>

      <!-- Only systemd, which runs as root, may report activation failures. -->
      <policy user="root">
      <allow send_destination="org.freedesktop.DBus"
      send_interface="org.freedesktop.systemd1.Activator"/>
      </policy>

      <!-- Config files are placed here that among other things, punch
      holes in the above policy for specific services. -->
      <includedir>system.d</includedir>

      <!-- This is included last so local configuration can override what's
      in this standard file -->
      <include ignore_missing="yes">system-local.conf</include>

      <include if_selinux_enabled="yes" selinux_root_relative="yes">contexts/dbus_contexts</include>

      </busconfig>

        No reviews matched the request. Check your Options in the drop-down menu of this sections header.

            jose josé bollo (Inactive)
            nathani Nathan Illerbrun
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

              Created:
              Updated:
              Resolved: