Gecko [ tanishkshah.com ]

Name	Size	Permission	Date
cagefs-dbus-hardening.conf	6.12 KB	-rw-r--r--	2026-07-31 12:29
org.freedesktop.Flatpak.SystemHelper.conf	971 B	-rw-r--r--	2024-04-17 17:19
org.freedesktop.GeoClue2.Agent.conf	711 B	-rw-r--r--	2025-03-31 10:05
org.freedesktop.GeoClue2.conf	1.38 KB	-rw-r--r--	2025-03-31 10:05
org.freedesktop.PolicyKit1.conf	638 B	-rw-r--r--	2025-09-21 09:50
org.freedesktop.RealtimeKit1.conf	1.05 KB	-rw-r--r--	2009-06-16 20:21
org.selinux.conf	535 B	-rw-r--r--	2026-04-05 11:05
teamd.conf	409 B	-rw-r--r--	2020-01-09 14:42

Rename

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE busconfig PUBLIC "-//freedesktop//DTD D-BUS Bus Configuration 1.0//EN"
"http://www.freedesktop.org/standards/dbus/1.0/busconfig.dtd">

<!-- CageFS dbus-hardening (CLOS-2704 / CLOS-4516): default-deny of
     org.freedesktop.systemd1 and org.freedesktop.login1 for non-root callers,
     to stop cross-user enumeration of sessions, units and process argv.
     Rationale, trade-offs and validation: see the CLOS-4516 commit / MR.

WHERE THIS LANDS depends on the OS and is decided by feature_manager.py,
     because this is a default-deny that must override systemd's own per-method
     <allow> rules, and dbus applies the LAST-parsed rule within a precedence
     class:
       * Modern systemd (cl8+/Ubuntu) ships its policy under
         /usr/share/dbus-1/system.d, which dbus parses BEFORE /etc/dbus-1/system.d.
         So this file is dropped in /etc/dbus-1/system.d and reliably wins.
       * cl7/cl7h systemd ships its policy in /etc/dbus-1/system.d — the SAME
         directory — and the classic dbus-daemon parses that directory in
         readdir() (unsorted) order, so a sibling drop-in cannot reliably
         override it (CLOS-4516). There this file is deployed as
         /etc/dbus-1/system-local.conf instead, which system.conf parses AFTER
         the whole system.d directory, making this deny the last (winning) rule.
     Root keeps access via systemd's own user="root" allow (a higher precedence
     class than context="default"), regardless of location. -->

<policy user="psaadm">
        <allow send_destination="org.freedesktop.systemd1"/>
        <allow send_destination="org.freedesktop.login1"/>
    </policy>

<policy user="postgres">
        <allow send_destination="org.freedesktop.systemd1"/>
        <allow send_destination="org.freedesktop.login1"/>
    </policy>

<!-- glibc's nscd runs as the unprivileged system account 'nscd' (uid 28) and
         resolves passwd/group entries through NSS, which on systemd hosts
         includes nss-systemd. On systemd releases that predate the userdb
         varlink socket (cl8's systemd 239 — cl9+ uses
         /run/systemd/userdb/io.systemd.DynamicUser instead), nss-systemd asks
         systemd for DynamicUser= allocations over D-Bus, so every uncached
         lookup hits systemd1.Manager and the blanket deny below logs a
         "Rejected send message ... LookupDynamicUserByName" line. On busy
         servers that floods /var/log/messages (CLOS-6641).

Scope: only the three read-only dynamic-user lookups nss-systemd
         issues, not a blanket send_destination allow (CLOS-5957) — so nscd
         still cannot enumerate units, sessions or process argv, which is what
         this hardening protects. The methods return only transient DynamicUser=
         service identities, never caged-user data. nscd is a system daemon,
         never a caged end user; /var/run/nscd is mounted into cages, but that
         is nscd's own NSS client socket and only serves passwd/group/hosts/
         services lookups — a caged user cannot make nscd issue arbitrary bus
         calls through it. A user= policy outranks context="default", so these
         allows win regardless of file/parse order. Where nscd is not installed
         dbus logs a one-line "Unknown username nscd" notice and ignores the
         block (same as psaadm above). -->
    <policy user="nscd">
        <allow send_destination="org.freedesktop.systemd1"
               send_interface="org.freedesktop.systemd1.Manager"
               send_member="LookupDynamicUserByName"/>
        <allow send_destination="org.freedesktop.systemd1"
               send_interface="org.freedesktop.systemd1.Manager"
               send_member="LookupDynamicUserByUID"/>
        <allow send_destination="org.freedesktop.systemd1"
               send_interface="org.freedesktop.systemd1.Manager"
               send_member="GetDynamicUsers"/>
    </policy>

<policy context="default">
        <deny send_destination="org.freedesktop.systemd1"/>
        <deny send_destination="org.freedesktop.login1"/>
    </policy>
</busconfig>