imsd, imsd-ofonod: let polkit decide call control, not the account name

The system-bus policies granted net.catcrafts.IMS1 and org.ofono to root
and to the account `user`, postmarketOS's default name, so on a unit
whose account is called something else dbus denied every Dial from the
dialer — nothing in imsd's journal, nothing on screen. A field user
found it by trial (alyx report 14, 2026-09-20; ims ledger F14).

Let any local account reach both names and have the daemons decide:
placing, answering or ending a call needs polkit's
net.catcrafts.IMS1.Voice (the active local session; not an ssh login, an
inactive session or a system service account). imsd-ofonod asks about
its own callers, since its calls reach imsd as root. Reads such as the
status and the call list are not gated, and a refusal is logged with the
sender; a `--session` run, the development mode without root or polkit,
leaves the gate off. The check is ImsdBus, a small GLib module both
daemons link; the package depends on polkit.

An upgrade restarts both daemons (the previous commit), so the open
policy faces the old, ungated daemons only until the apk transaction
ends.

Tested on the dev phone (KPN) in builds of this series; not every path
has run there.

implementations/main.cpp

@@ -11,8 +11,10 @@ Owns net.catcrafts.IMS1 on the system bus with the project's frozen D-Bus ABI
 run outgoing and incoming calls through the Imsd:Engine call machine (inbound
 INVITEs on the protected-port listeners become ringing calls a dialer answers
 via Accept), and spawn one imsd-media data-plane process per answered call.
-GLib/GDBus lives only here; every message, digest, SA command, and call-state
-decision comes from the GLib-free core.
+GLib/GDBus lives only here and in ImsdBus (the polkit gate in front of call
+control, shared with imsd-ofonod) — the integration daemons imsd-dialerd and
+imsd-ofonod carry their own; every message, digest, SA command, and
+call-state decision comes from the GLib-free core.
 
 Threads: a dedicated engine thread runs the SIP loop (blocking framed recv,
 protected-port listeners, media reaping, keepalive); the GLib main loop owns
@@ -20,7 +22,8 @@ the bus. D-Bus method calls push commands to the engine queue; engine events
 reach the bus via g_idle_add, where the calls table + status snapshot live
 (touched only on the main thread).
 
-  --session   own the name on the session bus (development; no policy needed)
+  --session   own the name on the session bus (development; no policy, no
+              polkit)
 */
 
 #include <arpa/inet.h>
@@ -40,6 +43,7 @@ reach the bus via g_idle_add, where the calls table + status snapshot live
 
 import std;
 import Imsd;
+import ImsdBus;
 
 namespace {
 
@@ -2408,7 +2412,9 @@ void HandleMethodCall(GDBusConnection*, const gchar*, const gchar*, const gchar*
     g_dbus_method_invocation_return_dbus_error(inv, "org.freedesktop.DBus.Error.UnknownMethod", "no such method");
 }
 
-const GDBusInterfaceVTable Vtable = { HandleMethodCall, nullptr, nullptr, {} };
+bool IsRead(std::string_view method) { return method == "GetStatus" || method == "GetCalls"; }
+constexpr char ErrAccessDenied[] = "org.freedesktop.DBus.Error.AccessDenied";
+const GDBusInterfaceVTable Vtable = { imsd::bus::Gated<HandleMethodCall, IsRead, ErrAccessDenied, Log>, nullptr, nullptr, {} };
 
 void OnBusAcquired(GDBusConnection* conn, const gchar*, gpointer) {
     DbusConn = conn;
@@ -2455,6 +2461,7 @@ int main(int argc, char** argv) {
     }
     Log(std::format("LOCAL={} P-CSCF=[{}]:{}", local, EnvOr("PCSCF", "(unset)"), EnvOr("PCSCF_PORT", "5060")));
     if (!session) LogAudioSession();
+    imsd::bus::AuthorizeCalls = !session;
 
     Engine engine;
     engine.SetLocal(local);

implementations/ofonod.cpp

@@ -45,11 +45,12 @@ plugins/provider/ofono/ — get these wrong and the plugin silently ignores us:
 
 Runs as root because `org.ofono` is a system-bus name (policy in
 packaging/org.ofono.conf). It does no I/O beyond D-Bus: every call decision
-stays in imsd. Everything happens on the GLib main loop, so there is no
-locking.
+stays in imsd. Its calls reach imsd as root, so it asks polkit about its own
+callers (ImsdBus): call control is net.catcrafts.IMS1.Voice, as on imsd.
+Everything happens on the GLib main loop, so there is no locking.
 
   --session   own org.ofono on the session bus and talk to imsd there
-              (development: no root, no policy file)
+              (development: no root, no policy file, no polkit)
   IMSD_BUS=session|system   override only the imsd side of that choice
 */
 
@@ -57,6 +58,7 @@ locking.
 #include <glib-unix.h>
 
 import std;
+import ImsdBus;
 
 namespace {
 
@@ -315,7 +317,9 @@ void HandleCallMethod(GDBusConnection*, const gchar*, const gchar* objectPath, c
     g_dbus_method_invocation_return_dbus_error(inv, "org.freedesktop.DBus.Error.UnknownMethod", "no such method");
 }
 
-const GDBusInterfaceVTable CallVtable = { HandleCallMethod, nullptr, nullptr, {} };
+bool IsRead(std::string_view method) { return method == "GetProperties" || method == "GetCalls" || method == "GetModems"; }
+constexpr char ErrAccessDenied[] = "org.ofono.Error.AccessDenied";
+const GDBusInterfaceVTable CallVtable = { imsd::bus::Gated<HandleCallMethod, IsRead, ErrAccessDenied, Log>, nullptr, nullptr, {} };
 
 guint RegisterObject(const char* xml, const char* path, const GDBusInterfaceVTable* vtable) {
     GDBusNodeInfo* node = g_dbus_node_info_new_for_xml(xml, nullptr);
@@ -596,9 +600,9 @@ void HandleSsMethod(GDBusConnection*, const gchar*, const gchar*, const gchar*,
 }
 
 const GDBusInterfaceVTable ManagerVtable = { HandleManagerMethod, nullptr, nullptr, {} };
-const GDBusInterfaceVTable ModemVtable = { HandleModemMethod, nullptr, nullptr, {} };
-const GDBusInterfaceVTable VcmVtable = { HandleVcmMethod, nullptr, nullptr, {} };
-const GDBusInterfaceVTable SsVtable = { HandleSsMethod, nullptr, nullptr, {} };
+const GDBusInterfaceVTable ModemVtable = { imsd::bus::Gated<HandleModemMethod, IsRead, ErrAccessDenied, Log>, nullptr, nullptr, {} };
+const GDBusInterfaceVTable VcmVtable = { imsd::bus::Gated<HandleVcmMethod, IsRead, ErrAccessDenied, Log>, nullptr, nullptr, {} };
+const GDBusInterfaceVTable SsVtable = { imsd::bus::Gated<HandleSsMethod, IsRead, ErrAccessDenied, Log>, nullptr, nullptr, {} };
 
 // ---- imsd events ------------------------------------------------------------
 void PublishVoiceState() {
@@ -727,6 +731,7 @@ int main(int argc, char** argv) {
         if (std::string_view(argv[i]) == "--session") session = true;
 
     GBusType ofonoBus = session ? G_BUS_TYPE_SESSION : G_BUS_TYPE_SYSTEM;
+    imsd::bus::AuthorizeCalls = !session;
     std::string imsdBusName = EnvOr("IMSD_BUS", session ? "session" : "system");
     GBusType imsdBus = imsdBusName == "session" ? G_BUS_TYPE_SESSION : G_BUS_TYPE_SYSTEM;