imsd, imsd-ofonod: let polkit decide call control, not the account name

The system-bus policies granted net.catcrafts.IMS1 and org.ofono to root
and to the account `user`, postmarketOS's default name, so on a unit
whose account is called something else dbus denied every Dial from the
dialer — nothing in imsd's journal, nothing on screen. A field user
found it by trial (alyx report 14, 2026-09-20; ims ledger F14).

Let any local account reach both names and have the daemons decide:
placing, answering or ending a call needs polkit's
net.catcrafts.IMS1.Voice (the active local session; not an ssh login, an
inactive session or a system service account). imsd-ofonod asks about
its own callers, since its calls reach imsd as root. Reads such as the
status and the call list are not gated, and a refusal is logged with the
sender; a `--session` run, the development mode without root or polkit,
leaves the gate off. The check is ImsdBus, a small GLib module both
daemons link; the package depends on polkit.

An upgrade restarts both daemons (the previous commit), so the open
policy faces the old, ungated daemons only until the apk transaction
ends.

Tested on the dev phone (KPN) in builds of this series; not every path
has run there.

packaging/APKBUILD

@@ -9,8 +9,9 @@ url="https://forgejo.catcrafts.net/Catcrafts/imsd"
 arch="aarch64 x86_64"
 license="GPL-3.0-only"
 # the media leg dlopen's the AMR-WB codecs; pw-record/pw-play drive PipeWire —
-# none of which abuild's .so auto-scan can see
-depends="modemmanager opencore-amr vo-amrwbenc pipewire-tools"
+# none of which abuild's .so auto-scan can see; polkit answers the daemons'
+# call-control check (ImsdBus)
+depends="modemmanager opencore-amr vo-amrwbenc pipewire-tools polkit"
 # clang/libc++ C++26 modules build (see Makefile); llvm-runtimes ships the
 # libc++ std module sources (/usr/share/libc++/v1/std.cppm) it precompiles
 makedepends="clang lld libc++-dev llvm-libunwind-dev llvm-runtimes glib-dev pkgconf"

packaging/APKBUILD.binary

@@ -17,8 +17,9 @@ pkgdesc="Userspace IMS/VoLTE daemon for mainline Linux phones"
 url="https://forgejo.catcrafts.net/Catcrafts/imsd"
 arch="aarch64"
 license="GPL-3.0-only"
-# the media leg dlopen's the AMR-WB codecs; pw-record/pw-play drive PipeWire
-depends="modemmanager libc++ opencore-amr vo-amrwbenc pipewire-tools"
+# the media leg dlopen's the AMR-WB codecs; pw-record/pw-play drive PipeWire;
+# polkit answers the daemons' call-control check (ImsdBus)
+depends="modemmanager libc++ opencore-amr vo-amrwbenc pipewire-tools polkit"
 # versioned provides = imsd satisfies soc-qcom-modem's 81voltd dependency AND
 # excludes the real package: 81voltd serves the modem's own ims-PDN requests,
 # which races imsd for the PDN and flaps it with a new prefix every ~2.5 min
@@ -52,6 +53,8 @@ package() {
         "$pkgdir"/etc/xdg/autostart/imsd-dialerd.desktop
     install -Dm644 net.catcrafts.IMS1.conf \
         "$pkgdir"/usr/share/dbus-1/system.d/net.catcrafts.IMS1.conf
+    install -Dm644 net.catcrafts.IMS1.policy \
+        "$pkgdir"/usr/share/polkit-1/actions/net.catcrafts.IMS1.policy
     # the skel override hides kde-telephony's modem daemon autostart for the
     # account created at install — imsd-dialerd owns those session bus names
     install -Dm644 "$srcdir"/org.kde.modem.daemon.desktop \

packaging/imsd-ofonod.service

@@ -3,9 +3,11 @@
 [Unit]
 Description=oFono-compatible GNOME Calls backend for imsd
 Documentation=https://forgejo.catcrafts.net/Catcrafts/imsd
-# org.ofono is a system-bus name, so this is a system service, and it runs
-# as root: its start hook restarts GNOME Calls in the users' own managers.
-# Only enable it on a GNOME/Phosh session
+# org.ofono is a system-bus name only root may own (org.ofono.conf), so this
+# is a system service run as root: imsd admits the calls it forwards as
+# root's (it has asked polkit about its own caller), and its start hook
+# restarts GNOME Calls in the users' own managers. Only enable it on a
+# GNOME/Phosh session
 # — Plasma Mobile uses imsd-dialerd instead. Both may run at once (different
 # buses, different consumers), but a real ofonod must not.
 Conflicts=ofono.service

packaging/make-bin-tarball.sh

@@ -29,6 +29,7 @@ cp packaging/ims-pdn-up.sh packaging/imsd-handover.sh packaging/imsd.service \
    packaging/imsd-ofono-restart-calls.sh \
    packaging/org.ofono.conf packaging/90_imsd-ofono.gschema.override \
    packaging/80-imsd-ofono.preset \
-   packaging/net.catcrafts.IMS1.conf "$stage/imsd-$VER/"
+   packaging/net.catcrafts.IMS1.conf packaging/net.catcrafts.IMS1.policy \
+   "$stage/imsd-$VER/"
 tar -C "$stage" -czf "imsd-$VER.tar.gz" "imsd-$VER"
 echo "wrote imsd-$VER.tar.gz ($(du -h "imsd-$VER.tar.gz" | cut -f1))"

packaging/net.catcrafts.IMS1.conf

@@ -11,12 +11,13 @@
     <allow send_destination="net.catcrafts.IMS1"/>
     <allow receive_sender="net.catcrafts.IMS1"/>
   </policy>
-  <!-- the phone session user drives calls via the imsdialerd shim -->
-  <policy user="user">
+  <!-- Any local account may reach imsd: the dialer shim runs as the session
+       account, whatever it is called. imsd itself decides who may place,
+       answer or end a call — polkit's net.catcrafts.IMS1.Voice
+       (net.catcrafts.IMS1.policy: the active local session). Owning the name
+       stays root's. -->
+  <policy context="default">
     <allow send_destination="net.catcrafts.IMS1"/>
     <allow receive_sender="net.catcrafts.IMS1"/>
   </policy>
-  <policy context="default">
-    <deny send_destination="net.catcrafts.IMS1"/>
-  </policy>
 </busconfig>

packaging/net.catcrafts.IMS1.policy

@@ -0,0 +1,26 @@
+<?xml version="1.0" encoding="UTF-8"?> <!--*-nxml-*-->
+<!-- SPDX-License-Identifier: GPL-3.0-only -->
+<!-- SPDX-FileCopyrightText: Copyright (C) 2026 Catcrafts® -->
+<!DOCTYPE policyconfig PUBLIC "-//freedesktop//DTD PolicyKit Policy Configuration 1.0//EN"
+ "http://www.freedesktop.org/standards/PolicyKit/1/policyconfig.dtd">
+<!-- Call control on imsd (net.catcrafts.IMS1) and imsd-ofonod (org.ofono):
+     both daemons ask polkit about this action before they place, answer or
+     end a call for a caller. The defaults are ModemManager's Voice action as
+     the permissive polkit build ships it (the strict build has
+     allow_active auth_self_keep): the active local session, not an ssh
+     login, an inactive session or a system service account. root is always
+     allowed.
+     Install: /usr/share/polkit-1/actions/net.catcrafts.IMS1.policy -->
+<policyconfig>
+  <vendor>Catcrafts</vendor>
+  <vendor_url>https://forgejo.catcrafts.net/Catcrafts/imsd</vendor_url>
+  <action id="net.catcrafts.IMS1.Voice">
+    <description>Place, answer and end voice calls over IMS</description>
+    <message>System policy prevents voice calls.</message>
+    <defaults>
+      <allow_any>no</allow_any>
+      <allow_inactive>no</allow_inactive>
+      <allow_active>yes</allow_active>
+    </defaults>
+  </action>
+</policyconfig>

packaging/org.ofono.conf

@@ -15,20 +15,20 @@
     <allow own="org.ofono"/>
     <!-- imsd (root) reaches this daemon only by broadcast signals, and
          dbus-broker checks a broadcast against the sender's send policy for
-         every name the receiver owns (dbus-daemon does not): without this
-         line the default deny below silently drops every CallAdded /
-         CallStateChanged from imsd on the way to imsd-ofonod (found on the
-         FP6, 2026-09-20). -->
+         every name the receiver owns (dbus-daemon does not). The default
+         below allows sending too since 0.3.10; this line stays so that a
+         tighter default can never again silently drop every CallAdded /
+         CallStateChanged from imsd on the way to imsd-ofonod, as the old
+         default deny did (found on the FP6, 2026-09-20). -->
     <allow send_destination="org.ofono"/>
   </policy>
-  <!-- the session user's GNOME Calls drives the modem; call control is
-       exactly what net.catcrafts.IMS1 already grants it through the dialerd -->
-  <policy user="user">
+  <!-- Any local account's GNOME Calls may reach imsd-ofonod, whatever the
+       session account is called; imsd-ofonod asks polkit before call control
+       (net.catcrafts.IMS1.Voice, as imsd does). Owning the name stays
+       root's. -->
+  <policy context="default">
+    <deny own="org.ofono"/>
     <allow send_destination="org.ofono"/>
     <allow receive_sender="org.ofono"/>
   </policy>
-  <policy context="default">
-    <deny own="org.ofono"/>
-    <deny send_destination="org.ofono"/>
-  </policy>
 </busconfig>