Catcrafts/imsd
Watch
2
0
Fork
You've already forked imsd
 0
Code Issues Pull requests Projects Releases 5 Packages 1 Wiki Activity Actions

imsd, imsd-ofonod: let polkit decide call control, not the account name

Browse source 
The system-bus policies granted net.catcrafts.IMS1 and org.ofono to root
and to the account `user`, postmarketOS's default name, so on a unit
whose account is called something else dbus denied every Dial from the
dialer — nothing in imsd's journal, nothing on screen. A field user
found it by trial (alyx report 14, 2026-09-20; ims ledger F14).

Let any local account reach both names and have the daemons decide:
placing, answering or ending a call needs polkit's
net.catcrafts.IMS1.Voice (the active local session; not an ssh login, an
inactive session or a system service account). imsd-ofonod asks about
its own callers, since its calls reach imsd as root. Reads such as the
status and the call list are not gated, and a refusal is logged with the
sender; a `--session` run, the development mode without root or polkit,
leaves the gate off. The check is ImsdBus, a small GLib module both
daemons link; the package depends on polkit.

An upgrade restarts both daemons (the previous commit), so the open
policy faces the old, ungated daemons only until the apk transaction
ends.

Tested on the dev phone (KPN) in builds of this series; not every path
has run there.
This commit is contained in:
Jorijn van der Graaf 2026-10-03 20:44:58 +02:00
commit f18baf2790
Signed by: jorijnvdgraaf
GPG key ID: 2937E59CDCC1BCFB
13 changed files with 245 additions and 52 deletions
Download patch file Download diff file Expand all files Collapse all files

26
project.cpp
View file

@ -57,6 +57,24 @@ static void ApplyGioFlags(Configuration& cfg) {
}
}
// ImsdBus — the polkit gate imsd and imsd-ofonod put in front of call
// control. A static library of its own: GLib, so outside imsd-core.
static std::unique_ptr<Configuration> BusLibrary(std::span<const std::string_view> args) {
auto bus = std::make_unique<Configuration>();
bus->path = "./";
bus->name = "imsd-bus";
bus->outputName = "imsd-bus";
ApplyStandardArgs(*bus, args);
bus->type = ConfigurationType::LibraryStatic;
{
std::array<fs::path, 1> ifaces = { "interfaces/ImsdBus" };
std::array<fs::path, 0> impls = {};
bus->GetInterfacesAndImplementations(ifaces, impls);
}
ApplyGioFlags(*bus);
return bus;
}
extern "C" Configuration CrafterBuildProject(std::span<const std::string_view> args) {
// Four executables come out of this repo; which one a build produces is
// chosen by `--product=`:
@ -70,7 +88,8 @@ extern "C" Configuration CrafterBuildProject(std::span<const std::string_view> a
// (pure GDBus translation, no core).
// ofonod — imsd-ofonod, the system-bus GNOME Calls backend
// (org.ofono.*) bridging to imsd, for Phosh and
// GNOME Mobile (pure GDBus translation, no core).
// GNOME Mobile (GDBus translation plus the imsd-bus
// polkit gate on its callers, no core).
bool wantMedia = false;
bool wantDialerd = false;
bool wantOfonod = false;
@ -86,6 +105,8 @@ extern "C" Configuration CrafterBuildProject(std::span<const std::string_view> a
ofonod.outputName = "imsd-ofonod";
ApplyStandardArgs(ofonod, args);
ofonod.type = ConfigurationType::Executable;
static auto Bus = BusLibrary(args);
ofonod.dependencies = { Bus.get() };
{
std::array<fs::path, 0> ifaces = {};
std::array<fs::path, 1> impls = { "implementations/ofonod" };
@ -161,7 +182,8 @@ extern "C" Configuration CrafterBuildProject(std::span<const std::string_view> a
cfg.outputName = "imsd";
ApplyStandardArgs(cfg, args);
cfg.type = ConfigurationType::Executable;
cfg.dependencies = { Core.get() };
static auto Bus = BusLibrary(args);
cfg.dependencies = { Core.get(), Bus.get() };
{
std::array<fs::path, 0> ifaces = {};
std::array<fs::path, 1> impls = { "implementations/main" };