Jorijn van der Graaf
f18baf2790
The system-bus policies granted net.catcrafts.IMS1 and org.ofono to root and to the account `user`, postmarketOS's default name, so on a unit whose account is called something else dbus denied every Dial from the dialer — nothing in imsd's journal, nothing on screen. A field user found it by trial (alyx report 14, 2026-09-20; ims ledger F14). Let any local account reach both names and have the daemons decide: placing, answering or ending a call needs polkit's net.catcrafts.IMS1.Voice (the active local session; not an ssh login, an inactive session or a system service account). imsd-ofonod asks about its own callers, since its calls reach imsd as root. Reads such as the status and the call list are not gated, and a refusal is logged with the sender; a `--session` run, the development mode without root or polkit, leaves the gate off. The check is ImsdBus, a small GLib module both daemons link; the package depends on polkit. An upgrade restarts both daemons (the previous commit), so the open policy faces the old, ungated daemons only until the apk transaction ends. Tested on the dev phone (KPN) in builds of this series; not every path has run there.
34 lines
1.7 KiB
XML
34 lines
1.7 KiB
XML
<?xml version="1.0" encoding="UTF-8"?> <!--*-nxml-*-->
|
|
<!-- SPDX-License-Identifier: GPL-3.0-only -->
|
|
<!-- SPDX-FileCopyrightText: Copyright (C) 2026 Catcrafts® -->
|
|
<!DOCTYPE busconfig PUBLIC "-//freedesktop//DTD D-BUS Bus Configuration 1.0//EN"
|
|
"http://www.freedesktop.org/standards/dbus/1.0/busconfig.dtd">
|
|
<!-- imsd-ofonod system-bus policy: imsd presented as an oFono modem, which is
|
|
the seam GNOME Calls' bundled `ofono` provider plugin drives.
|
|
Install: /usr/share/dbus-1/system.d/imsd-ofono.conf
|
|
|
|
Deliberately NOT named org.ofono.conf on disk: the real oFono package
|
|
ships that filename, and the two must not silently overwrite each other.
|
|
They cannot run together in any case — one org.ofono name, one owner. -->
|
|
<busconfig>
|
|
<policy user="root">
|
|
<allow own="org.ofono"/>
|
|
<!-- imsd (root) reaches this daemon only by broadcast signals, and
|
|
dbus-broker checks a broadcast against the sender's send policy for
|
|
every name the receiver owns (dbus-daemon does not). The default
|
|
below allows sending too since 0.3.10; this line stays so that a
|
|
tighter default can never again silently drop every CallAdded /
|
|
CallStateChanged from imsd on the way to imsd-ofonod, as the old
|
|
default deny did (found on the FP6, 2026-09-20). -->
|
|
<allow send_destination="org.ofono"/>
|
|
</policy>
|
|
<!-- Any local account's GNOME Calls may reach imsd-ofonod, whatever the
|
|
session account is called; imsd-ofonod asks polkit before call control
|
|
(net.catcrafts.IMS1.Voice, as imsd does). Owning the name stays
|
|
root's. -->
|
|
<policy context="default">
|
|
<deny own="org.ofono"/>
|
|
<allow send_destination="org.ofono"/>
|
|
<allow receive_sender="org.ofono"/>
|
|
</policy>
|
|
</busconfig>
|