<!DOCTYPE busconfig PUBLIC
 "-//freedesktop//DTD D-BUS Bus Configuration 1.0//EN"
 "http://www.freedesktop.org/standards/dbus/1.0/busconfig.dtd">
<busconfig>

  <!-- This configuration file specifies the required security policies
       for the Wicked network service to work. -->

  <policy user="root">
    <allow own="org.opensuse.Network.Nanny"/>

    <allow send_destination="org.opensuse.Network.Nanny"
           send_interface="org.freedesktop.DBus.Introspectable"/>
    <allow send_destination="org.opensuse.Network.Nanny"
           send_interface="org.freedesktop.DBus.Properties" />
    <allow send_destination="org.opensuse.Network.Nanny"
           send_interface="org.freedesktop.DBus.ObjectManager" />

    <allow send_destination="org.opensuse.Network.Nanny"
           send_interface="org.opensuse.Network.Nanny"/>
    <allow send_destination="org.opensuse.Network.Nanny"
           send_interface="org.opensuse.Network.ManagedPolicy"/>
    <allow send_destination="org.opensuse.Network.Nanny"
           send_interface="org.opensuse.Network.ManagedInterface"/>
    <allow send_destination="org.opensuse.Network.Nanny"
           send_interface="org.opensuse.Network.ManagedModem"/>
  </policy>

  <policy context="default">
    <allow send_destination="org.opensuse.Network.Nanny"
           send_interface="org.freedesktop.DBus.Introspectable"/>
    <allow send_destination="org.opensuse.Network.Nanny"
           send_interface="org.freedesktop.DBus.ObjectManager" />

    <!-- SECURITY ADVICE:
         Normal users are allowed to install new policies,
	 and store secrets.
	 Device enablement happens through ManagedInterface.enable,
	 which is restricted to the root user.
      -->

    <allow send_destination="org.opensuse.Network.Nanny"
           send_interface="org.opensuse.Network.Nanny"
	   send_member="getDevice"/>
    <allow send_destination="org.opensuse.Network.Nanny"
           send_interface="org.opensuse.Network.Nanny"
	   send_member="createPolicy"/>
    <allow send_destination="org.opensuse.Network.Nanny"
           send_interface="org.opensuse.Network.Nanny"
	   send_member="addSecret"/>

    <allow send_destination="org.opensuse.Network.Nanny"
           send_interface="org.opensuse.Network.ManagedPolicy"
	   send_member="update"/>

    <allow send_destination="org.opensuse.Network.Nanny"
           send_interface="org.opensuse.Network.ManagedInterface"
	   send_member="enable"/>
    <allow send_destination="org.opensuse.Network.Nanny"
           send_interface="org.opensuse.Network.ManagedInterface"
	   send_member="disable"/>
  </policy>

</busconfig>

