diff options
author | Simon McVittie <smcv@collabora.com> | 2017-07-19 15:46:13 +0100 |
---|---|---|
committer | Simon McVittie <smcv@debian.org> | 2017-07-28 11:24:20 +0100 |
commit | ff09f3ba7099aeb3394b04ef5b78928dcd94a71e (patch) | |
tree | a8e1f3836ec3ace4d07c584a959db7874a87b95a /doc | |
parent | c1348e23fee268184a1f351439e60455ff224416 (diff) | |
download | dbus-ff09f3ba7099aeb3394b04ef5b78928dcd94a71e.tar.gz |
dbus-daemon(1): Clarify how user, group rules work
Signed-off-by: Simon McVittie <smcv@collabora.com>
Reviewed-by: Thiago Macieira <thiago@kde.org>
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=92853
Diffstat (limited to 'doc')
-rw-r--r-- | doc/dbus-daemon.1.xml.in | 20 |
1 files changed, 12 insertions, 8 deletions
diff --git a/doc/dbus-daemon.1.xml.in b/doc/dbus-daemon.1.xml.in index be4e1aa8..447b7fd2 100644 --- a/doc/dbus-daemon.1.xml.in +++ b/doc/dbus-daemon.1.xml.in @@ -929,14 +929,18 @@ requested. [send|receive]_requested_reply="true" indicates that the rule applies always, regardless of pending reply state.</para> -<para>user and group denials mean that the given user or group may -not connect to the message bus.</para> - - -<para>For "name", "username", "groupname", etc. -the character "*" can be substituted, meaning "any." Complex globs -like "foo.bar.*" aren't allowed for now because they'd be work to -implement and maybe encourage sloppy security anyway.</para> +<para> + Rules with the <literal>user</literal> or <literal>group</literal> + attribute are checked when a new connection to the message bus is + established, and control whether the connection can continue. + Each of these attributes cannot be combined with any other + attribute. As a special case, both <literal>user="*"</literal> and + <literal>group="*"</literal> match any connection. If there are + no rules of this form, the default is to allow connections from the same + user ID that owns the <command>dbus-daemon</command> process. The well-known + session bus normally uses that default behaviour, while the well-known + system bus normally allows any connection. +</para> <para> Rules with the <literal>own</literal> or <literal>own_prefix</literal> |