doc: update documentation with own_prefix policy rules

https://bugs.freedesktop.org/show_bug.cgi?id=46886

1 files changed, 10 insertions, 0 deletions

diff --git a/doc/dbus-daemon.1.in b/doc/dbus-daemon.1.in
index b063e643..53856e91 100644
--- a/doc/dbus-daemon.1.in
+++ b/doc/dbus-daemon.1.in
@@ -501,6 +501,7 @@ The possible attributes of these elements are:
    eavesdrop="true" | "false"
 
    own="name"
+   own_prefix="name"
    user="username"
    group="groupname"
 .fi
@@ -573,6 +574,15 @@ like "foo.bar.*" aren't allowed for now because they'd be work to
 implement and maybe encourage sloppy security anyway.
 
 .PP
+<allow own_prefix="a.b"/> allows you to own the name "a.b" or any
+name whose first dot-separated elements are "a.b": in particular,
+you can own "a.b.c" or "a.b.c.d", but not "a.bc" or "a.c".
+This is useful when services like Telepathy and ReserveDevice
+define a meaning for subtrees of well-known names, such as
+org.freedesktop.Telepathy.ConnectionManager.(anything)
+and org.freedesktop.ReserveDevice1.(anything).
+
+.PP
 It does not make sense to deny a user or group inside a <policy>
 for a user or group; user/group denials can only be inside
 context="default" or context="mandatory" policies.