summaryrefslogtreecommitdiff
path: root/vpn
diff options
context:
space:
mode:
authortaesub kim <taesub.kim@samsung.com>2017-06-22 08:49:20 (GMT)
committertaesub kim <taesub.kim@samsung.com>2017-07-20 06:51:29 (GMT)
commite4544ee49501928e15c2174d1e4936dc6ff7d97e (patch)
treefc25dab6d28a737344467b8924e0667bcb5adae7 /vpn
parentce407f97aed0fdba65b5d881ef19cd7ee5e7abeb (diff)
downloadconnman-e4544ee49501928e15c2174d1e4936dc6ff7d97e.zip
connman-e4544ee49501928e15c2174d1e4936dc6ff7d97e.tar.gz
connman-e4544ee49501928e15c2174d1e4936dc6ff7d97e.tar.bz2
Change-Id: I0d0afacc8a11fadc8128f6eef3f64f7a4ca8675b Signed-off-by: Taesub Kim <taesub.kim@samsung.com>
Diffstat (limited to 'vpn')
-rwxr-xr-xvpn/connman-vpn.service.in8
-rwxr-xr-xvpn/net.connman.vpn.service.in3
-rwxr-xr-xvpn/vpn-dbus.conf6
-rwxr-xr-xvpn/vpn-polkit.conf4
4 files changed, 17 insertions, 4 deletions
diff --git a/vpn/connman-vpn.service.in b/vpn/connman-vpn.service.in
index 6cc59cb..a4c294e 100755
--- a/vpn/connman-vpn.service.in
+++ b/vpn/connman-vpn.service.in
@@ -5,12 +5,14 @@ After=dbus.socket
[Service]
Type=dbus
+User=network_fw
+Group=network_fw
BusName=net.connman.vpn
SmackProcessLabel=System
-ExecStart=@sbindir@/connman-vpnd -n
+ExecStart=@bindir@/connman-vpnd -n
StandardOutput=null
-CapabilityBoundingSet=~CAP_MAC_ADMIN
-CapabilityBoundingSet=~CAP_MAC_OVERRIDE
+Capabilities=cap_net_admin,cap_net_bind_service,cap_net_broadcast,cap_net_raw=i
+SecureBits=keep-caps
[Install]
WantedBy=multi-user.target
diff --git a/vpn/net.connman.vpn.service.in b/vpn/net.connman.vpn.service.in
index 8dcf254..8ce55c2 100755
--- a/vpn/net.connman.vpn.service.in
+++ b/vpn/net.connman.vpn.service.in
@@ -1,5 +1,6 @@
[D-BUS Service]
Name=net.connman.vpn
Exec=/bin/false
-User=root
+User=network_fw
+Group=network_fw
SystemdService=connman-vpn.service
diff --git a/vpn/vpn-dbus.conf b/vpn/vpn-dbus.conf
index 5b44017..7b7b6d1 100755
--- a/vpn/vpn-dbus.conf
+++ b/vpn/vpn-dbus.conf
@@ -4,6 +4,12 @@
<policy user="root">
<allow own="net.connman.vpn"/>
<allow send_destination="net.connman.vpn"/>
+ <allow send_interface="net.connman.vpn.Agent"/>
+ </policy>
+ <policy user="network_fw">
+ <allow own="net.connman.vpn"/>
+ <allow send_destination="net.connman.vpn"/>
+ <allow send_interface="net.connman.vpn.Agent"/>
</policy>
<policy at_console="true">
<allow send_destination="net.connman.vpn"/>
diff --git a/vpn/vpn-polkit.conf b/vpn/vpn-polkit.conf
index a1dc617..237d21b 100755
--- a/vpn/vpn-polkit.conf
+++ b/vpn/vpn-polkit.conf
@@ -5,6 +5,10 @@
<allow own="net.connman.vpn"/>
<allow send_interface="net.connman.vpn.Agent"/>
</policy>
+ <policy user="network_fw">
+ <allow own="net.connman.vpn"/>
+ <allow send_interface="net.connman.vpn.Agent"/>
+ </policy>
<policy context="default">
<allow send_destination="net.connman.vpn"/>
</policy>