Add --dbus-user and --dbus-system options

Allow setting a separate policy for the user and system buses.
For now, the filter policy is equivalent to the none (block) policy.
Future commits will add more configuration options and filters.

1 files changed, 32 insertions, 3 deletions

diff --git a/src/firejail/profile.c b/src/firejail/profile.c
index d709a7951..14533ce08 100644
--- a/src/firejail/profile.c
+++ b/src/firejail/profile.c
@@ -150,7 +150,7 @@ static int check_netoptions(void) {
 }
 
 static int check_nodbus(void) {
-        return arg_nodbus != 0;
+        return arg_dbus_user != DBUS_POLICY_ALLOW || arg_dbus_system != DBUS_POLICY_ALLOW;
 }
 
 static int check_nosound(void) {
@@ -432,11 +432,40 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
                 return 0;
         }
         else if (strcmp(ptr, "nodbus") == 0) {
-                arg_nodbus = 1;
+                arg_dbus_user = DBUS_POLICY_BLOCK;
+                arg_dbus_system = DBUS_POLICY_BLOCK;
+                return 0;
+        }
+        else if (strncmp("dbus-user ", ptr, 10) == 0) {
+                ptr += 10;
+                if (strcmp("allow", ptr) == 0) {
+                        arg_dbus_user = DBUS_POLICY_ALLOW;
+                } else if (strcmp("filter", ptr) == 0) {
+                        arg_dbus_user = DBUS_POLICY_FILTER;
+                } else if (strcmp("none", ptr) == 0) {
+                        arg_dbus_user = DBUS_POLICY_BLOCK;
+                } else {
+                        fprintf(stderr, "Unknown dbus-user policy: %s\n", ptr);
+                        exit(1);
+                }
+                return 0;
+        }
+        else if (strncmp("dbus-system ", ptr, 12) == 0) {
+                ptr += 12;
+                if (strcmp("allow", ptr) == 0) {
+                        arg_dbus_system = DBUS_POLICY_ALLOW;
+                } else if (strcmp("filter", ptr) == 0) {
+                        arg_dbus_system = DBUS_POLICY_FILTER;
+                } else if (strcmp("none", ptr) == 0) {
+                        arg_dbus_system = DBUS_POLICY_BLOCK;
+                } else {
+                        fprintf(stderr, "Unknown dbus-system policy: %s\n", ptr);
+                        exit(1);
+                }
                 return 0;
         }
         else if (strcmp(ptr, "nou2f") == 0) {
-                arg_nou2f = 1;
+                arg_nou2f = 1;
                 return 0;
         }
         else if (strcmp(ptr, "netfilter") == 0) {