Add dbus-*.call and dbus-*.broadcast commands

This allows setting per-member and per-object path policies for
xdg-dbus-proxy.

1 files changed, 28 insertions, 0 deletions

diff --git a/src/firejail/profile.c b/src/firejail/profile.c
index f2959686a..699ca4bea 100644
--- a/src/firejail/profile.c
+++ b/src/firejail/profile.c
@@ -473,6 +473,20 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
                 }
                 return 1;
         }
+        else if (strncmp(ptr, "dbus-user.call ", 15) == 0) {
+                if (!dbus_check_call_rule(ptr + 15)) {
+                        fprintf(stderr, "Invalid dbus-user.call rule: %s\n", ptr + 15);
+                        exit(1);
+                }
+                return 1;
+        }
+        else if (strncmp(ptr, "dbus-user.broadcast ", 20) == 0) {
+                if (!dbus_check_call_rule(ptr + 20)) {
+                        fprintf(stderr, "Invalid dbus-user.broadcast rule: %s\n", ptr + 20);
+                        exit(1);
+                }
+                return 1;
+        }
         else if (strncmp("dbus-system ", ptr, 12) == 0) {
                 ptr += 12;
                 if (strcmp("filter", ptr) == 0) {
@@ -510,6 +524,20 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
                 }
                 return 1;
         }
+        else if (strncmp(ptr, "dbus-system.call ", 17) == 0) {
+                if (!dbus_check_call_rule(ptr + 17)) {
+                        fprintf(stderr, "Invalid dbus-system.call rule: %s\n", ptr + 17);
+                        exit(1);
+                }
+                return 1;
+        }
+        else if (strncmp(ptr, "dbus-system.broadcast ", 22) == 0) {
+                if (!dbus_check_call_rule(ptr + 22)) {
+                        fprintf(stderr, "Invalid dbus-system.broadcast rule: %s\n", ptr + 22);
+                        exit(1);
+                }
+                return 1;
+        }
         else if (strcmp(ptr, "nou2f") == 0) {
                 arg_nou2f = 1;
                 return 0;