From 6c182b8e9bb191dae8d308873732c860041f0719 Mon Sep 17 00:00:00 2001
From: Matthias Gerstner <matthias.gerstner@suse.de>
Date: Thu, 25 Jan 2018 18:06:50 +0100
Subject: [PATCH] meson/dbus: support build time option to restrict D-Bus
 access

This change makes it possible to pass '-Ddbus-group=<group>' to limit
the access to the ratbagd D-Bus service. The default remains to allow
everyone access to the service.

This allows integrators to choose more conservative security settings
e.g. only allowing users in the 'games' group to talk to the ratbagd
daemon.
---
 ...1.conf => org.freedesktop.ratbag1.conf.in} |  3 +--
 meson.build                                   | 19 +++++++++++++++++--
 meson_options.txt                             |  5 +++++
 3 files changed, 23 insertions(+), 4 deletions(-)
 rename dbus/{org.freedesktop.ratbag1.conf => org.freedesktop.ratbag1.conf.in} (88%)

diff --git a/dbus/org.freedesktop.ratbag1.conf b/dbus/org.freedesktop.ratbag1.conf.in
similarity index 88%
rename from dbus/org.freedesktop.ratbag1.conf
rename to dbus/org.freedesktop.ratbag1.conf.in
index f4edc1e1..97229979 100644
--- a/dbus/org.freedesktop.ratbag1.conf
+++ b/dbus/org.freedesktop.ratbag1.conf.in
@@ -11,8 +11,7 @@
                 <allow receive_sender="org.freedesktop.ratbag1"/>
         </policy>
 
-	<!-- allow everyone to talk to the daemon -->
-        <policy context="default">
+        <policy @access@>
                 <allow send_destination="org.freedesktop.ratbag1"/>
                 <allow receive_sender="org.freedesktop.ratbag1"/>
         </policy>
diff --git a/meson.build b/meson.build
index ec9fa3fe..588dbca2 100644
--- a/meson.build
+++ b/meson.build
@@ -467,8 +467,23 @@ configure_file(input : 'dbus/org.freedesktop.ratbag1.service.in',
 	       output : 'org.freedesktop.ratbag1.service',
 	       configuration : config_bindir,
 	       install_dir : join_paths(dbusdir, 'system-services'))
-install_data('dbus/org.freedesktop.ratbag1.conf',
-	     install_dir : join_paths(dbusdir, 'system.d'))
+
+dbusgroup = get_option('dbus-group')
+if dbusgroup == ''
+	# grant everybody access by default
+	access = 'context="default"'
+else
+	# grant access to members of the specified group only
+	access = 'group="@0@"'.format(dbusgroup)
+endif
+
+config_dbusaccess = configuration_data()
+config_dbusaccess.set('access', access)
+
+configure_file(input : 'dbus/org.freedesktop.ratbag1.conf.in',
+	       output : 'org.freedesktop.ratbag1.conf',
+	       configuration : config_dbusaccess,
+	       install_dir : join_paths(dbusdir, 'system.d'))
 
 #### tools ####
 
diff --git a/meson_options.txt b/meson_options.txt
index f761ad8e..cd164b42 100644
--- a/meson_options.txt
+++ b/meson_options.txt
@@ -22,3 +22,8 @@ option('documentation',
 	type: 'boolean',
 	value: false,
 	description: 'Enable documentation build (default=no)')
+
+option('dbus-group',
+	type: 'string',
+	value : '',
+	description : 'The UNIX group that is granted access to the ratbagd D-Bus service. By default all users may access it.')