From 46a2b3f0ce86226ebaccd85afd355f905d55a858 Mon Sep 17 00:00:00 2001
From: Sven Sager <akira@narux.de>
Date: Fri, 18 Apr 2025 14:12:43 +0200
Subject: [PATCH] feat(dbus): Add DBus policy configuration for
 revpi-middleware

Introduce a new DBus policy file to manage access control for
revpi-middleware. This configuration allows full access to the root
user, limited access for the 'picontrol' group, and denies unauthorized
access by default.
---
 .../com.revolutionpi.middleware1.conf         | 22 +++++++++++++++++++
 1 file changed, 22 insertions(+)
 create mode 100644 data/dbus-policy/com.revolutionpi.middleware1.conf

diff --git a/data/dbus-policy/com.revolutionpi.middleware1.conf b/data/dbus-policy/com.revolutionpi.middleware1.conf
new file mode 100644
index 0000000..0118123
--- /dev/null
+++ b/data/dbus-policy/com.revolutionpi.middleware1.conf
@@ -0,0 +1,22 @@
+<!-- /etc/dbus-1/system.d/revpi-middleware.conf -->
+<busconfig>
+    <!-- Allow full access to root as the bus owner -->
+    <policy user="root">
+        <allow own="com.revolutionpi.middleware1"/>
+        <allow send_destination="com.revolutionpi.middleware1"/>
+        <allow receive_sender="com.revolutionpi.middleware1"/>
+    </policy>
+
+    <!-- System group picontrol -->
+    <policy group="picontrol">
+        <allow send_destination="com.revolutionpi.middleware1"
+               send_interface="org.freedesktop.DBus.Introspectable"/>
+        <allow send_destination="com.revolutionpi.middleware1"
+               send_interface="com.revolutionpi.middleware1.picontrol"/>
+    </policy>
+
+    <!-- Standard-Policy -->
+    <policy context="default">
+        <deny send_destination="com.revolutionpi.middleware1"/>
+    </policy>
+</busconfig>