|
|
解决了,怪我没看wiki里HAL的troubleshooting。
----------------------------------------------------------------------------------------------------
看wiki没看懂,如果allow了group, 到底用不用再allow 特定的user?如果默认配置全是deny的,为什么我这里什么都没改就默认allow?需要改成deny吗?
这是我的hal.conf
<!DOCTYPE busconfig PUBLIC
"-//freedesktop//DTD D-BUS Bus Configuration 1.0//EN"
"http://www.freedesktop.org/standards/dbus/1.0/busconfig.dtd">
<busconfig>
<!-- This configuration file specifies the required security policies
for the HAL to work. -->
<!-- Only root or user hal can own the HAL service -->
<policy user="hal">
<allow own="org.freedesktop.Hal"/>
</policy>
<policy user="root">
<allow own="org.freedesktop.Hal"/>
</policy>
<!-- Allow anyone to invoke methods on the Manager and Device interfaces -->
<policy context="default">
<allow send_destination="org.freedesktop.Hal"
send_interface="org.freedesktop.DBus.Introspectable"/>
<allow send_destination="org.freedesktop.Hal"
send_interface="org.freedesktop.DBus.Properties" />
<allow send_destination="org.freedesktop.Hal"
send_interface="org.freedesktop.Hal.Device"/>
<allow send_destination="org.freedesktop.Hal"
send_interface="org.freedesktop.Hal.Manager"/>
<allow send_destination="org.freedesktop.Hal"
send_interface="org.freedesktop.Hal.Device.CPUFreq"/>
<allow send_destination="org.freedesktop.Hal"
send_interface="org.freedesktop.Hal.Device.DockStation"/>
<allow send_destination="org.freedesktop.Hal"
send_interface="org.freedesktop.Hal.Device.KillSwitch"/>
<allow send_destination="org.freedesktop.Hal"
send_interface="org.freedesktop.Hal.Device.KeyboardBacklight"/>
<allow send_destination="org.freedesktop.Hal"
send_interface="org.freedesktop.Hal.Device.LaptopPanel"/>
<allow send_destination="org.freedesktop.Hal"
send_interface="org.freedesktop.Hal.Device.Leds"/>
<allow send_destination="org.freedesktop.Hal"
send_interface="org.freedesktop.Hal.Device.LightSensor"/>
<allow send_destination="org.freedesktop.Hal"
send_interface="org.freedesktop.Hal.Device.Storage"/>
<allow send_destination="org.freedesktop.Hal"
send_interface="org.freedesktop.Hal.Device.Storage.Removable"/>
<allow send_destination="org.freedesktop.Hal"
send_interface="org.freedesktop.Hal.Device.SystemPowerManagement"/>
<allow send_destination="org.freedesktop.Hal"
send_interface="org.freedesktop.Hal.Device.Volume"/>
<allow send_destination="org.freedesktop.Hal"
send_interface="org.freedesktop.Hal.Device.Volume.Crypto"/>
<allow send_destination="org.freedesktop.Hal"
send_interface="org.freedesktop.Hal.Device.WakeOnLan"/>
</policy>
<policy group="power">
<allow send_interface="org.freedesktop.Hal.Device.SystemPowerManagement"/>
<allow send_interface="org.freedesktop.Hal.Device.LaptopPanel"/>
</policy>
<policy group="storage">
<allow send_interface="org.freedesktop.Hal.Device.Volume"/>
<allow send_interface="org.freedesktop.Hal.Device.Volume.Crypto"/>
</policy>
</busconfig>
以及我的例外策略:
<!-- This configuration file controls the systemwide message bus.
Add a system-local.conf and edit that rather than changing this
file directly. -->
<!-- Note that there are any number of ways you can hose yourself
security-wise by screwing up this file; in particular, you
probably don't want to listen on any more addresses, add any more
auth mechanisms, run as a different user, etc. -->
<!DOCTYPE busconfig PUBLIC "-//freedesktop//DTD D-Bus Bus Configuration 1.0//EN"
"http://www.freedesktop.org/standards/dbus/1.0/busconfig.dtd">
<busconfig>
<!-- Our well-known bus type, do not change this -->
<type>system</type>
<!-- Run as special user -->
<user>dbus</user>
<!-- Fork into daemon mode -->
<fork/>
<!-- We use system service launching using a helper -->
<standard_system_servicedirs/>
<!-- This is a setuid helper that is used to launch system services -->
<servicehelper>/usr/lib/dbus-1.0/dbus-daemon-launch-helper</servicehelper>
<!-- Write a pid file -->
<pidfile>/var/run/dbus.pid</pidfile>
<!-- Enable logging to syslog -->
<syslog/>
<!-- Only allow socket-credentials-based authentication -->
<auth>EXTERNAL</auth>
<!-- Only listen on a local socket. (abstract=/path/to/socket
means use abstract namespace, don't really create filesystem
file; only Linux supports this. Use path=/whatever on other
systems.) -->
<listen>unix:path=/var/run/dbus/system_bus_socket</listen>
<policy context="default">
<!-- All users can connect to system bus -->
<allow user="*"/> |
|