cryptohome/etc/org.chromium.UserDataAuth.conf

<!--
  Copyright 2019 The Chromium OS Authors. All rights reserved.
  Use of this source code is governed by a BSD-style license that can be
  found in the LICENSE file.
-->

<!DOCTYPE busconfig PUBLIC "-//freedesktop//DTD D-BUS Bus Configuration 1.0//EN"
  "http://www.freedesktop.org/standards/dbus/1.0/busconfig.dtd">
<busconfig>
  <policy user="root">
    <allow own="org.chromium.UserDataAuth" />
    <allow send_destination="org.chromium.UserDataAuth" />
  </policy>

  <policy user="chronos">
    <!-- introspection is denied -->
    <deny send_destination="org.chromium.UserDataAuth"
          send_interface="org.freedesktop.DBus.Introspectable" />
    <!-- properties denied -->
    <deny send_destination="org.chromium.UserDataAuth"
          send_interface="org.freedesktop.DBus.Properties" />
    <!-- allow explicit methods -->
    <allow send_destination="org.chromium.UserDataAuth"
           send_interface="org.chromium.UserDataAuthInterface"
           send_member="IsMounted"/>
    <allow send_destination="org.chromium.UserDataAuth"
           send_interface="org.chromium.UserDataAuthInterface"
           send_member="Unmount"/>
    <allow send_destination="org.chromium.UserDataAuth"
           send_interface="org.chromium.UserDataAuthInterface"
           send_member="MountEx"/>
    <allow send_destination="org.chromium.UserDataAuth"
           send_interface="org.chromium.UserDataAuthInterface"
           send_member="RemoveEx"/>
    <allow send_destination="org.chromium.UserDataAuth"
           send_interface="org.chromium.UserDataAuthInterface"
           send_member="RenameCryptohome"/>
    <allow send_destination="org.chromium.UserDataAuth"
           send_interface="org.chromium.UserDataAuthInterface"
           send_member="GetAccountDiskUsage"/>
    <allow send_destination="org.chromium.UserDataAuth"
           send_interface="org.chromium.UserDataAuthInterface"
           send_member="ListKeysEx"/>
    <allow send_destination="org.chromium.UserDataAuth"
           send_interface="org.chromium.UserDataAuthInterface"
           send_member="GetKeyDataEx"/>
    <allow send_destination="org.chromium.UserDataAuth"
           send_interface="org.chromium.UserDataAuthInterface"
           send_member="CheckKeyEx"/>
    <allow send_destination="org.chromium.UserDataAuth"
           send_interface="org.chromium.UserDataAuthInterface"
           send_member="AddKeyEx"/>
    <allow send_destination="org.chromium.UserDataAuth"
           send_interface="org.chromium.UserDataAuthInterface"
           send_member="UpdateKeyEx"/>
    <allow send_destination="org.chromium.UserDataAuth"
           send_interface="org.chromium.UserDataAuthInterface"
           send_member="RemoveKeyEx"/>
    <allow send_destination="org.chromium.UserDataAuth"
           send_interface="org.chromium.UserDataAuthInterface"
           send_member="MigrateKeyEx"/>
    <allow send_destination="org.chromium.UserDataAuth"
           send_interface="org.chromium.UserDataAuthInterface"
           send_member="MigrateToDircrypto"/>
    <allow send_destination="org.chromium.UserDataAuth"
           send_interface="org.chromium.UserDataAuthInterface"
           send_member="NeedsDircryptoMigration"/>
    <allow send_destination="org.chromium.UserDataAuth"
           send_interface="org.chromium.UserDataAuthInterface"
           send_member="GetSupportedKeyPolicies"/>
    <allow send_destination="org.chromium.UserDataAuth"
           send_interface="org.chromium.UserDataAuthInterface"
           send_member="IsQuotaSupported"/>
    <allow send_destination="org.chromium.UserDataAuth"
           send_interface="org.chromium.UserDataAuthInterface"
           send_member="GetCurrentSpaceForUid"/>
    <allow send_destination="org.chromium.UserDataAuth"
           send_interface="org.chromium.UserDataAuthInterface"
           send_member="GetCurrentSpaceForGid"/>
  </policy>

  <policy context="default">
    <deny send_destination="org.chromium.UserDataAuth" />
  </policy>
</busconfig>