biod/dbus/org.chromium.BiometricsDaemon.conf

<!DOCTYPE busconfig PUBLIC
 "-//freedesktop//DTD D-BUS Bus Configuration 1.0//EN"
 "http://www.freedesktop.org/standards/dbus/1.0/busconfig.dtd">
<!--
  Copyright 2016 The ChromiumOS Authors
  Use of this source code is governed by a BSD-style license that can be
  found in the LICENSE file.

  This file will be installed at /etc/dbus-1/system.d on Chromium OS.
-->
<busconfig>
  <policy context="default">
    <deny send_destination="org.chromium.BiometricsDaemon" />
  </policy>

  <!--
    Allow root to send messages to biod because cryptohome needs to talk with
    biod for fingerprint protocols.
  -->
  <policy user="root">
    <allow send_destination="org.chromium.BiometricsDaemon" />
  </policy>

  <!--
    User `chronos` is given access to send messages to biod because chronos is
    the user that the browser uses.
  -->
  <policy user="chronos">
    <allow send_destination="org.chromium.BiometricsDaemon" />
  </policy>

  <!--
    User `power` needs to send messages to biod, so we can get information about
    power button presses.
  -->
  <policy user="power">
    <allow send_destination="org.chromium.BiometricsDaemon" />
  </policy>

  <policy user="biod">
    <allow own="org.chromium.BiometricsDaemon" />
  </policy>
</busconfig>