Comment 55 for bug 306362

(In reply to comment #49)
> Here is a first pass through the system.d directory.

Some thoughts...

--- system.d/avahi-dbus.conf

There are few receive_sender rules there as well that should only be needed for signals, so their fate actually depends on what the default for signals will be.

--- system.d/ConsoleKit.conf

Did you leave user="root" rules unchanged intentionally? They look like a good candidate for allow send_destination. Why not remove all those context="default" deny rules and only keep explicit allows.

The similar comments apply to gdm.conf.

--- system.d/dnsmasq.conf

Rule <allow send_interface="uk.org.thekelleys.dnsmasq"/> should only be needed for signal sending, so is candidate for removal if signals are permitted by default.

--- system.d/newprinternotification.conf

- <allow send_interface="com.redhat.NewPrinterNotification"/>

Again, may be needed for signals.

--- system.d/org.fedoraproject.Config.Services.conf

I'd prefer to see allow send_destination rule removed from user="root" section. All context="default" rules apply to root as well, so having the rule only there should be sufficient.

--- system.d/org.gnome.ClockApplet.Mechanism.conf

This seems incorrect to me. Probably something like this is needed:

@@ -8,12 +8,12 @@
   <!-- Only root can own the service -->
   <policy user="root">
     <allow own="org.gnome.ClockApplet.Mechanism"/>
- <allow send_interface="org.gnome.ClockApplet.Mechanism.SetTimezoneInterface"/>
   </policy>

   <!-- Allow anyone to invoke methods on the interfaces -->
   <policy context="default">
- <allow send_interface="org.gnome.ClockApplet.Mechanism.SetTimezoneInterface"/>
+ <allow send_destination="org.gnome.ClockApplet.Mechanism"
+ send_interface="org.gnome.ClockApplet.Mechanism.SetTimezoneInterface"/>
   </policy>

 </busconfig>

Not sure if binding to a particular interface is really needed.

--- system.d/org.gnome.*

Allow rules in user="root" section can be omitted when service should be accessible to all users and there's context="default" allow rule.

--- system.d/setroubleshootd.conf

It may requires some of the removed rules, or allow receive_sender rule for signal handling.

Similar probably applies to yum-updatesd.conf as well.