mcptd: Replace root in suggested configs

Allow mctpd, which should be an unprivileged user, to run the daemon
with minimum capabilities.

mctpd needs CAP_NET_BIND_SERVICE and CAP_NET_ADMIN, so those have been
added to AmbientCapabilities in the service config.

The mctpd user has been allowed to own the au.com.codeconstruct.MCTP1
object as well as root. root also retains the right to own the object,
meaning the config remains valid if the daemon is run as root.

Unprivileged users can only access properties and are prohibited from
configuring the network.

Root and users in the mctp-admin group are permitted to interact with
any method the daemon provides.

For some setups, it may be useful to create a group with permissions to
use the RegisterTypeSupport or RegisterVDMTypeSupport methods so that
programs may register support without being given permission to modify
the network characteristics.

Signed-off-by: James Lee <james@codeconstruct.com.au>

Author: SafetyInObscurity

conf/mctpd-dbus.conf

@@ -2,9 +2,33 @@
 <!DOCTYPE busconfig PUBLIC "-//freedesktop//DTD D-BUS Bus Configuration 1.0//EN"
         "http://www.freedesktop.org/standards/dbus/1.0/busconfig.dtd">
 <busconfig>
+ <policy context="default">
+  <deny send_destination="au.com.codeconstruct.MCTP1">
+
+  <allow receive_sender="au.com.codeconstruct.MCTP1"/>
+
+  <allow send_destination="au.com.codeconstruct.MCTP1"
+         send_interface="org.freedesktop.DBus.Propeties"
+         send_member="Get"/>
+
+  <allow send_destination="au.com.codeconstruct.MCTP1"
+         send_interface="org.freedesktop.DBus.Propeties"
+         send_member="GetAll"/>
+
+  <allow send_destination="au.com.codeconstruct.MCTP1"
+         send_interface="org.freedesktop.DBus.Introspectable"/>
+
+  <allow send_destination="au.com.codeconstruct.MCTP1"
+         send_interface="org.freedesktop.DBus.ObjectManager"/>
+ </policy>
+ <policy user="mctpd">
+  <allow own="au.com.codeconstruct.MCTP1"/>
+ </policy>
+ <policy group="mctp-admin">
+  <allow send_destination="au.com.codeconstruct.MCTP1"/>
+ </policy>
  <policy user="root">
   <allow own="au.com.codeconstruct.MCTP1"/>
   <allow send_destination="au.com.codeconstruct.MCTP1"/>
-  <allow receive_sender="au.com.codeconstruct.MCTP1"/>
  </policy>
 </busconfig>

conf/mctpd.service

@@ -8,6 +8,8 @@ After=mctp-local.target
 Type=dbus
 BusName=au.com.codeconstruct.MCTP1
 ExecStart=/usr/sbin/mctpd
+User=mctpd
+AmbientCapabilities=CAP_NET_BIND_SERVICE CAP_NET_ADMIN
 
 [Install]
 WantedBy=mctp.target