From 6e10f9bec93bd285bea3737e85d066eae4176f5b Mon Sep 17 00:00:00 2001
From: CentOS Sources <bugs@centos.org>
Date: Aug 22 2023 15:22:01 +0000
Subject: import subscription-manager-1.24.52-2.el7_9


---

diff --git a/README.debrand b/README.debrand
deleted file mode 100644
index 01c46d2..0000000
--- a/README.debrand
+++ /dev/null
@@ -1,2 +0,0 @@
-Warning: This package was configured for automatic debranding, but the changes
-failed to apply.
diff --git a/SOURCES/00001-fix-dbus-policy.patch b/SOURCES/00001-fix-dbus-policy.patch
new file mode 100644
index 0000000..ee8bc45
--- /dev/null
+++ b/SOURCES/00001-fix-dbus-policy.patch
@@ -0,0 +1,99 @@
+diff --git a/etc-conf/dbus/system.d/com.redhat.RHSM1.conf b/etc-conf/dbus/system.d/com.redhat.RHSM1.conf
+index e21c57263..11adf1d79 100644
+--- a/etc-conf/dbus/system.d/com.redhat.RHSM1.conf
++++ b/etc-conf/dbus/system.d/com.redhat.RHSM1.conf
+@@ -7,23 +7,9 @@
+     <policy user="root">
+         <allow own="com.redhat.RHSM1"/>
+ 
+-        <!-- Basic D-Bus API stuff -->
+-        <allow send_destination="com.redhat.RHSM1"
+-            send_interface="org.freedesktop.DBus.Introspectable"/>
+-        <allow send_destination="com.redhat.RHSM1"
+-            send_interface="org.freedesktop.DBus.Properties"/>
+-        <allow send_destination="com.redhat.RHSM1"
+-            send_interface="org.freedesktop.DBus.ObjectManager"/>
+-
+-        <!-- allow Config.Set from root -->
+-        <allow send_destination="com.redhat.RHSM1"
+-            send_interface="com.redhat.RHSM1.Config"
+-            send_member="Set"/>
+-    </policy>
+-
+-
+-    <policy context="default">
+-        <!-- TODO: make these read-only by default -->
++        <!--
++        Lock down the objects to root access only
++        -->
+ 
+         <allow send_destination="com.redhat.RHSM1"
+             send_interface="com.redhat.RHSM1"/>
+@@ -37,11 +23,6 @@
+         <allow send_destination="com.redhat.RHSM1"
+             send_interface="com.redhat.RHSM1.Config"/>
+ 
+-        <!-- deny Config.Set by default -->
+-        <deny send_destination="com.redhat.RHSM1"
+-            send_interface="com.redhat.RHSM1.Config"
+-            send_member="Set"/>
+-
+         <allow send_destination="com.redhat.RHSM1"
+             send_interface="com.redhat.RHSM1.RegisterServer"/>
+ 
+@@ -65,5 +46,54 @@
+         <allow send_destination="com.redhat.RHSM1"
+             send_interface="org.freedesktop.DBus.ObjectManager"/>
+     </policy>
+-</busconfig>
+ 
++
++    <policy context="default">
++
++        <!--
++        Non-root users can execute only methods providing
++        information from files readable by non-root users.
++        -->
++
++        <allow send_destination="com.redhat.RHSM1"
++            send_interface="com.redhat.RHSM1.Entitlement"
++            send_member="GetStatus"/>
++
++        <allow send_destination="com.redhat.RHSM1"
++            send_interface="com.redhat.RHSM1.Products"
++            send_member="ListInstalledProducts"/>
++
++        <allow send_destination="com.redhat.RHSM1"
++            send_interface="com.redhat.RHSM1.Syspurpose"
++            send_member="GetSyspurpose"/>
++
++        <allow send_destination="com.redhat.RHSM1"
++            send_interface="com.redhat.RHSM1.Syspurpose"
++            send_member="GetSyspurposeStatus"/>
++
++        <allow send_destination="com.redhat.RHSM1"
++            send_interface="com.redhat.RHSM1.Config"
++            send_member="GetAll"/>
++
++        <allow send_destination="com.redhat.RHSM1"
++            send_interface="com.redhat.RHSM1.Config"
++            send_member="Get"/>
++
++        <!--
++        The UUID returned by following method is read
++        from consumer cert. Only this file is not
++        readable by non-root users.
++        -->
++        <allow send_destination="com.redhat.RHSM1"
++            send_interface="com.redhat.RHSM1.Consumer"
++            send_member="GetUuid"/>
++
++        <!-- Basic D-Bus API stuff -->
++        <allow send_destination="com.redhat.RHSM1"
++            send_interface="org.freedesktop.DBus.Introspectable"/>
++        <allow send_destination="com.redhat.RHSM1"
++            send_interface="org.freedesktop.DBus.Properties"/>
++        <allow send_destination="com.redhat.RHSM1"
++            send_interface="org.freedesktop.DBus.ObjectManager"/>
++    </policy>
++</busconfig>
diff --git a/SPECS/subscription-manager.spec b/SPECS/subscription-manager.spec
index 17a362d..2c62c10 100644
--- a/SPECS/subscription-manager.spec
+++ b/SPECS/subscription-manager.spec
@@ -134,7 +134,7 @@
 
 Name: subscription-manager
 Version: 1.24.52
-Release: 1%{?dist}
+Release: 2%{?dist}
 Summary: Tools and libraries for subscription and repository management
 Group:   System Environment/Base
 License: GPLv2
@@ -265,6 +265,8 @@ BuildRequires: systemd-rpm-macros
 BuildRequires: systemd
 %endif
 
+Patch00001: 00001-fix-dbus-policy.patch
+
 %description
 The Subscription Manager package provides programs and libraries to allow users
 to manage subscriptions and yum repositories from the Red Hat entitlement
@@ -526,6 +528,8 @@ Subscription Manager Cockpit UI
 %prep
 %setup -q
 
+%autopatch -p1
+
 %build
 make -f Makefile VERSION=%{version}-%{release} CFLAGS="%{optflags}" \
     LDFLAGS="%{__global_ldflags}" OS_DIST="%{dist}" PYTHON="%{__python}" \
@@ -1170,6 +1174,9 @@ gtk-update-icon-cache -f %{_datadir}/icons/hicolor &>/dev/null || :
 %endif
 
 %changelog
+* Tue Aug 08 2023 Jiri Hnidek <jhnidek@redhat.com> 1.24.52-2
+- 2229752: Fix D-Bus policy (jhnidek@redhat.com)
+
 * Tue Jun 27 2023 Pino Toscano <ptoscano@redhat.com> 1.24.52-1
 - tito: update rhel-7.9 releaser (ptoscano@redhat.com)
 - managercli: fix RestlibException reporting for get_current_owner()