NAME

       oddjobd.conf - configuration for oddjobd

DESCRIPTION

       The /etc/oddjobd.conf configuration file specifies which services the oddjobd server provides over the D-
       Bus, and authorization rules which are enforced in addition to those enforced by the system message bus.

       The configuration file is an XML document.  The top-level element type is <oddjobconfig>, which  contains
       one or more <service> elements.  Each <service> describes a service which will be provided on the system-
       wide message bus.

       Each <object> describes an object path which will will be  recognized  by  the  specified  service.   The
       object path may include wildcards, in which case any call to an object with a path name which matches the
       specified path will be accepted.  An object contains one or more  <interface>  elements,  each  of  which
       describes a group of methods described in <method> elements.

       Each  <method>  element  must specify the method name as a value for its name attribute and may include a
       <helper> element which the name of an executable to run as its exec attribute and the number of arguments
       which  will  be  expected from the D-Bus client and passed to the helper as its argument_count attribute.
       The <helper>'s exec attribute can include  one  or  more  command  line  arguments,  separated  from  the
       executable  by whitespace.  A <helper> may also include attributes indicating whether or not the invoking
       user's name should be prepended to  the  list  of  arguments  received  as  part  of  the  D-Bus  request
       (prepend_user_name,  with  recognized  values "yes" or "no"), and whether that set of arguments should be
       passed in to the helper via stdin (the default) or on its  command  line  (argument_passing_method,  with
       recognized values "stdin" and "cmdline").

       Each <oddjobconfig>, <service>, <object>, <interface>, or <method> element may also include authorization
       elements <allow> and <deny>.  Each <allow> or <deny> rule specifies  some  combination  of  a  user  name
       and/or a UID range which the invoking user must match for the rule to apply.  A rule can also specify the
       caller's SELinux context, user, role, or execution domain, and be applied or not based on whether or  not
       policy  is  being  enforced.   All  <deny> rules for the method are checked first, followed by all of its
       <allow> rules.  If no matches are found, the <deny> rules for  the  containing  <interface>  element  are
       checked,  followed  by  its  <allow>  rules, and so on.  If all ACLs are searched and no matches turn up,
       access is denied.

       The oddjobd server will automatically supply information used by the  D-Bus  introspection  mechanism  on
       behalf  of  your objects, but only if the client which is requesting the information is allowed to invoke
       the Introspect method of the org.freedesktop.DBus.Introspectable interface provided by the object.

       The configuration file may also indicate that  the  contents  of  other  files  should  be  read  by  the
       configuration parser, using an <include> element.

EXAMPLES

       Here is an example file:
        <?xml version="1.0"?>
        <oddjobconfig/>

       Another:
        <?xml version="1.0"?>
        <oddjobconfig>
         <allow user="wally"/>
         <service name="com.redhat.oddjob">
          <allow user="polly"/>
          <object name="/com/redhat/oddjob">
           <allow user="holly"/>
           <interface name="com.redhat.oddjob">
            <allow user="bob"/>
            <method name="pwd">
             <helper exec="/bin/pwd" argument_count="0" prepend_user_name="no"/>
             <allow user="jimmy"/>
             <allow user="billy"/>
             <allow min_uid="0" max_uid="1000"/>
            </method>
            <method name="reboot">
             <helper exec="/sbin/reboot" argument_count="0"/>
            </method>
            <method name="flush-nscd">
             <helper exec="/sbin/nscd -i passwd -i group -i hosts" argument_count="0"/>
            </method>
           </interface>
           <interface name="org.freedesktop.DBus.Introspectable">
            <allow min_uid="0" max_uid="0"/>
           </interface>
          </object>
         </service>
         <include ignore_missing="yes">/etc/oddjobd-local.conf</include>
         <include ignore_missing="yes">/etc/oddjobd.conf.d/*.conf</include>
        </oddjobconfig>

       And another:
        <?xml version="1.0"?>
        <oddjobconfig>
         <service name="com.example.management">
          <object name="/com/example/power">
           <interface name="com.example.shutdown">
            <method name="reboot">
             <allow user="root"/>
             <helper exec="/sbin/reboot" argument_count="0"/>
            </method>
           </interface>
           <interface name="org.freedesktop.DBus.Introspectable">
            <allow min_uid="0" max_uid="0"/>
           </interface>
          </object>
          <object name="/com/example/power">
           <interface name="com.example.shutdown">
            <method name="poweroff">
             <allow user="root"/>
             <helper exec="/sbin/poweroff" argument_count="0"/>
            </method>
           </interface>
           <interface name="org.freedesktop.DBus.Introspectable">
            <allow min_uid="0" max_uid="0"/>
           </interface>
          </object>
         </service>
        </oddjobconfig>

SEE ALSO

       oddjob_request(1) oddjob.conf(5) oddjobd(8)