From 020d6c1dcee94826b16788125e092be1bcefb2c7 Mon Sep 17 00:00:00 2001
From: Lennart Poettering <lennart@poettering.net>
Date: Thu, 5 Jun 2025 10:58:54 +0200
Subject: [PATCH] machined: open up OpenMachinePTY() for unpriv clients
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The method call already does a PK check, it was just forgotten to
allowlist this in the dbus policy. And in the dbus vtable for
OpenMachinePTY() call. (It was allowlisted in the per-machine
vtable…)

Anyway, clean this up.
---
 man/org.freedesktop.machine1.xml          | 1 -
 src/machine/machined-dbus.c               | 2 +-
 src/machine/org.freedesktop.machine1.conf | 8 ++++++++
 3 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/man/org.freedesktop.machine1.xml b/man/org.freedesktop.machine1.xml
index 936f2ad7f2..e2ec4a1147 100644
--- a/man/org.freedesktop.machine1.xml
+++ b/man/org.freedesktop.machine1.xml
@@ -94,7 +94,6 @@ node /org/freedesktop/machine1 {
                         out s ssh_private_key_path);
       GetMachineOSRelease(in  s name,
                           out a{ss} fields);
-      @org.freedesktop.systemd1.Privileged("true")
       OpenMachinePTY(in  s name,
                      out h pty,
                      out s pty_path);
diff --git a/src/machine/machined-dbus.c b/src/machine/machined-dbus.c
index 616bea54f8..954f20e455 100644
--- a/src/machine/machined-dbus.c
+++ b/src/machine/machined-dbus.c
@@ -948,7 +948,7 @@ const sd_bus_vtable manager_vtable[] = {
                                 SD_BUS_ARGS("s", name),
                                 SD_BUS_RESULT("h", pty, "s", pty_path),
                                 method_open_machine_pty,
-                                0),
+                                SD_BUS_VTABLE_UNPRIVILEGED),
         SD_BUS_METHOD_WITH_ARGS("OpenMachineLogin",
                                 SD_BUS_ARGS("s", name),
                                 SD_BUS_RESULT("h", pty, "s", pty_path),
diff --git a/src/machine/org.freedesktop.machine1.conf b/src/machine/org.freedesktop.machine1.conf
index bafc1affdb..c3c8149f9a 100644
--- a/src/machine/org.freedesktop.machine1.conf
+++ b/src/machine/org.freedesktop.machine1.conf
@@ -72,6 +72,10 @@
                        send_interface="org.freedesktop.machine1.Manager"
                        send_member="OpenMachineLogin"/>
 
+                <allow send_destination="org.freedesktop.machine1"
+                       send_interface="org.freedesktop.machine1.Manager"
+                       send_member="OpenMachinePTY"/>
+
                 <allow send_destination="org.freedesktop.machine1"
                        send_interface="org.freedesktop.machine1.Manager"
                        send_member="OpenMachineShell"/>
@@ -176,6 +180,10 @@
                        send_interface="org.freedesktop.machine1.Machine"
                        send_member="OpenLogin"/>
 
+                <allow send_destination="org.freedesktop.machine1"
+                       send_interface="org.freedesktop.machine1.Machine"
+                       send_member="OpenPTY"/>
+
                 <allow send_destination="org.freedesktop.machine1"
                        send_interface="org.freedesktop.machine1.Machine"
                        send_member="OpenShell"/>