Usually, this "<allow send_destination="..."/>" part is shipped
by firewalld's D-Bus policy. However, if firewalld is initially
not installed with NetworkManager already running, dbus-daemon
seems to cache the missing permission for the D-Bus connection.
As a result, when installing and starting firewalld, NetworkManager
requests fail until restart:

  firewall: [0x7f4b83643890,change:"eth1"]: complete: request failed (Rejected send message, 1 matched rules; type="method_call", sender=":1.3" (uid=0 pid=715 comm="/usr/sbin/NetworkManager --no-daemon ") interface="org.fedoraproject.FirewallD1.zone" member="changeZone" error name="(unset)" requested_reply="0" destination=":1.25" (uid=0 pid=1243 comm="/usr/bin/python -Es /usr/sbin/firewalld --nofork -"))

https://bugzilla.redhat.com/show_bug.cgi?id=1436770
(cherry picked from commit cc1d409ba886e8e7c33f845790cfc700fcd2d854)

(cherry picked from commit 8583e62276a23a7ea858edf6c71d122e22f41955)

Use DBus to make nameserver updates rather than restarting the dnsmasq binary
again and again.

Signed-off-by: Mathieu Trudel-Lapierre <mathieu.trudel-lapierre@canonical.com>

https://mail.gnome.org/archives/networkmanager-list/2016-March/msg00144.html

It does more than intended; apart from denying messages to that particular
interface it also denies all messages non-qualified with an
interface globally.
This blocks messages completely unrelated to wpa_supplicant, such as
NetworkManager communication with the VPN plugins.

From the dbus-daemon manual:

  Be careful with send_interface/receive_interface, because the
  interface field in messages is optional. In particular, do NOT
  specify <deny send_interface="org.foo.Bar"/>! This will cause
  no-interface messages to be blocked for all services, which is
  almost certainly not what you intended. Always use rules of the form:
  <deny send_interface="org.foo.Bar" send_destination="org.foo.Service"/>

We can just safely remove those rules, since we're sufficiently protected
by the send_destination matches and method calls are disallowed by default
anyway.

https://bugzilla.gnome.org/show_bug.cgi?id=763880

D-Bus has an upper limit on number of Match rules and it's rather easy
to hit as the proxy likes to add one for each object. Let's remove the Match
rule the proxy added and ensure a less granular rule is present instead.

Ideally, we should be able to tell glib not to hook its rules.
Related: https://bugzilla.gnome.org/show_bug.cgi?id=758749

https://bugzilla.gnome.org/show_bug.cgi?id=758751

NMExportedObject now derives from GDBusObjectSkeleton, which is what
GDBusObjectManagerServer wants.  The main GDBusConnection and each
private server connection now gets a new GDBusObjectManagerServer,
and exported objects are registered with that instead of individually
exporting each GDBusInterfaceSkeleton.

Previously exported objects were not referenced by the BusManager,
but instead removed from the exports hash via weak references.  The
GDBusObjectManagerServer instead references exported objects, which
can make them live much longer than they did before.

Co-Authored-By: Thomas Haller <thaller@redhat.com>

It does more than intended; apart from denying messages to that particular
interface it also denies all messages non-qualified with an interface globally.
From the dbus-daemon manual:

  Be careful with send_interface/receive_interface, because the
  interface field in messages is optional. In particular, do NOT
  specify <deny send_interface="org.foo.Bar"/>! This will cause
  no-interface messages to be blocked for all services, which is almost
  certainly not what you intended. Always use rules of the form: <deny
  send_interface="org.foo.Bar" send_destination="org.foo.Service"/>

We can just safely remove those rules, since we're sufficiently protected
by the send_destination matches and method calls are disallowed by default
anyway.