From 0168430d91851fbd06952df1e2e786cbd1fd4a21 Mon Sep 17 00:00:00 2001
From: Semyon Klintsov <semen.klincov@red-soft.ru>
Date: Wed, 5 Aug 2026 11:33:48 +0300
Subject: [PATCH] dbus: allow FreezeUnit and ThawUnit D-Bus requests (#43292)

This change adds explicit D-Bus policy rules to allow calling the
Freeze and Thaw methods on the systemd interfaces.

- Add D-Bus policy rules for Manager interface FreezeUnit/ThawUnit methods
- Add D-Bus policy rules for Unit interface Freeze/Thaw methods
---
 src/core/org.freedesktop.systemd1.conf | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/src/core/org.freedesktop.systemd1.conf b/src/core/org.freedesktop.systemd1.conf
index 32f5b8848d6..802c8ef3365 100644
--- a/src/core/org.freedesktop.systemd1.conf
+++ b/src/core/org.freedesktop.systemd1.conf
@@ -378,6 +378,14 @@
                        send_interface="org.freedesktop.systemd1.Manager"
                        send_member="UnsetAndSetEnvironment"/>
 
+                <allow send_destination="org.freedesktop.systemd1"
+                       send_interface="org.freedesktop.systemd1.Manager"
+                       send_member="FreezeUnit"/>
+
+                <allow send_destination="org.freedesktop.systemd1"
+                       send_interface="org.freedesktop.systemd1.Manager"
+                       send_member="ThawUnit"/>
+
                 <!-- Managed via polkit or other criteria: org.freedesktop.systemd1.Job interface -->
 
                 <allow send_destination="org.freedesktop.systemd1"
@@ -450,6 +458,14 @@
                        send_interface="org.freedesktop.systemd1.Unit"
                        send_member="Unref"/>
 
+                <allow send_destination="org.freedesktop.systemd1"
+                       send_interface="org.freedesktop.systemd1.Unit"
+                       send_member="Freeze"/>
+
+                <allow send_destination="org.freedesktop.systemd1"
+                       send_interface="org.freedesktop.systemd1.Unit"
+                       send_member="Thaw"/>
+
                 <!-- Managed via polkit or other criteria: org.freedesktop.systemd1.Service interface -->
 
                 <allow send_destination="org.freedesktop.systemd1"