+++ This bug was initially created as a clone of Bug #1217191

This was found via the kde6 reviews and whitelistings going on currently.

The new kauth starting with version v5.245.0 generates D-Bus configuration
files containing the following default access policy:

    <policy context="default">
      <allow send_destination="*"/>
    </policy>

This affects _all_ D-Bus services not only the one that the configuration file
is about. Instead this would need to read something like

    <allow send_destination="org.kde.some.destination"/>

This bad configuration has the effect that everybody may now talk to _all_
D-Bus services, even if this shouldn't be the case. Most D-Bus services on the
system bus are accessible to all users, but not all. A simple reproducer on
current Tumbleweed is testing with ratbagd:

    root# zypper in zypper in ratbagd

    nobody$ gdbus introspect -y -d org.freedesktop.ratbag1 -o /org/freedesktop/ratbag1
    Error: GDBus.Error:org.freedesktop.DBus.Error.AccessDenied
    [...]

This is the _expected_ output. But once one of the KDE6 configuration files
e.g. from kde-inotify-survey is installed, the access is granted. The outcome
for other packages may vary also depending on the alphabetical order in which
files are processed in /usr/share/dbus-1/system.d.

The change in kauth that introduced this is this commit:

    https://invent.kde.org/frameworks/kauth/-/commit/d7916401a335d3a71d617333a471d3c5f20d5cf5

And the merge request for this commit is found here:

    https://invent.kde.org/frameworks/kauth/-/merge_requests/44

A reviewer even suggested to do the right thing, but it still wasn't done.

KDE security needs to be involved to fix this.

I already wrongly whitelisted a bunch of KDE6 services using these bad
configuration files. They should not hit Factory yet though, hopefully.