Patch from Colin Walters for http://bugs.freedesktop.org/show_bug.cgi?id=19020,
adapted to apply to Debian's ConsoleKit.

He writes:
> This patch is relatively conservative; it adds send_destination= to all the
> rules (as is very important, see
> https://bugs.freedesktop.org/show_bug.cgi?id=18961).
>
> It also adds SetIdleHint into the default allow.  From the source it looks that
> that method implementation checks the caller.
>
> Please review.  
>
> Also an open question - do all the methods verify their caller?  In that case
> the policy file can be *much* simpler; see:
> http://lists.freedesktop.org/archives/dbus/2008-December/010717.html

--- a/data/ConsoleKit.conf	2009-01-06 02:59:15.000000000 +0000
+++ b/data/ConsoleKit.conf	2009-01-06 03:04:38.000000000 +0000
@@ -8,89 +8,129 @@
     <allow own="org.freedesktop.ConsoleKit"/>
 
     <!-- Allow all methods on interfaces -->
-    <allow send_interface="org.freedesktop.ConsoleKit.Manager"/>
-    <allow send_interface="org.freedesktop.ConsoleKit.Seat"/>
-    <allow send_interface="org.freedesktop.ConsoleKit.Session"/>
+    <allow send_destination="org.freedesktop.ConsoleKit"/>
   </policy>
 
   <!-- Deny all and then allow some methods on interfaces -->
   <policy context="default">
-    <deny send_interface="org.freedesktop.ConsoleKit.Manager"/>
-    <deny send_interface="org.freedesktop.ConsoleKit.Seat"/>
-    <deny send_interface="org.freedesktop.ConsoleKit.Session"/>
+    <allow send_destination="org.freedesktop.ConsoleKit"
+           send_interface="org.freedesktop.DBus.Introspectable"/>
+    <deny send_destination="org.freedesktop.ConsoleKit"
+          send_interface="org.freedesktop.ConsoleKit.Manager"/>
+    <deny send_destination="org.freedesktop.ConsoleKit"
+          send_interface="org.freedesktop.ConsoleKit.Seat"/>
+    <deny send_destination="org.freedesktop.ConsoleKit"
+          send_interface="org.freedesktop.ConsoleKit.Session"/>
     <deny send_destination="org.freedesktop.ConsoleKit"
           send_interface="org.freedesktop.DBus.Properties" />
 
-    <allow send_interface="org.freedesktop.ConsoleKit.Manager"
+    <allow send_destination="org.freedesktop.ConsoleKit"
+           send_interface="org.freedesktop.ConsoleKit.Manager"
            send_member="OpenSession"/>
-    <allow send_interface="org.freedesktop.ConsoleKit.Manager"
+    <allow send_destination="org.freedesktop.ConsoleKit"
+           send_interface="org.freedesktop.ConsoleKit.Manager"
            send_member="CloseSession"/>
-    <allow send_interface="org.freedesktop.ConsoleKit.Manager"
+    <allow send_destination="org.freedesktop.ConsoleKit"
+           send_interface="org.freedesktop.ConsoleKit.Manager"
            send_member="GetSeats"/>
-    <allow send_interface="org.freedesktop.ConsoleKit.Manager"
+    <allow send_destination="org.freedesktop.ConsoleKit"
+           send_interface="org.freedesktop.ConsoleKit.Manager"
            send_member="GetSessionForCookie"/>
-    <allow send_interface="org.freedesktop.ConsoleKit.Manager"
+    <allow send_destination="org.freedesktop.ConsoleKit"
+           send_interface="org.freedesktop.ConsoleKit.Manager"
            send_member="GetSessionForUnixProcess"/>
-    <allow send_interface="org.freedesktop.ConsoleKit.Manager"
+    <allow send_destination="org.freedesktop.ConsoleKit"
+           send_interface="org.freedesktop.ConsoleKit.Manager"
            send_member="GetCurrentSession"/>
-    <allow send_interface="org.freedesktop.ConsoleKit.Manager"
+    <allow send_destination="org.freedesktop.ConsoleKit"
+           send_interface="org.freedesktop.ConsoleKit.Manager"
            send_member="GetSessionsForUnixUser"/>
-    <allow send_interface="org.freedesktop.ConsoleKit.Manager"
+    <allow send_destination="org.freedesktop.ConsoleKit"
+           send_interface="org.freedesktop.ConsoleKit.Manager"
            send_member="GetSessionsForUser"/>
-    <allow send_interface="org.freedesktop.ConsoleKit.Manager"
+    <allow send_destination="org.freedesktop.ConsoleKit"
+           send_interface="org.freedesktop.ConsoleKit.Manager"
            send_member="GetSystemIdleHint"/>
-    <allow send_interface="org.freedesktop.ConsoleKit.Manager"
+    <allow send_destination="org.freedesktop.ConsoleKit"
+           send_interface="org.freedesktop.ConsoleKit.Manager"
            send_member="GetSystemIdleSinceHint"/>
 
-    <allow send_interface="org.freedesktop.ConsoleKit.Seat"
+    <allow send_destination="org.freedesktop.ConsoleKit"
+           send_interface="org.freedesktop.ConsoleKit.Seat"
            send_member="GetId"/>
-    <allow send_interface="org.freedesktop.ConsoleKit.Seat"
+    <allow send_destination="org.freedesktop.ConsoleKit"
+           send_interface="org.freedesktop.ConsoleKit.Seat"
            send_member="GetSessions"/>
-    <allow send_interface="org.freedesktop.ConsoleKit.Seat"
+    <allow send_destination="org.freedesktop.ConsoleKit"
+           send_interface="org.freedesktop.ConsoleKit.Seat"
            send_member="GetDevices"/>
-    <allow send_interface="org.freedesktop.ConsoleKit.Seat"
+    <allow send_destination="org.freedesktop.ConsoleKit"
+           send_interface="org.freedesktop.ConsoleKit.Seat"
            send_member="GetActiveSession"/>
-    <allow send_interface="org.freedesktop.ConsoleKit.Seat"
+    <allow send_destination="org.freedesktop.ConsoleKit"
+           send_interface="org.freedesktop.ConsoleKit.Seat"
            send_member="CanActivateSessions"/>
-    <allow send_interface="org.freedesktop.ConsoleKit.Seat"
+    <allow send_destination="org.freedesktop.ConsoleKit"
+           send_interface="org.freedesktop.ConsoleKit.Seat"
            send_member="ActivateSession"/>
 
-    <allow send_interface="org.freedesktop.ConsoleKit.Session"
+    <allow send_destination="org.freedesktop.ConsoleKit"
+           send_interface="org.freedesktop.ConsoleKit.Session"
            send_member="GetId"/>
-    <allow send_interface="org.freedesktop.ConsoleKit.Session"
+    <allow send_destination="org.freedesktop.ConsoleKit"
+           send_interface="org.freedesktop.ConsoleKit.Session"
            send_member="GetSeatId"/>
-    <allow send_interface="org.freedesktop.ConsoleKit.Session"
+    <allow send_destination="org.freedesktop.ConsoleKit"
+           send_interface="org.freedesktop.ConsoleKit.Session"
            send_member="GetSessionType"/>
-    <allow send_interface="org.freedesktop.ConsoleKit.Session"
+    <allow send_destination="org.freedesktop.ConsoleKit"
+           send_interface="org.freedesktop.ConsoleKit.Session"
            send_member="GetUser"/>
-    <allow send_interface="org.freedesktop.ConsoleKit.Session"
+    <allow send_destination="org.freedesktop.ConsoleKit"
+           send_interface="org.freedesktop.ConsoleKit.Session"
            send_member="GetUnixUser"/>
-    <allow send_interface="org.freedesktop.ConsoleKit.Session"
+    <allow send_destination="org.freedesktop.ConsoleKit"
+           send_interface="org.freedesktop.ConsoleKit.Session"
            send_member="GetX11Display"/>
-    <allow send_interface="org.freedesktop.ConsoleKit.Session"
+    <allow send_destination="org.freedesktop.ConsoleKit"
+           send_interface="org.freedesktop.ConsoleKit.Session"
            send_member="GetX11DisplayDevice"/>
-    <allow send_interface="org.freedesktop.ConsoleKit.Session"
+    <allow send_destination="org.freedesktop.ConsoleKit"
+           send_interface="org.freedesktop.ConsoleKit.Session"
            send_member="GetDisplayDevice"/>
-    <allow send_interface="org.freedesktop.ConsoleKit.Session"
+    <allow send_destination="org.freedesktop.ConsoleKit"
+           send_interface="org.freedesktop.ConsoleKit.Session"
            send_member="GetRemoteHostName"/>
-    <allow send_interface="org.freedesktop.ConsoleKit.Session"
+    <allow send_destination="org.freedesktop.ConsoleKit"
+           send_interface="org.freedesktop.ConsoleKit.Session"
            send_member="IsActive"/>
-    <allow send_interface="org.freedesktop.ConsoleKit.Session"
+    <allow send_destination="org.freedesktop.ConsoleKit"
+           send_interface="org.freedesktop.ConsoleKit.Session"
            send_member="IsLocal"/>
-    <allow send_interface="org.freedesktop.ConsoleKit.Session"
+    <allow send_destination="org.freedesktop.ConsoleKit"
+           send_interface="org.freedesktop.ConsoleKit.Session"
            send_member="GetCreationTime"/>
-    <allow send_interface="org.freedesktop.ConsoleKit.Session"
+    <allow send_destination="org.freedesktop.ConsoleKit"
+           send_interface="org.freedesktop.ConsoleKit.Session"
            send_member="Activate"/>
-    <allow send_interface="org.freedesktop.ConsoleKit.Session"
+    <allow send_destination="org.freedesktop.ConsoleKit"
+           send_interface="org.freedesktop.ConsoleKit.Session"
            send_member="GetIdleHint"/>
-    <allow send_interface="org.freedesktop.ConsoleKit.Session"
+    <allow send_destination="org.freedesktop.ConsoleKit"
+           send_interface="org.freedesktop.ConsoleKit.Session"
            send_member="GetIdleSinceHint"/>
+
+    <allow send_destination="org.freedesktop.ConsoleKit"
+           send_interface="org.freedesktop.ConsoleKit.Session"
+           send_member="SetIdleHint"/>
   </policy>
 
   <policy user="root">
-    <allow send_interface="org.freedesktop.ConsoleKit.Manager"
+    <allow send_destination="org.freedesktop.ConsoleKit"
+           send_interface="org.freedesktop.ConsoleKit.Manager"
            send_member="Restart"/>
-    <allow send_interface="org.freedesktop.ConsoleKit.Manager"
+    <allow send_destination="org.freedesktop.ConsoleKit"
+           send_interface="org.freedesktop.ConsoleKit.Manager"
            send_member="Stop"/>
   </policy>