@PhAndersson
Right, while searching for another problem, I just stumbled on something that looks like an answer.
there is in this directory:
/etc/dbus-1/system.d
a bunch of files configuring the authorizations for dbus; for example (taken for its brevity):
cat com.lomiri.UserMetrics.conf
<!DOCTYPE busconfig PUBLIC
"-//freedesktop//DTD D-BUS Bus Configuration 1.0//EN"
"http://www.freedesktop.org/standards/dbus/1.0/busconfig.dtd">
<busconfig>
<policy user="usermetrics">
<allow own="com.lomiri.UserMetrics"/>
</policy>
<policy context="default">
<allow send_destination="com.lomiri.UserMetrics"/>
<allow receive_sender="com.lomiri.UserMetrics"/>
</policy>
Now, it's sure that the system.d directory does not seem the right place for a user level service.
At the moment I have no clue where a file configuring the dbus authorization for the org.bluez.obexd service should be created.
But I tend to think that creating one is the proper thing to do because I don't see a reason why obexd should be forbidden to send message to its agents. It should be allowed whatever security reason there is to block general message sending. So this could be the proper way (TM) for your application to run confined.