Skip to content

fix(selinux): Allow creation of icons for PWAs including folders #697

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
PhysicsIsAwesome wants to merge 2 commits into
base: live
Choose a base branch
from
Open

fix(selinux): Allow creation of icons for PWAs including folders #697

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
0934b3c
fix(selinux): Allow creation of icons for PWAs including necessary fo…
PhysicsIsAwesome Apr 18, 2026
4abb3cc
fix(selinux): Remove manage permission on gnome data that is no longe…
PhysicsIsAwesome Apr 18, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions build/trivalent.if
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -95,12 +95,15 @@ template(`trivalent_role_template',`
#
interface(`trivalent_filetrans_home_content',`
gen_require(`
type trivalent_data_home_t;
type trivalent_home_cdm_lib_t;
type trivalent_home_t;
')

optional_policy(`
gnome_config_filetrans($1, trivalent_home_t, dir, "trivalent")
gnome_cache_filetrans($1, trivalent_home_t, dir, "trivalent")
gnome_data_filetrans($1, trivalent_data_home_t, file)
filetrans_pattern($1, trivalent_home_t, trivalent_home_cdm_lib_t, file, "libwidevinecdm.so")
')
')
52 changes: 28 additions & 24 deletions build/trivalent.te
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,30 @@ policy_module(trivalent, 1.0.0)
#
# SPDX-License-Identifier: Apache-2.0 OR MIT

gen_require(`
attribute gnome_home_type;
attribute userdomain;
class dbus acquire_svc;
type audio_home_t;
type chrome_sandbox_home_t;
type data_home_t;
type device_t;
type dosfs_t;
type fonts_cache_t;
type http_port_t;
type http_cache_port_t;
type howl_port_t;
type ld_so_cache_t;
type null_device_t;
type root_t;
type pki_ca_port_t;
type nsfs_t;
type tmp_t;
type tmpfs_t;
type user_home_t;
type xserver_misc_device_t;
')

########################################
#
# Declarations
Expand Down Expand Up @@ -55,34 +79,14 @@ userdom_user_home_content(trivalent_home_cdm_lib_t)
type trivalent_script_exec_t;
application_executable_file(trivalent_script_exec_t)

type trivalent_data_home_t, gnome_home_type;
userdom_user_home_content(trivalent_data_home_t)

##############################
#
# Local policy
#

gen_require(`
attribute userdomain;
class dbus acquire_svc;
type audio_home_t;
type chrome_sandbox_home_t;
type device_t;
type dosfs_t;
type fonts_cache_t;
type http_port_t;
type http_cache_port_t;
type howl_port_t;
type ld_so_cache_t;
type null_device_t;
type root_t;
type pki_ca_port_t;
type nsfs_t;
type tmp_t;
type tmpfs_t;
type user_home_t;
type xserver_misc_device_t;
')

trivalent_filetrans_home_content(userdomain)
trivalent_filetrans_home_content(trivalent_domain)
trivalent_filetrans_home_content(trivalent_script_domain)
Expand Down Expand Up @@ -113,7 +117,8 @@ allow trivalent_domain trivalent_home_t:file { manage_file_perms map };
allow trivalent_domain trivalent_home_t:lnk_file { manage_lnk_file_perms };
allow trivalent_domain self:netlink_route_socket { nlmsg_read nlmsg_write };
manage_files_pattern(trivalent_domain, trivalent_home_t, trivalent_home_cdm_lib_t)

manage_files_pattern(trivalent_domain, data_home_t, trivalent_data_home_t)
create_dirs_pattern(trivalent_domain, data_home_t, data_home_t)

# not covered by interfaces
allow trivalent_domain fonts_cache_t:dir mounton;
Expand Down Expand Up @@ -257,7 +262,6 @@ gnome_manage_generic_cache_files(trivalent_domain)
gnome_manage_generic_cache_sockets(trivalent_domain)
gnome_manage_home_config(trivalent_domain)
gnome_manage_home_config_dirs(trivalent_domain)
gnome_manage_data(trivalent_domain)
gnome_manage_generic_home_files(trivalent_domain)
gnome_manage_generic_home_dirs(trivalent_domain)
gnome_map_generic_data_home_files(trivalent_domain)
Expand Down