Enable run-time permission only for specific profiles.

- Run-time permission is not required for all profiles.
- Set the flag file which can distinguish it.

Change-Id: I70397952cc2c25fb7d127391c2ff3d88e9ee94d4

diff --git a/config/90_user-content-permissions.post b/config/90_user-content-permissions.post
index 181d38eed63b1a858c5fb82f613b64a25570159a..a9dc4b1430a43da0049666e6398b02aca4187896 100644 (file)
--- a/config/90_user-content-permissions.post
+++ b/config/90_user-content-permissions.post
@@ -4,5 +4,12 @@ PATH=/bin:/usr/bin:/sbin:/usr/sbin
 
 NEW_USER=$1
 export `tzplatform-get --user $NEW_USER TZ_USER_CONTENT`
-find $TZ_USER_CONTENT -type d -exec chown root:priv_mediastorage {} + -exec chmod 2770 {} +
+
+if [ -e /opt/share/askuser_disable ]
+then
+       find $TZ_USER_CONTENT -type d -exec chown root:priv_mediastorage {} + -exec chmod 2770 {} +
+else
+       find $TZ_USER_CONTENT -type d -exec chown root:priv_mediastorage {} + -exec chmod 2777 {} +
+fi
+
 find $TZ_USER_CONTENT -type l -exec chown -h root:priv_mediastorage {} + -exec chsmack -a '_' {} +

diff --git a/config/set_capability b/config/set_capability
index a390a7ec6ef909502976f4875445fb6fe6046c8a..6d54a4c12e200e82894d051a60308327001be8d6 100755 (executable)
--- a/config/set_capability
+++ b/config/set_capability
@@ -592,7 +592,7 @@ fi
 
 # This is not related with the capability, but place here to run in generic-security.post
 # It would be better to run this separately in generic-security.post future.
-if [ -e /usr/share/security-config/update_privacy_mount_list.sh ] && [ -e /usr/share/security-manager/policy/privilege-mount.list ]
+if [ -e /usr/share/security-config/update_privacy_mount_list.sh ] && [ -e /usr/share/security-manager/policy/privilege-mount.list ] && [ ! -e /opt/share/askuser_disable ]
 then
        /usr/share/security-config/update_privacy_mount_list.sh
 fi

diff --git a/packaging/security-config.spec b/packaging/security-config.spec
index 5fd36a61e25dc66e1389908fc66d597a33553bdd..68a297c9e19b7947c080e8dd45479924ba77e5cf 100755 (executable)
--- a/packaging/security-config.spec
+++ b/packaging/security-config.spec
@@ -55,6 +55,8 @@ ln -s ../%{name}.service %{buildroot}/%{_unitdir}/multi-user.target.wants/%{name
 /usr/share/security-config/set_label
 mkdir -p /opt/share/security-config/result
 mkdir -p /opt/share/security-config/log
+touch /opt/share/askuser_disable
+chmod 600 /opt/share/askuser_disable
 
 %post profile_mobile
 mv /opt/share/security-config/test/root_test/mobile/* /opt/share/security-config/test/root_test/
@@ -63,6 +65,7 @@ rm -r /opt/share/security-config/test/root_test/mobile/
 rm -r /opt/share/security-config/test/root_test/wearable/
 rm -r /opt/share/security-config/test/capability_test/mobile/
 rm -r /opt/share/security-config/test/capability_test/wearable/
+rm -f /opt/share/askuser_disable
 
 %postun profile_mobile
 rm /opt/share/security-config/test/root_test/*
@@ -75,6 +78,7 @@ rm -r /opt/share/security-config/test/root_test/mobile/
 rm -r /opt/share/security-config/test/root_test/wearable/
 rm -r /opt/share/security-config/test/capability_test/mobile/
 rm -r /opt/share/security-config/test/capability_test/wearable/
+rm -f /opt/share/askuser_disable
 
 %postun profile_wearable
 rm /opt/share/security-config/test/root_test/*