Enable run-time permission only for specific profiles.

- Run-time permission is not required for all profiles.
- Set the flag file which can distinguish it.

Change-Id: I70397952cc2c25fb7d127391c2ff3d88e9ee94d4

diff --git a/config/90_user-content-permissions.post b/config/90_user-content-permissions.post
index 181d38eed63b1a858c5fb82f613b64a25570159a..a9dc4b1430a43da0049666e6398b02aca4187896 100644 (file)
--- a/config/90_user-content-permissions.post
+++ b/config/90_user-content-permissions.post
@@ -4,5 +4,12 @@ PATH=/bin:/usr/bin:/sbin:/usr/sbin
 
 NEW_USER=$1
 export `tzplatform-get --user $NEW_USER TZ_USER_CONTENT`
-find $TZ_USER_CONTENT -type d -exec chown root:priv_mediastorage {} + -exec chmod 2770 {} +
+
+if [ -e /opt/share/askuser_disable ]
+then
+       find $TZ_USER_CONTENT -type d -exec chown root:priv_mediastorage {} + -exec chmod 2770 {} +
+else
+       find $TZ_USER_CONTENT -type d -exec chown root:priv_mediastorage {} + -exec chmod 2777 {} +
+fi
+
 find $TZ_USER_CONTENT -type l -exec chown -h root:priv_mediastorage {} + -exec chsmack -a '_' {} +

diff --git a/config/set_capability b/config/set_capability
index ab2232a81784e1f689c58e6c1ca5b967680087a6..482da1a319cddac6948762f33471795e53604b72 100755 (executable)
--- a/config/set_capability
+++ b/config/set_capability
@@ -627,7 +627,7 @@ fi
 
 # This is not related with the capability, but place here to run in generic-security.post
 # It would be better to run this separately in generic-security.post future.
-if [ -e /usr/share/security-config/update_privacy_mount_list.sh ] && [ -e /usr/share/security-manager/policy/privilege-mount.list ]
+if [ -e /usr/share/security-config/update_privacy_mount_list.sh ] && [ -e /usr/share/security-manager/policy/privilege-mount.list ] && [ ! -e /opt/share/askuser_disable ]
 then
        /usr/share/security-config/update_privacy_mount_list.sh
 fi

diff --git a/packaging/security-config.spec b/packaging/security-config.spec
index 9a6099e2e367a986e6d7d58d1697843b18fff5a5..0f0b1beb560f656f892cd5e676f0d86b895995df 100755 (executable)
--- a/packaging/security-config.spec
+++ b/packaging/security-config.spec
@@ -55,6 +55,8 @@ ln -s ../%{name}.service %{buildroot}/%{_unitdir}/multi-user.target.wants/%{name
 /usr/share/security-config/set_label
 mkdir -p /opt/share/security-config/result
 mkdir -p /opt/share/security-config/log
+touch /opt/share/askuser_disable
+chmod 600 /opt/share/askuser_disable
 
 %post profile_mobile
 mv /opt/share/security-config/test/root_test/mobile/* /opt/share/security-config/test/root_test/
@@ -65,6 +67,7 @@ rm -r /opt/share/security-config/test/root_test/wearable/
 rm -r /opt/share/security-config/test/capability_test/mobile/
 rm -r /opt/share/security-config/test/capability_test/wearable/
 rm -r /opt/share/security-config/test/new_service_test/list/
+rm -f /opt/share/askuser_disable
 
 %postun profile_mobile
 rm /opt/share/security-config/test/root_test/*
@@ -80,6 +83,7 @@ rm -r /opt/share/security-config/test/root_test/wearable/
 rm -r /opt/share/security-config/test/capability_test/mobile/
 rm -r /opt/share/security-config/test/capability_test/wearable/
 rm -r /opt/share/security-config/test/new_service_test/list/
+rm -f /opt/share/askuser_disable
 
 %postun profile_wearable
 rm /opt/share/security-config/test/root_test/*