policies: allow custom directories and filed under /usr/local

According to FHS, /usr/local is meant for installing software locally. Thus, this directory feels like the ideal place for extra software installed by Image Builder's users via the custom files and directories. This commit relaxes the custom files and directory policies so users can add arbitrary files and directories under /usr/local.
osbuild · Feb 3, 2025 · e569940 · e569940
1 parent 78bee57
commit e569940
Showing 1 changed file with 23 additions and 23 deletions.
diff --git a/pkg/policies/policies.go b/pkg/policies/policies.go
@@ -50,36 +50,36 @@ var CustomDirectoriesPolicies = pathpolicy.NewPathPolicies(map[string]pathpolicy
 	"/sysroot":    {Deny: true},
 	"/tmp":        {Deny: true},
 	"/usr":        {Deny: true},
+	"/usr/local":  {},
 	"/var/run":    {Deny: true},
 	"/var/tmp":    {Deny: true},
 	"/efi":        {Deny: true},
 })
 
 // CustomFilesPolicies is a set of default policies for custom files
 var CustomFilesPolicies = pathpolicy.NewPathPolicies(map[string]pathpolicy.PathPolicy{
-	"/":               {},
-	"/usr/local/bin":  {},
-	"/usr/local/sbin": {},
-	"/bin":            {Deny: true},
-	"/boot":           {Deny: true},
-	"/dev":            {Deny: true},
-	"/efi":            {Deny: true},
-	"/etc/fstab":      {Deny: true},
-	"/etc/group":      {Deny: true},
-	"/etc/passwd":     {Deny: true},
-	"/etc/shadow":     {Deny: true},
-	"/lib":            {Deny: true},
-	"/lib64":          {Deny: true},
-	"/lost+found":     {Deny: true},
-	"/proc":           {Deny: true},
-	"/run":            {Deny: true},
-	"/sbin":           {Deny: true},
-	"/sys":            {Deny: true},
-	"/sysroot":        {Deny: true},
-	"/tmp":            {Deny: true},
-	"/usr":            {Deny: true},
-	"/var/run":        {Deny: true},
-	"/var/tmp":        {Deny: true},
+	"/":           {},
+	"/bin":        {Deny: true},
+	"/boot":       {Deny: true},
+	"/dev":        {Deny: true},
+	"/efi":        {Deny: true},
+	"/etc/fstab":  {Deny: true},
+	"/etc/group":  {Deny: true},
+	"/etc/passwd": {Deny: true},
+	"/etc/shadow": {Deny: true},
+	"/lib":        {Deny: true},
+	"/lib64":      {Deny: true},
+	"/lost+found": {Deny: true},
+	"/proc":       {Deny: true},
+	"/run":        {Deny: true},
+	"/sbin":       {Deny: true},
+	"/sys":        {Deny: true},
+	"/sysroot":    {Deny: true},
+	"/tmp":        {Deny: true},
+	"/usr":        {Deny: true},
+	"/usr/local":  {},
+	"/var/run":    {Deny: true},
+	"/var/tmp":    {Deny: true},
 })
 
 // MountpointPolicies for ostree