policies: allow /{usr,var}/local/bin paths

Signed-off-by: Lukas Zapletal <[email protected]>
osbuild · Mar 22, 2024 · c8ff1f0 · c8ff1f0
1 parent e00940b
commit c8ff1f0
Showing 1 changed file with 9 additions and 7 deletions.
diff --git a/pkg/policies/policies.go b/pkg/policies/policies.go
@@ -42,13 +42,15 @@ var CustomDirectoriesPolicies = pathpolicy.NewPathPolicies(map[string]pathpolicy
 
 // CustomFilesPolicies is a set of default policies for custom files
 var CustomFilesPolicies = pathpolicy.NewPathPolicies(map[string]pathpolicy.PathPolicy{
-	"/":           {Deny: true},
-	"/etc":        {},
-	"/root":       {},
-	"/etc/fstab":  {Deny: true},
-	"/etc/shadow": {Deny: true},
-	"/etc/passwd": {Deny: true},
-	"/etc/group":  {Deny: true},
+	"/":               {Deny: true},
+	"/etc":            {},
+	"/root":           {},
+	"/usr/local/bin":  {},
+	"/usr/local/sbin": {},
+	"/etc/fstab":      {Deny: true},
+	"/etc/shadow":     {Deny: true},
+	"/etc/passwd":     {Deny: true},
+	"/etc/group":      {Deny: true},
 })
 
 // MountpointPolicies for ostree