base-files: add /media to System::Shared SMACK label

[AGL/meta-agl.git] / meta-security / recipes-core / base-files / base-files_%.bbappend

diff --git a/meta-security/recipes-core/base-files/base-files_%.bbappend b/meta-security/recipes-core/base-files/base-files_%.bbappend
index 7a37eb9..f0e340f 100644 (file)
--- a/meta-security/recipes-core/base-files/base-files_%.bbappend
+++ b/meta-security/recipes-core/base-files/base-files_%.bbappend
@@ -40,8 +40,8 @@ EOF
 # via postinst. This is much easier to use with bitbake, too:
 # - no need to maintain a patched rpm
 # - works for directories which are not packaged by default when empty
-RDEPENDS_${PN}_append_with-lsm-smack = " smack-userspace"
-DEPENDS_append_with-lsm-smack = " smack-userspace-native"
+RDEPENDS_${PN}_append_with-lsm-smack = " smack"
+DEPENDS_append_with-lsm-smack = " smack-native"
 pkg_postinst_${PN}_with-lsm-smack() {
     #!/bin/sh -e
 
@@ -56,6 +56,12 @@ pkg_postinst_${PN}_with-lsm-smack() {
     chsmack -t $D${sysconfdir}
     chsmack -a 'System::Shared' $D${sysconfdir}
 
+    # Same for /media. Any daemon running as "System" will get write access
+    # to everything.
+    install -d $D/media
+    chsmack -t $D/media
+    chsmack -a 'System::Shared' $D/media
+
     # Same for /var. Any daemon running as "System" will get write access
     # to everything.
     install -d $D${localstatedir}