add /usr/share whitelisting support in --build

3 files changed, 33 insertions, 0 deletions

diff --git a/src/fbuilder/build_fs.c b/src/fbuilder/build_fs.c
index 6f3907770..5e63c241a 100644
--- a/src/fbuilder/build_fs.c
+++ b/src/fbuilder/build_fs.c
@@ -171,6 +171,37 @@ void build_var(const char *fname) {
                 filedb_print(var_out, "whitelist ");
 }
 
+
+//*******************************************
+// usr/share directory
+//*******************************************
+static FileDB *share_out = NULL;
+static void share_callback(char *ptr) {
+        // extract the directory:
+        // "/usr/share/bash-completion/bash_completion"  becomes "/usr/share/bash-completion"
+        assert(strncmp(ptr, "/usr/share", 10) == 0);
+        char *p1 = ptr + 10;
+        if (*p1 != '/')
+                return;
+        p1++;
+        char *p2 = strchr(p1, '/');
+        if (p2)
+                *p2 = '\0';
+
+        share_out = filedb_add(share_out, ptr);
+}
+
+void build_share(const char *fname) {
+        assert(fname);
+
+        process_files(fname, "/usr/share", share_callback);
+
+        if (share_out == NULL)
+                printf("blacklist /usr/share\n");
+        else
+                filedb_print(share_out, "whitelist ");
+}
+
 //*******************************************
 // tmp directory
 //*******************************************
diff --git a/src/fbuilder/build_profile.c b/src/fbuilder/build_profile.c
index fbe48cd4b..6d6263035 100644
--- a/src/fbuilder/build_profile.c
+++ b/src/fbuilder/build_profile.c
@@ -140,6 +140,7 @@ void build_profile(int argc, char **argv, int index) {
                 build_etc(TRACE_OUTPUT);
                 build_var(TRACE_OUTPUT);
                 build_bin(TRACE_OUTPUT);
+                build_share(TRACE_OUTPUT);
                 printf("\n");
 
                 printf("### security filters\n");
diff --git a/src/fbuilder/fbuilder.h b/src/fbuilder/fbuilder.h
index c448f3e06..401ae908e 100644
--- a/src/fbuilder/fbuilder.h
+++ b/src/fbuilder/fbuilder.h
@@ -43,6 +43,7 @@ void build_etc(const char *fname);
 void build_var(const char *fname);
 void build_tmp(const char *fname);
 void build_dev(const char *fname);
+void build_share(const char *fname);
 
 // build_bin.c
 void build_bin(const char *fname);