#!/bin/bash
# Copyright © Cloud Linux GmbH & Cloud Linux Software, Inc 2010-2021 All Rights Reserved
#
# Licensed under CLOUD LINUX LICENSE AGREEMENT
# http://cloudlinux.com/docs/LICENSE.TXT

# Note: Also called from Debian (see debian/postinst, "triggered" case).

# Run when a package that creates an account exempted by the cagefs
# dbus-hardening policy (CLOS-4516) is installed. D-Bus resolves a policy's
# user= name to a uid only when it reads its config, and drops any rule it
# cannot resolve -- and cagefs loads that policy at its OWN install time, which
# is usually before those packages exist. Without this re-read the exemption
# never activates. Currently:
#   * postgresql-server -> 'postgres', so postgresql-setup can read PGDATA over
#     D-Bus (CLOS-4632)
#   * nscd -> 'nscd', so nss-systemd's dynamic-user lookups are not refused and
#     logged on every uncached passwd/group miss (CLOS-6641)
#
# Delegated to feature_manager.py so the reload (and the "is the policy deployed?"
# guard) lives in one place and stays correct across the classic dbus-daemon and
# dbus-broker. Best-effort: must not fail the package trigger.

/usr/share/cagefs/feature_manager.py reload-dbus-hardening >/dev/null 2>&1 || :

exit 0