#!/bin/bash
# Copyright © Cloud Linux GmbH & Cloud Linux Software, Inc 2010-2021 All Rights Reserved
#
# Licensed under CLOUD LINUX LICENSE AGREEMENT
# http://cloudlinux.com/docs/LICENSE.TXT

# Note: Also called from Debian (see debian/postinst, "triggered" case).

# CLOS-4632: postgresql-server creates the unprivileged 'postgres' account. The
# cagefs dbus-hardening policy (CLOS-4516) carries a <policy user="postgres">
# allow so postgresql-setup can read PGDATA over D-Bus, but D-Bus resolves a
# policy's user= name to a uid only when it reads its config -- and cagefs loads
# that policy at its OWN install time, before postgresql-server exists, so the
# rule is dropped and the exemption never activates. Re-read the policy now that
# the account exists.
#
# Delegated to feature_manager.py so the reload (and the "is the policy deployed?"
# guard) lives in one place and stays correct across the classic dbus-daemon and
# dbus-broker. Best-effort: must not fail the package trigger.

/usr/share/cagefs/feature_manager.py reload-dbus-hardening >/dev/null 2>&1 || :

exit 0