policies: split out ostree policies

We want to be more strict for ostree so let's keep the old policies
there.

pkg/distro/fedora/imagetype.go

@@ -389,12 +389,20 @@ func (t *imageType) checkOptions(bp *blueprint.Blueprint, options distro.ImageOp
 		return nil, err
 	}
 
-	err = blueprint.CheckDirectoryCustomizationsPolicy(dc, policies.CustomDirectoriesPolicies)
+	dcp := policies.CustomDirectoriesPolicies
+	fcp := policies.CustomFilesPolicies
+
+	if t.rpmOstree {
+		dcp = policies.OstreeCustomDirectoriesPolicies
+		fcp = policies.OstreeCustomFilesPolicies
+	}
+
+	err = blueprint.CheckDirectoryCustomizationsPolicy(dc, dcp)
 	if err != nil {
 		return nil, err
 	}
 
-	err = blueprint.CheckFileCustomizationsPolicy(fc, policies.CustomFilesPolicies)
+	err = blueprint.CheckFileCustomizationsPolicy(fc, fcp)
 	if err != nil {
 		return nil, err
 	}

pkg/distro/rhel/rhel10/options.go

@@ -46,12 +46,21 @@ func checkOptions(t *rhel.ImageType, bp *blueprint.Blueprint, options distro.Ima
 	if err != nil {
 		return warnings, err
 	}
-	err = blueprint.CheckDirectoryCustomizationsPolicy(dc, policies.CustomDirectoriesPolicies)
+
+	dcp := policies.CustomDirectoriesPolicies
+	fcp := policies.CustomFilesPolicies
+
+	if t.RPMOSTree {
+		dcp = policies.OstreeCustomDirectoriesPolicies
+		fcp = policies.OstreeCustomFilesPolicies
+	}
+
+	err = blueprint.CheckDirectoryCustomizationsPolicy(dc, dcp)
 	if err != nil {
 		return warnings, err
 	}
 
-	err = blueprint.CheckFileCustomizationsPolicy(fc, policies.CustomFilesPolicies)
+	err = blueprint.CheckFileCustomizationsPolicy(fc, fcp)
 	if err != nil {
 		return warnings, err
 	}

pkg/distro/rhel/rhel9/options.go

@@ -159,12 +159,21 @@ func checkOptions(t *rhel.ImageType, bp *blueprint.Blueprint, options distro.Ima
 	if err != nil {
 		return warnings, err
 	}
-	err = blueprint.CheckDirectoryCustomizationsPolicy(dc, policies.CustomDirectoriesPolicies)
+
+	dcp := policies.CustomDirectoriesPolicies
+	fcp := policies.CustomFilesPolicies
+
+	if t.RPMOSTree {
+		dcp = policies.OstreeCustomDirectoriesPolicies
+		fcp = policies.OstreeCustomFilesPolicies
+	}
+
+	err = blueprint.CheckDirectoryCustomizationsPolicy(dc, dcp)
 	if err != nil {
 		return warnings, err
 	}
 
-	err = blueprint.CheckFileCustomizationsPolicy(fc, policies.CustomFilesPolicies)
+	err = blueprint.CheckFileCustomizationsPolicy(fc, fcp)
 	if err != nil {
 		return warnings, err
 	}

pkg/distro/rhel7/imagetype.go

@@ -287,12 +287,15 @@ func (t *imageType) checkOptions(bp *blueprint.Blueprint, options distro.ImageOp
 		return warnings, err
 	}
 
-	err = blueprint.CheckDirectoryCustomizationsPolicy(dc, policies.CustomDirectoriesPolicies)
+	dcp := policies.CustomDirectoriesPolicies
+	fcp := policies.CustomFilesPolicies
+
+	err = blueprint.CheckDirectoryCustomizationsPolicy(dc, dcp)
 	if err != nil {
 		return warnings, err
 	}
 
-	err = blueprint.CheckFileCustomizationsPolicy(fc, policies.CustomFilesPolicies)
+	err = blueprint.CheckFileCustomizationsPolicy(fc, fcp)
 	if err != nil {
 		return warnings, err
 	}

pkg/distro/rhel8/imagetype.go

@@ -436,12 +436,21 @@ func (t *imageType) checkOptions(bp *blueprint.Blueprint, options distro.ImageOp
 	if err != nil {
 		return warnings, err
 	}
-	err = blueprint.CheckDirectoryCustomizationsPolicy(dc, policies.CustomDirectoriesPolicies)
+
+	dcp := policies.CustomDirectoriesPolicies
+	fcp := policies.CustomFilesPolicies
+
+	if t.rpmOstree {
+		dcp = policies.OstreeCustomDirectoriesPolicies
+		fcp = policies.OstreeCustomFilesPolicies
+	}
+
+	err = blueprint.CheckDirectoryCustomizationsPolicy(dc, dcp)
 	if err != nil {
 		return warnings, err
 	}
 
-	err = blueprint.CheckFileCustomizationsPolicy(fc, policies.CustomFilesPolicies)
+	err = blueprint.CheckFileCustomizationsPolicy(fc, fcp)
 	if err != nil {
 		return warnings, err
 	}

pkg/policies/policies.go

@@ -92,3 +92,22 @@ var OstreeMountpointPolicies = pathpolicy.NewPathPolicies(map[string]pathpolicy.
 	"/var/usrlocal": {Deny: true},
 	"/var/mnt":      {Deny: true},
 })
+
+// CustomDirectoriesPolicies for ostree
+var OstreeCustomDirectoriesPolicies = pathpolicy.NewPathPolicies(map[string]pathpolicy.PathPolicy{
+	"/":    {Deny: true},
+	"/etc": {},
+})
+
+// CustomFilesPolicies for ostree
+var OstreeCustomFilesPolicies = pathpolicy.NewPathPolicies(map[string]pathpolicy.PathPolicy{
+	"/":               {Deny: true},
+	"/etc":            {},
+	"/root":           {},
+	"/usr/local/bin":  {},
+	"/usr/local/sbin": {},
+	"/etc/fstab":      {Deny: true},
+	"/etc/shadow":     {Deny: true},
+	"/etc/passwd":     {Deny: true},
+	"/etc/group":      {Deny: true},
+})