patch module

files/patches/admin.mount.patch

@@ -0,0 +1,11 @@
+--- a/usr/share/gvfs/mounts/admin.mount
++++ b/usr/share/gvfs/mounts/admin.mount
+@@ -1,7 +1,7 @@
+ [Mount]
+ Type=admin
+ # Add a dummy argument after pkexec, or '/bin/sh -c' will eat the first argument in '$@'
+-Exec=/bin/sh -c 'pkexec /usr/libexec/gvfsd-admin "$@" --address $DBUS_SESSION_BUS_ADDRESS --dir $XDG_RUNTIME_DIR' gvfsd-admin
++Exec=/bin/sh -c 'run0 --setenv=PKEXEC_UID="$UID" /usr/libexec/gvfsd-admin "$@" --address $DBUS_SESSION_BUS_ADDRESS --dir $XDG_RUNTIME_DIR' gvfsd-admin
+ AutoMount=false
+ DBusName=org.gtk.vfs.mountpoint_admin
+ MountPerClient=true

modules/patch/module.yml

@@ -0,0 +1,6 @@
+name: patch
+shortdesc: This module is used to apply patches to files at image build image.
+example: |
+  type: patch
+  patches:
+    - hardenlogindefs.patch

modules/patch/patch.sh

@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+shopt -s nullglob
+
+get_json_array PATCHES 'try .["patches"][]' "$1"
+PATCH_DIR="$CONFIG_DIRECTORY/patches"
+readonly PATCHES PATCH_DIR
+
+main() {
+    local p
+    for p in "${PATCHES[@]}"; do
+        patch --batch --silent --forward --no-backup-if-mismatch \
+              --directory=/ --strip=1 < "$PATCH_DIR/$p"
+    done
+}
+
+main "$@"

recipes/common/common-modules.yml

@@ -20,5 +20,8 @@ modules:
     - type: script
       scripts:
         - enablecommonautoupdate.sh
+    - type: patch
+      patches:
+        - login.defs.patch
     - type: secureblue-signing
       source: local

recipes/common/common-scripts.yml

@@ -8,4 +8,3 @@ scripts:
   - disablegeoclue.sh
   - enablesecurebluefirstrun.sh
   - createjustcompletions.sh
-  - patchcommonconf.sh

recipes/common/silverblue-modules.yml

@@ -27,3 +27,6 @@ modules:
     - type: script
       scripts:
         - removedkmshelper.sh
+    - type: patch
+      patches:
+        - admin.mount.patch