patch module

files/patches/run0gvfsadmin.patch

@@ -0,0 +1,11 @@
+--- a/usr/share/gvfs/mounts/admin.mount
++++ b/usr/share/gvfs/mounts/admin.mount
+@@ -1,7 +1,7 @@
+ [Mount]
+ Type=admin
+ # Add a dummy argument after pkexec, or '/bin/sh -c' will eat the first argument in '$@'
+-Exec=/bin/sh -c 'pkexec /usr/libexec/gvfsd-admin "$@" --address $DBUS_SESSION_BUS_ADDRESS --dir $XDG_RUNTIME_DIR' gvfsd-admin
++Exec=/bin/sh -c 'run0 --setenv=PKEXEC_UID="$UID" /usr/libexec/gvfsd-admin "$@" --address $DBUS_SESSION_BUS_ADDRESS --dir $XDG_RUNTIME_DIR' gvfsd-admin
+ AutoMount=false
+ DBusName=org.gtk.vfs.mountpoint_admin
+ MountPerClient=true

modules/patch/module.yml

@@ -0,0 +1,6 @@
+name: patch
+shortdesc: This module is used to apply patches to files at image build image.
+example: |
+  type: patch
+  patches:
+    - hardenlogindefs.patch

modules/patch/patch.sh

@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+shopt -s nullglob
+
+get_json_array PATCHES 'try .["patches"][]' "$1"
+PATCH_DIR="$CONFIG_DIRECTORY/patches"
+readonly PATCHES PATCH_DIR
+
+main() {
+    local p
+    for p in "${PATCHES[@]}"; do
+        patch --forward --directory=/ --strip=1 --no-backup-if-mismatch < "$PATCH_DIR/$p"
+    done
+}
+
+main "$@"

modules/patch/patch.tsp

@@ -0,0 +1,19 @@
+import "@typespec/json-schema";
+using TypeSpec.JsonSchema;
+
+@jsonSchema("/modules/script-latest.json")
+model ScriptModuleLatest {
+  ...ScriptModuleV1;
+}
+
+@jsonSchema("/modules/script-v1.json")
+model ScriptModuleV1 {
+  /** The patch module can be used to to apply patches to files at image build image. */
+  type: "patch" | "patch@v1" | "patch@latest";
+
+  /**
+   * List of patches to apply. Each patch has path components till the first / stripped
+   * and is then applied relative to image's root.
+   */
+  patches: Array<string>;
+}

recipes/common/common-modules.yml

@@ -20,5 +20,9 @@ modules:
     - type: script
       scripts:
         - enablecommonautoupdate.sh
+    - type: patch
+      patches:
+        - hardenlogindefs.patch
+        - run0gvfsadmin.patch
     - type: secureblue-signing
       source: local

recipes/common/common-scripts.yml

@@ -8,4 +8,3 @@ scripts:
   - disablegeoclue.sh
   - enablesecurebluefirstrun.sh
   - createjustcompletions.sh
-  - patchcommonconf.sh