support usec and umount control

debian/changelog

@@ -1,3 +1,9 @@
+refpolicy (2:2.20240723-2deepin3) unstable; urgency=medium
+
+  * change to support umount control.                            
+
+ -- xiongyingrong <xiongyingrong@uniontech.com> Thu, 31 Oct 2024 15:37:26 +0800
+
 refpolicy (2:2.20240723-2deepin2) unstable; urgency=medium
 
   * support simplify usec and umount control

debian/patches/0001-deepin-umount-control.patch

@@ -0,0 +1,39 @@
+From 905fcea65314ff3f8b177d1276410ded675974cc Mon Sep 17 00:00:00 2001
+From: xyr218 <xiongyingrong@uniontech.com>
+Date: Tue, 29 Oct 2024 15:03:09 +0800
+Subject: [PATCH] deepin-umount-control
+
+---
+ config/appconfig-mcs/seusers |   2 +-
+ policy/modules/services/deepin_perm_control.te | 9 +++++++++
+ 2 file changed, 11 insertions(+)
+
+diff --git a/config/appconfig-mcs/seusers b/config/appconfig-mcs/seusers
+index 66c6742..cd04920 100644
+--- a/config/appconfig-mcs/seusers
++++ b/config/appconfig-mcs/seusers
+@@ -1,3 +1,3 @@
+ root:unconfined_u:s0-mcs_systemhigh
+ __default__:unconfined_u:s0-mcs_systemhigh
+-sddm:xdm:s0
++#sddm:xdm:s0
+
+diff --git a/policy/modules/services/deepin_perm_control.te b/policy/modules/services/deepin_perm_control.te
+index 0679477..0a34a87 100644
+--- a/policy/modules/services/deepin_perm_control.te
++++ b/policy/modules/services/deepin_perm_control.te
+@@ -858,3 +858,12 @@ allow deepin_home_sec_t filesystem_type:filesystem associate;
+ allow deepin_home_sec_t self:filesystem associate;
+ allow deepin_executable_file_type deepin_home_sec_t:file ~{ relabelfrom relabelto };
+ allow deepin_executable_file_type deepin_home_sec_t:dir list_dir_perms;
++
++# umount管控
++require {       
++    class filesystem unmount;     
++}
++type deepin_immutable_t;  
++deepin_app_domain_set(deepin_immutable_t);
++allow deepin_immutable_t deepin_ro_file_t:filesystem { unmount };
+-- 
+2.20.1
+

debian/patches/series

@@ -17,3 +17,4 @@ thunderbolt
 3000-bookworm
 4000-bubblewrap
 support-v25-usec-policy.patch
+0001-deepin-umount-control.patch