!6 Fix config file to deny noraml user to stop Setroubleshootd

From: @panxh_purple
Reviewed-by: @zhujianwei001
Signed-off-by: @zhujianwei001

Fix-config-file-to-deny-noraml-user-to-stop-Setroubleshootd.patch

@@ -0,0 +1,33 @@
+From bf6d97e7f14bdefb7e9e889ae29e29b0d8484a16 Mon Sep 17 00:00:00 2001
+From: openEuler Buildteam <buildteam@openeuler.org>
+Date: Tue, 15 Dec 2020 14:14:57 +0800
+Subject: [PATCH] Fix config file to deny noraml user to stop Setroubleshootd.
+
+---
+ org.fedoraproject.Setroubleshootd.conf | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/org.fedoraproject.Setroubleshootd.conf b/org.fedoraproject.Setroubleshootd.conf
+index 65a0daa..fe0e2f4 100644
+--- a/org.fedoraproject.Setroubleshootd.conf
++++ b/org.fedoraproject.Setroubleshootd.conf
+@@ -9,12 +9,15 @@
+ 	</policy>
+ 	<policy user="root">
+ 		<allow send_destination="org.fedoraproject.Setroubleshootd"/>
++		<allow send_destination="org.fedoraproject.Setroubleshootd"
++		       send_interface="org.fedoraproject.SetroubleshootdIface"
++		       send_member="finish"/>
+ 	</policy>
+ 	<policy context="default">
+ 		<allow send_destination="org.fedoraproject.Setroubleshootd"
+ 		       send_interface="org.fedoraproject.SetroubleshootdIface"
+ 		       send_member="start"/>
+-		<allow send_destination="org.fedoraproject.Setroubleshootd"
++		<deny  send_destination="org.fedoraproject.Setroubleshootd"
+ 		       send_interface="org.fedoraproject.SetroubleshootdIface"
+ 		       send_member="finish"/>
+ 		<allow send_destination="org.fedoraproject.Setroubleshootd"
+-- 
+1.8.3.1
+

setroubleshoot.spec

@@ -1,6 +1,6 @@
 Name: setroubleshoot
 Version: 3.3.20
-Release: 3
+Release: 4
 Summary: SELinux Trouble Shooting Tool
 License: GPLv2+
 URL: https://pagure.io/setroubleshoot
@@ -8,6 +8,8 @@ URL: https://pagure.io/setroubleshoot
 Source0: https://releases.pagure.org/setroubleshoot/%{name}-%{version}.tar.gz
 Source1: %{name}.tmpfiles
 
+Patch9000: Fix-config-file-to-deny-noraml-user-to-stop-Setroubleshootd.patch
+
 BuildRequires: gcc libcap-ng-devel intltool gettext python3 python3-devel git
 BuildRequires: desktop-file-utils dbus-glib-devel gtk2-devel libnotify-devel audit-libs-devel libselinux-devel polkit-devel
 BuildRequires: python3-libselinux python3-pydbus python3-gobject gtk3-devel xdg-utils
@@ -153,6 +155,9 @@ chown -R setroubleshoot:setroubleshoot %{_localstatedir}/lib/%{name}
 %{_mandir}/man1/seapplet.1.gz
 
 %changelog
+* Tue Dec 15 2020 panxiaohe <panxiaohe@huawei.com> - 3.3.20-4
+- Fix config file to deny noraml user to stop Setroubleshootd.
+
 * Thu Aug 20 2020 wangchen <wangchen137@huawei.com> - 3.3.20-3
 - fix the failure of building for audit downgrade