From ec434cd06ea97296f2a25445f8a298b9ad799776 Mon Sep 17 00:00:00 2001
From: "Aode (lion)" <asonix@asonix.dog>
Date: Tue, 16 Nov 2021 09:45:43 -0600
Subject: [PATCH] Add imagemagick policy to object store dev image

---
 docker/object-storage/Dockerfile              |  2 ++
 .../config-Q16HDRI/policy.xml                 | 19 +++++++++++++++++++
 2 files changed, 21 insertions(+)
 create mode 100644 docker/object-storage/root/usr/lib/ImageMagick-7.1.0/config-Q16HDRI/policy.xml

diff --git a/docker/object-storage/Dockerfile b/docker/object-storage/Dockerfile
index 5980a60..9b07035 100644
--- a/docker/object-storage/Dockerfile
+++ b/docker/object-storage/Dockerfile
@@ -15,6 +15,8 @@ RUN \
         -g $GID \
         app
 
+COPY root/ /
+
 COPY ./pict-rs.toml /etc/pict-rs.toml
 
 ENV PATH=$PATH:/usr/bin/vendor_perl
diff --git a/docker/object-storage/root/usr/lib/ImageMagick-7.1.0/config-Q16HDRI/policy.xml b/docker/object-storage/root/usr/lib/ImageMagick-7.1.0/config-Q16HDRI/policy.xml
new file mode 100644
index 0000000..06166a9
--- /dev/null
+++ b/docker/object-storage/root/usr/lib/ImageMagick-7.1.0/config-Q16HDRI/policy.xml
@@ -0,0 +1,19 @@
+<policymap>
+    <policy domain="resource" name="memory" value="256MiB" />
+    <policy domain="resource" name="list-length" value="128" />
+    <policy domain="resource" name="width" value="10KP" />
+    <policy domain="resource" name="height" value="10KP" />
+    <policy domain="resource" name="map" value="512MiB" />
+    <policy domain="resource" name="area" value="40MP" />
+    <policy domain="resource" name="disk" value="1GiB" />
+    <policy domain="resource" name="file" value="768" />
+    <policy domain="resource" name="thread" value="2" />
+    <policy domain="coder" rights="none" pattern="*" />
+    <policy domain="coder" rights="read | write" pattern="{GIF,JPEG,PNG,WEBP,MP4,TMP,PAM}" />
+    <policy domain="filter" rights="none" pattern="*" />
+    <policy domain="path" rights="none" pattern="@*" />
+    <policy domain="module" rights="none" pattern="*" />
+    <policy domain="module" rights="read | write" pattern="{GIF,JPEG,PNG,WEBP,MP4,TMP,PAM}" />
+        <!-- indirect reads not permitted -->
+    <policy domain="system" name="precision" value="6" />
+</policymap>