fix(selinux): Allow creation of icons for PWAs

[PhysicsIsAwesome]

Trivalent needs to be able to create icons under subfolders of $HOME/.local/share/icons/..., including missing folders in that path.

I decided against simply allowing write access to type data_home_t, because some executables are of this type, to not introduce WX.

Thus I introduced a new type trivalent_data_home_t for files in data_home_t dirs, including the necessary filetrans. It also allows creation of directories of type data_home_t, in case they don't already exist.

I tested installing and uninstalling a PWA.

It also contains a small fix, with missing trivalent_home_cdm_lib_t missing in a gen_require block.

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[WavyEbuilder]

I like this change, but I have concerns about labelling integrity upon updates; namely how we can be sure that this directory in the user's home directory will be labelled appropriately, given that, as far as I understand, we have no reliable way of relabelling existing user content for updates. cc @RoyalOughtness.

[PhysicsIsAwesome]

namely how we can be sure that this directory in the user's home directory will be labelled appropriately

The directory will keep the standard label data_home_t, just files created by trivalent_domain within data_home_t dirs will get the trivalent-specific label. Is that what you mean?

we have no reliable way of relabelling existing user content for updates.

Is there something which should be changed in this PR?

[WavyEbuilder]

namely how we can be sure that this directory in the user's home directory will be labelled appropriately

The directory will keep the standard label data_home_t, just files created by trivalent_domain within data_home_t dirs will get the trivalent-specific label. Is that what you mean?

My concern is that Trivalent could have already created stuff for existing installs, and that won't have the type transition added here unfortunately

we have no reliable way of relabelling existing user content for updates.

Is there something which should be changed in this PR?

I don't think so, I think we'll need a separate change for this with a bit of relabelling infrastructure. However, I suppose this also doesn't change existing permissions (in the sense that it's currently denied), so I actually think this should be fine to merge