add selinux policy to howdy-beta

[troyready]

Trying to use howdy-beta on my Fedora 41 system results in SELinux /var/log/audit/audit.log errors like:

type=AVC msg=audit(1731249683.384:270): avc:  denied  { map } for  pid=2191 comm="python3" path="/dev/video2" dev="devtmpfs" ino=975 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:v4l_device_t:s0 tclass=chr_file permissive=0

I used audit2allow to create a working policy and have included it in the package here.

[principis]

I'm a bit hesitant to include this in the package. Wouldn't this allow many processes and not just howdy to access v4l_device_t? Is there a better way to solve this?

[troyready]

I think it's more limited than it seems. If I look at running processes on my system now via ps auxZ|grep -i 'xdm_[t]', the only two results are:

system_u:system_r:xdm_t:s0-s0:c0.c1023 root 1759  0.0  0.0 534120  8676 ?        Ssl  Nov21   0:00 /usr/sbin/gdm
system_u:system_r:xdm_t:s0-s0:c0.c1023 root 2571  0.0  0.0 615336 11828 ?        Sl   Nov21   0:00 gdm-session-worker [pam/gdm-password]

(notably, not other invocations of /usr/bin/python made by my user).