$NetBSD: patch-config_policy.xml,v 1.3 2023/07/22 10:09:06 adam Exp $

Disable ghostscript coders by default to workaround VU#332928:
<https://www.kb.cert.org/vuls/id/332928>

--- config/policy.xml.orig	2023-07-16 11:14:27.000000000 +0000
+++ config/policy.xml
@@ -75,6 +75,18 @@
   <!-- <policy domain="cache" name="memory-map" value="anonymous"/> -->
   <!-- <policy domain="cache" name="synchronize" value="True"/> -->
   <!-- <policy domain="cache" name="shared-secret" value="passphrase" stealth="true"/> -->
+
+  <!-- 
+    -- Disable ghostscript coders as suggested by VU#332928
+    --  <https://www.kb.cert.org/vuls/id/332928>
+    -->
+  <policy domain="coder" rights="none" pattern="PS" />
+  <policy domain="coder" rights="none" pattern="PS2" />
+  <policy domain="coder" rights="none" pattern="PS3" />
+  <policy domain="coder" rights="none" pattern="EPS" />
+  <policy domain="coder" rights="none" pattern="PDF" />
+  <policy domain="coder" rights="none" pattern="XPS" />
+
   <!-- <policy domain="cache" name="synchronize" value="True"/> -->
   <!-- <policy domain="system" name="max-memory-request" value="256MiB"/> -->
   <!-- <policy domain="system" name="shred" value="1"/> -->