From 887d0f8e9358b7009e58c90b6af82379d16246de Mon Sep 17 00:00:00 2001
From: Emanuele Giuseppe Esposito <eesposit@redhat.com>
Date: Thu, 17 Jul 2025 10:16:24 -0400
Subject: [PATCH] sysext: support ImagePolicy global config option

Just as Mutable=, support ImagePolicy in systemd/{sysext/confext}.conf and
dropins in systemd/{sysext.confext}.conf.d/* configs.
---
 man/sysext.conf.xml | 12 ++++++++++++
 src/sysext/sysext.c |  1 +
 2 files changed, 13 insertions(+)

diff --git a/man/sysext.conf.xml b/man/sysext.conf.xml
index cdd88f24474..f717b74426a 100644
--- a/man/sysext.conf.xml
+++ b/man/sysext.conf.xml
@@ -73,6 +73,18 @@
           <xi:include href="version-info.xml" xpointer="v259"/>
           </listitem>
         </varlistentry>
+
+        <varlistentry>
+          <term><varname>ImagePolicy=</varname></term>
+          <listitem><para>Set the image policy. Takes an image policy string as argument, as per
+          <citerefentry><refentrytitle>systemd.image-policy</refentrytitle><manvolnum>7</manvolnum></citerefentry>.
+          For details, see the <option>--image-policy=</option> option in
+          <citerefentry><refentrytitle>systemd-sysext</refentrytitle><manvolnum>8</manvolnum></citerefentry>.
+          </para>
+
+          <xi:include href="version-info.xml" xpointer="v259"/>
+          </listitem>
+        </varlistentry>
       </variablelist>
     </refsect2>
   </refsect1>
diff --git a/src/sysext/sysext.c b/src/sysext/sysext.c
index a4512d48e55..15a00237e42 100644
--- a/src/sysext/sysext.c
+++ b/src/sysext/sysext.c
@@ -155,6 +155,7 @@ static int parse_config_file(ImageClass image_class) {
         const char *section = image_class == IMAGE_SYSEXT ? "SysExt" : "ConfExt";
         const ConfigTableItem items[] = {
                 { section, "Mutable",           config_parse_mutable_mode,      0,      &arg_mutable            },
+                { section, "ImagePolicy",       config_parse_image_policy,      0,      &arg_image_policy       },
                 {}
         };
         _cleanup_free_ char *config_file = NULL;
-- 
2.47.3