permissions: disable automatic reloading of permissions from cfg

security reasons, avoid reading them live. Ideally we'd lock them behind sudo, but we can't do that.

1 files changed, 2 insertions, 3 deletions

diff --git a/src/config/ConfigManager.cpp b/src/config/ConfigManager.cpp
index 0c45186e..3c0f2cf8 100644
--- a/src/config/ConfigManager.cpp
+++ b/src/config/ConfigManager.cpp
@@ -989,8 +989,6 @@ std::optional<std::string> CConfigManager::resetHLConfig() {
     m_failedPluginConfigValues.clear();
     m_finalExecRequests.clear();
 
-    g_pDynamicPermissionManager->clearConfigPermissions();
-
     // paths
     m_configPaths.clear();
     std::string mainConfigPath = getMainConfigPath();
@@ -2911,7 +2909,8 @@ std::optional<std::string> CConfigManager::handlePermission(const std::string& c
     if (mode == PERMISSION_RULE_ALLOW_MODE_UNKNOWN)
         return "unknown permission allow mode";
 
-    g_pDynamicPermissionManager->addConfigPermissionRule(data[0], type, mode);
+    if (m_isFirstLaunch)
+        g_pDynamicPermissionManager->addConfigPermissionRule(data[0], type, mode);
 
     return {};
 }