Merge lp:~ahayzen/webbrowser-app/fix-1620635-apparmor-download-rule into lp:webbrowser-app/staging

[Andrew Hayzen]

* Add "@{HOME}/@{XDG_DOWNLOAD_DIR}/** rwk," manually rather than via write_paths as we don't want an owner. Due to bug 1620635 - content-hub uses libapparmor to check the read path and this fails with rules containing owner

* Add "@{HOME}/@{XDG_DOWNLOAD_DIR}/** rwk," manually rather than via write_paths as we don't want an owner. Due to bug 1620635 - content-hub uses libapparmor to check the read path and this fails with rules containing owner

[Jamie Strandboge (jdstrand)]

This looks fine to me and works around the aforementioned bug.

review: Approve

=== modified file 'debian/rules'
--- debian/rules	2017-03-07 11:42:15 +0000
+++ debian/rules	2017-03-21 17:00:36 +0000
@@ -20,7 +20,8 @@
 	sed 's#^}$$#\n  /sys/class/ r,\n  /sys/class/input/ r,\n  /run/udev/data/** r,\n}#g' | \
 	egrep -v '^\s*deny /dev/ r,\s*$$' | \
 	sed 's#^\(\s*\)deny\(\s\+/{run,dev}/shm/pulse-shm\*\s\+w,\).*$$#\1owner\2#g' | \
-	sed 's#^}$$#\n  /dev/dri/ r,\n  /sys/devices/pci[0-9]*/**/config r,\n}#g' \
+	sed 's#^}$$#\n  /dev/dri/ r,\n  /sys/devices/pci[0-9]*/**/config r,\n}#g' | \
+	sed 's#^}$$#\n  @{HOME}/@{XDG_DOWNLOAD_DIR}/** rwk,\n}#g' \
 	> ./debian/usr.bin.webbrowser-app
 ifeq ($(DEB_BUILD_GNU_TYPE),$(DEB_HOST_GNU_TYPE))
 	apparmor_parser -QTK ./debian/usr.bin.webbrowser-app
 
=== modified file 'debian/webbrowser-app-apparmor.manifest'
--- debian/webbrowser-app-apparmor.manifest	2017-03-06 18:02:25 +0000
+++ debian/webbrowser-app-apparmor.manifest	2017-03-21 17:00:36 +0000
@@ -37,7 +37,6 @@
         "/sys/devices/**/input*/"
       ],
       "write_path": [
-        "@{HOME}/@{XDG_DOWNLOAD_DIR}/"
       ]
     }
   }