Merge lp:~jdstrand/ofono/ofono-lp1296415 into lp:~phablet-team/ofono/ubuntu

[Jamie Strandboge]

  * add lenient AppArmor profile to restrict DBus connections with ofono to
    specific services (LP: #1296415)
    - add debian/usr.sbin.ofonod
    - debian/control: Build-Depends on dh-apparmor
    - debian/rules: update override_dh_installdeb to use dh_apparmor
    - debian/ofono.dirs: add etc/apparmor.d
    - debian/ofono.install: install profile in to place
    - debian/ofono.upstart: update to load AppArmor profile

  * add lenient AppArmor profile to restrict DBus connections with ofono to
    specific services (LP: #1296415)
    - add debian/usr.sbin.ofonod
    - debian/control: Build-Depends on dh-apparmor
    - debian/rules: update override_dh_installdeb to use dh_apparmor
    - debian/ofono.dirs: add etc/apparmor.d
    - debian/ofono.install: install profile in to place
    - debian/ofono.upstart: update to load AppArmor profile

[PS Jenkins bot (ps-jenkins)]

PASSED: Continuous integration, rev:6869
http://jenkins.qa.ubuntu.com/job/phablet-team-ofono-ubuntu-ci/53/
Executed test runs:
    SUCCESS: http://jenkins.qa.ubuntu.com/job/phablet-team-ofono-ubuntu-utopic-amd64-ci/10
    SUCCESS: http://jenkins.qa.ubuntu.com/job/phablet-team-ofono-ubuntu-utopic-armhf-ci/7
        deb: http://jenkins.qa.ubuntu.com/job/phablet-team-ofono-ubuntu-utopic-armhf-ci/7/artifact/work/output/*zip*/output.zip
    SUCCESS: http://jenkins.qa.ubuntu.com/job/phablet-team-ofono-ubuntu-utopic-i386-ci/7

Click here to trigger a rebuild:
http://s-jenkins.ubuntu-ci:8080/job/phablet-team-ofono-ubuntu-ci/53/rebuild

review: Approve (continuous-integration)

[lp:~jdstrand/ofono/ofono-lp1296415]

6870. By Jamie Strandboge on 2014-06-24

debian/usr.sbin.ofonod: more closely mimic unconfined with exec transitions

[PS Jenkins bot (ps-jenkins)]

PASSED: Continuous integration, rev:6870
http://jenkins.qa.ubuntu.com/job/phablet-team-ofono-ubuntu-ci/54/
Executed test runs:
    SUCCESS: http://jenkins.qa.ubuntu.com/job/phablet-team-ofono-ubuntu-utopic-amd64-ci/11
    SUCCESS: http://jenkins.qa.ubuntu.com/job/phablet-team-ofono-ubuntu-utopic-armhf-ci/8
        deb: http://jenkins.qa.ubuntu.com/job/phablet-team-ofono-ubuntu-utopic-armhf-ci/8/artifact/work/output/*zip*/output.zip
    SUCCESS: http://jenkins.qa.ubuntu.com/job/phablet-team-ofono-ubuntu-utopic-i386-ci/8

Click here to trigger a rebuild:
http://s-jenkins.ubuntu-ci:8080/job/phablet-team-ofono-ubuntu-ci/54/rebuild

review: Approve (continuous-integration)

Unmerged revisions

6870. By Jamie Strandboge on 2014-06-24

debian/usr.sbin.ofonod: more closely mimic unconfined with exec transitions

6869. By Jamie Strandboge on 2014-06-24

debian/usr.sbin.ofonod: remove unused and unneeded rild peer

6868. By Jamie Strandboge on 2014-06-24

 * add lenient AppArmor profile to restrict DBus connections with ofono to
   specific services (LP: #1296415)
   - add debian/usr.sbin.ofonod
   - debian/control: Build-Depends on dh-apparmor
   - debian/rules: update override_dh_installdeb to use dh_apparmor
   - debian/ofono.dirs: add etc/apparmor.d
   - debian/ofono.install: install profile in to place
   - debian/ofono.upstart: update to load AppArmor profile

=== modified file 'debian/control'
--- debian/control	2014-05-29 12:15:34 +0000
+++ debian/control	2014-06-24 22:22:27 +0000
@@ -12,7 +12,8 @@
                libudev-dev,
                udev,
                libbluetooth-dev (>= 4.30),
-               mobile-broadband-provider-info
+               mobile-broadband-provider-info,
+               dh-apparmor
 Standards-Version: 3.9.4
 Homepage: http://www.ofono.org/
 # If you aren't a member of ~phablet-team but need to upload
 
=== modified file 'debian/ofono.dirs'
--- debian/ofono.dirs	2013-10-02 15:34:41 +0000
+++ debian/ofono.dirs	2014-06-24 22:22:27 +0000
@@ -1,1 +1,2 @@
 /var/lib/ofono
+/etc/apparmor.d
 
=== modified file 'debian/ofono.install'
--- debian/ofono.install	2013-10-02 15:34:41 +0000
+++ debian/ofono.install	2014-06-24 22:22:27 +0000
@@ -4,3 +4,4 @@
 debian/tmp/etc/ofono
 debian/tmp/lib/udev/rules.d/*
 debian/tmp/usr/share/man
+debian/usr.sbin.ofonod etc/apparmor.d
 
=== modified file 'debian/ofono.upstart'
--- debian/ofono.upstart	2013-10-02 15:34:41 +0000
+++ debian/ofono.upstart	2014-06-24 22:22:27 +0000
@@ -6,4 +6,8 @@
 expect fork
 respawn
 
+pre-start script
+    /lib/init/apparmor-profile-load usr.sbin.ofonod
+end script
+
 exec ofonod -P ril
 
=== modified file 'debian/rules'
--- debian/rules	2013-12-23 18:38:54 +0000
+++ debian/rules	2014-06-24 22:22:27 +0000
@@ -23,3 +23,7 @@
 
 override_dh_strip:
 	dh_strip --dbg-package=ofono-dbg
+
+override_dh_installdeb:
+	dh_apparmor --profile-name=usr.sbin.ofonod -pofono
+	dh_installdeb
 
=== added file 'debian/usr.sbin.ofonod'
--- debian/usr.sbin.ofonod	1970-01-01 00:00:00 +0000
+++ debian/usr.sbin.ofonod	2014-06-24 22:22:27 +0000
@@ -0,0 +1,55 @@
+#include <tunables/global>
+
+# Permissive profile limit dbus access
+/usr/sbin/ofonod (attach_disconnected) {
+  capability,
+  mount,
+  remount,
+  umount,
+  network,
+
+  /   rwkl,
+  /** rwlkm,
+  /** pix,
+
+  # We can do anything on dbus
+  dbus (bind, send),
+
+  # Some methods are ok by anyone (ie, dbus-daemon itself)
+  dbus (receive)
+       bus=system
+       interface="org.freedesktop.DBus.Properties",
+
+  # Limit who can connect on DBus to these (LP: #1296415)
+  dbus (receive) peer=(label=/usr/lib/*/indicator-network/indicator-network-service),
+  dbus (receive) peer=(label=/usr/sbin/NetworkManager),
+  dbus (receive) peer=(label=/etc/NetworkManager/dispatcher.d/03mmsproxy),
+  dbus (receive) peer=(label=/usr/bin/nuntium),
+  dbus (receive) peer=(label=/usr/bin/ubuntu-download-manager),
+  dbus (receive) peer=(label=/usr/bin/powerd),
+  dbus (receive) peer=(label=/usr/bin/system-settings),
+  dbus (receive) peer=(label=/usr/lib/*/urfkill/urfkilld),
+  dbus (receive) peer=(label=/usr/lib/telepathy/telepathy-ofono),
+  dbus (receive) peer=(label=ofono_scripts),
+
+  # Allow some ptrace, but don't allow others to ptrace us
+  ptrace (read, readby, trace),
+
+  # We have to let all signals through, since 'init' is unconfined
+  signal,
+}
+
+profile ofono_scripts /usr/share/ofono/scripts/* (attach_disconnected) {
+  capability,
+  mount,
+  remount,
+  umount,
+  network,
+  dbus,
+  ptrace,
+  signal,
+
+  /   rwkl,
+  /** rwlkm,
+  /** pix,
+}