Merge lp:~jdstrand/powerd/powerd-lp1296415 into lp:powerd

[Jamie Strandboge]

  * add lenient AppArmor profile to allow connecting to ofono (LP: #1296415)
    - add debian/usr.bin.powerd
    - debian/control: Build-Depends on dh-apparmor
    - debian/rules: update override_dh_installdeb to use dh_apparmor
    - debian/powerd.dirs: add etc/apparmor.d
    - debian/powerd.install: install profile in to place
    - debian/upstart: update to load the AppArmor profile

  * add lenient AppArmor profile to allow connecting to ofono (LP: #1296415)
    - add debian/usr.bin.powerd
    - debian/control: Build-Depends on dh-apparmor
    - debian/rules: update override_dh_installdeb to use dh_apparmor
    - debian/powerd.dirs: add etc/apparmor.d
    - debian/powerd.install: install profile in to place
    - debian/upstart: update to load the AppArmor profile

[PS Jenkins bot (ps-jenkins)]

PASSED: Continuous integration, rev:132
http://jenkins.qa.ubuntu.com/job/powerd-ci/156/
Executed test runs:
    SUCCESS: http://jenkins.qa.ubuntu.com/job/powerd-utopic-armhf-ci/8
        deb: http://jenkins.qa.ubuntu.com/job/powerd-utopic-armhf-ci/8/artifact/work/output/*zip*/output.zip

Click here to trigger a rebuild:
http://s-jenkins.ubuntu-ci:8080/job/powerd-ci/156/rebuild

review: Approve (continuous-integration)

[lp:~jdstrand/powerd/powerd-lp1296415]

133. By Jamie Strandboge on 2014-06-24

debian/usr.bin.powerd: more closely mimic confined with exec transitions

[PS Jenkins bot (ps-jenkins)]

PASSED: Continuous integration, rev:133
http://jenkins.qa.ubuntu.com/job/powerd-ci/157/
Executed test runs:
    SUCCESS: http://jenkins.qa.ubuntu.com/job/powerd-utopic-armhf-ci/9
        deb: http://jenkins.qa.ubuntu.com/job/powerd-utopic-armhf-ci/9/artifact/work/output/*zip*/output.zip

Click here to trigger a rebuild:
http://s-jenkins.ubuntu-ci:8080/job/powerd-ci/157/rebuild

review: Approve (continuous-integration)

[Jamie Strandboge (jdstrand)]

Rejecting for now since we won't be implementing this (see bug description).

Unmerged revisions

133. By Jamie Strandboge on 2014-06-24

debian/usr.bin.powerd: more closely mimic confined with exec transitions

132. By Jamie Strandboge on 2014-06-24

revert change to debian/changelog-- let autolanding handle it

131. By Jamie Strandboge on 2014-06-24

* add lenient AppArmor profile to allow connecting to ofono (LP: #1296415)
  - add debian/usr.bin.powerd
  - debian/control: Build-Depends on dh-apparmor
  - debian/rules: update override_dh_installdeb to use dh_apparmor
  - debian/powerd.dirs: add etc/apparmor.d
  - debian/powerd.install: install profile in to place
  - debian/upstart: update to load the AppArmor profile

=== modified file 'debian/control'
--- debian/control	2014-05-29 06:53:15 +0000
+++ debian/control	2014-06-24 22:23:58 +0000
@@ -13,6 +13,7 @@
                libupower-glib-dev,
                uuid-dev,
                libhardware-dev (>= 0.1.0+git20131207+e452e83-0ubuntu12),
+               dh-apparmor,
 Standards-Version: 3.9.4
 Homepage: https://launchpad.net/powerd
 # If you aren't a member of ~phablet-team but need to upload packaging changes,
 
=== added file 'debian/dirs'
--- debian/dirs	1970-01-01 00:00:00 +0000
+++ debian/dirs	2014-06-24 22:23:58 +0000
@@ -0,0 +1,1 @@
+etc/apparmor.d
 
=== modified file 'debian/install'
--- debian/install	2013-05-22 17:35:03 +0000
+++ debian/install	2014-06-24 22:23:58 +0000
@@ -1,1 +1,2 @@
 debian/powerd.conf etc/dbus-1/system.d/
+debian/usr.bin.powerd etc/apparmor.d
 
=== modified file 'debian/rules'
--- debian/rules	2013-06-04 06:19:10 +0000
+++ debian/rules	2014-06-24 22:23:58 +0000
@@ -10,3 +10,7 @@
 
 override_dh_install:
 	dh_install --fail-missing
+
+override_dh_installdeb:
+	dh_apparmor --profile-name=usr.bin.powerd -ppowerd
+	dh_installdeb
 
=== modified file 'debian/upstart'
--- debian/upstart	2013-08-14 11:07:09 +0000
+++ debian/upstart	2014-06-24 22:23:58 +0000
@@ -8,4 +8,8 @@
 #uncomment the line below to enable debugging
 #env POWERD_DEBUG=1
 
+pre-start script
+    /lib/init/apparmor-profile-load usr.bin.powerd
+end script
+
 exec /usr/bin/powerd
 
=== added file 'debian/usr.bin.powerd'
--- debian/usr.bin.powerd	1970-01-01 00:00:00 +0000
+++ debian/usr.bin.powerd	2014-06-24 22:23:58 +0000
@@ -0,0 +1,16 @@
+#include <tunables/global>
+
+# Permissive profile to have profile name to limit access to ofonod (LP: #1296415)
+/usr/bin/powerd (attach_disconnected) {
+  capability,
+  mount,
+  remount,
+  umount,
+  network,
+  /   rwkl,
+  /** rwlkm,
+  /** pix,
+  dbus,
+  signal,
+  ptrace,
+}