Merge lp:~mardy/signon-apparmor-extension/lp1415492 into lp:signon-apparmor-extension

[Alberto Mardegan]

Treat p2p clients as unconfined

Treat p2p clients as unconfined

[David Barth (dbarth)]

review: Approve

[PS Jenkins bot (ps-jenkins)]

FAILED: Continuous integration, rev:19
http://jenkins.qa.ubuntu.com/job/signon-apparmor-extension-ci/15/
Executed test runs:
    FAILURE: http://jenkins.qa.ubuntu.com/job/signon-apparmor-extension-vivid-amd64-ci/1/console
    FAILURE: http://jenkins.qa.ubuntu.com/job/signon-apparmor-extension-vivid-armhf-ci/1/console
    FAILURE: http://jenkins.qa.ubuntu.com/job/signon-apparmor-extension-vivid-i386-ci/1/console

Click here to trigger a rebuild:
http://s-jenkins.ubuntu-ci:8080/job/signon-apparmor-extension-ci/15/rebuild

review: Needs Fixing (continuous-integration)

=== modified file 'src/access-control-manager.cpp'
--- src/access-control-manager.cpp	2014-10-02 13:54:26 +0000
+++ src/access-control-manager.cpp	2015-01-28 15:37:31 +0000
@@ -25,10 +25,9 @@
 #include <QDBusMessage>
 #include <QDebug>
 #include <QStringList>
-#include <dbus/dbus.h>
 #include <sys/apparmor.h>
 
-static const char keychainAppId[] = "SignondKeychain";
+static const char keychainAppId[] = "unconfined";
 
 AccessReply::AccessReply(const SignOn::AccessRequest &request,
                          QObject *parent):
@@ -72,29 +71,15 @@
 QString AccessControlManager::appIdOfPeer(const QDBusConnection &peerConnection,
                                           const QDBusMessage &peerMessage)
 {
+    Q_UNUSED(peerConnection);
+
     QString uniqueConnectionId = peerMessage.service();
     QString appId;
 
     if (uniqueConnectionId.isEmpty()) {
-        /* it's a p2p connection; get the fd of the socket, and ask apparmor to
-         * identify the peer. */
-        DBusConnection *connection =
-            (DBusConnection *)peerConnection.internalPointer();
-        int fd = 0;
-        dbus_bool_t ok = dbus_connection_get_unix_fd(connection, &fd);
-        if (Q_LIKELY(ok)) {
-            char *con = NULL, *mode = NULL;
-            int ret = aa_getpeercon(fd, &con, &mode);
-            if (Q_LIKELY(ret >= 0)) {
-                appId = QString::fromUtf8(con);
-                qDebug() << "App ID:" << appId;
-                free(con);
-            } else {
-                qWarning() << "Couldn't get apparmor profile of peer";
-            }
-        } else {
-            qWarning() << "Couldn't get fd of caller!";
-        }
+        /* it's a p2p connection; we treat the peer as "unconfined" */
+        qDebug() << "Client connected via P2P socket; treating as unconfined";
+        appId = "unconfined";
     } else {
         QDBusMessage msg =
             QDBusMessage::createMethodCall("org.freedesktop.DBus",
 
=== modified file 'tests/tst_extension.cpp'
--- tests/tst_extension.cpp	2014-10-02 13:54:26 +0000
+++ tests/tst_extension.cpp	2015-01-28 15:37:31 +0000
@@ -122,8 +122,6 @@
     QDBusMessage msg =
         QDBusMessage::createMethodCall("", "/", "my.interface", "hi");
     QString appId = m_acm->appIdOfPeer(m_p2pConnection, msg);
-    /* At the moment, AppArmor doesn't implement the
-     * GetConnectionAppArmorSecurityContext method, so expect an error. */
     QCOMPARE(appId, QStringLiteral("unconfined"));
 }
 
@@ -132,7 +130,7 @@
     /* forge a QDBusMessage */
     setMockedProfile("com.ubuntu.myapp_myapp_0.2");
     QDBusMessage msg =
-        QDBusMessage::createMethodCall("", "/", "my.interface", "hi");
+        QDBusMessage::createMethodCall(":0.1", "/", "my.interface", "hi");
     bool allowed = m_acm->isPeerAllowedToAccess(m_busConnection, msg,
                                                 "anyContext");
     QVERIFY(!allowed);