Merge lp:~ted/apparmor-easyprof-ubuntu/libual-tps into lp:apparmor-easyprof-ubuntu

[Ted Gould]

DBus rule for UAL TPS untrusted helpers

[Jamie Strandboge (jdstrand)]

We discussed this rule and the implementation at length in #ubuntu-hardened today. We would prefer another approach which would avoid some issues, but have agreed for now this is ok. Bug #1462492 tracks fixing this in a future iteration.

[Jamie Strandboge (jdstrand)]

As for this particular rule, it needs to be applied in all the version of the sdk template, not just 1.0. I can take care of that.

review: Approve

=== modified file 'data/templates/ubuntu/1.0/ubuntu-sdk'
--- data/templates/ubuntu/1.0/ubuntu-sdk	2015-05-15 09:37:26 +0000
+++ data/templates/ubuntu/1.0/ubuntu-sdk	2015-06-05 18:56:23 +0000
@@ -188,6 +188,15 @@
        member="Open"
        peer=(label=unconfined),
 
+  # Untrusted Helpers needed to use Trusted Prompt Sessions getting the
+  # Mir socket from their trusted helper (who is setting up the TPS)
+  dbus (receive, send)
+       path=/com/canonical/UbuntuAppLaunch/@{APP_ID_DBUS}/*
+       interface="org.canonical.UbuntuAppLaunch.SocketDemangler"
+       member="GetMirSocket"
+       bus=session
+       peer=(label=unconfined),
+
   # TODO: finetune this
   dbus (send)
        bus=session