Merge ~ubuntu-audio-dev/pulseaudio:classic-snap-support into ~ubuntu-audio-dev/pulseaudio:ubuntu

[James Henstridge]

debian/patches: grant classic snaps access to microphone.

The 1:12.2-0ubuntu2 release broke recording support for classic snaps. These snaps have an AppArmor label, but won't necessarily have the relevant Pulse Audio interfaces plugged: they are just expected to have access by default.

This can be demonstrated with a command like the following:

    aa-exec -p snap.skype.skype /usr/bin/parecord foo.wav

Without the changes in this branch, this gives an "access denied" error. With them, it successfully records audio to "foo.wav".

diff --git a/debian/changelog b/debian/changelog
index 9c2fe54..3d85ef7 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,10 +1,15 @@
-pulseaudio (1:12.2-0ubuntu3) UNRELEASED; urgency=medium
+pulseaudio (1:12.2-0ubuntu3) cosmic; urgency=medium
 
+  [ Ken VanDine ]
   * Update patch tags with more detailed descriptions and a note about 
     not forwarding upstream:
     - 0700-modules-add-snappy-policy-module.patch
     - 0701-enable-snap-policy-module.patch
 
+  [ James Henstridge ]
+  * 0700-modules-add-snappy-policy-module.patch: grant recording access
+    to snaps with classic confinement. (LP: #1787324)
+
  -- Ken VanDine <[e-mail]>  Mon, 13 Aug 2018 10:11:10 -0400
 
 pulseaudio (1:12.2-0ubuntu2) cosmic; urgency=medium
diff --git a/debian/patches/0700-modules-add-snappy-policy-module.patch b/debian/patches/0700-modules-add-snappy-policy-module.patch
index 9d66510..96f62f7 100644
--- a/debian/patches/0700-modules-add-snappy-policy-module.patch
+++ b/debian/patches/0700-modules-add-snappy-policy-module.patch
@@ -1,18 +1,19 @@
 From: James Henstridge <[e-mail]>
 Date: Tue, 7 Aug 2018 12:40:59 +0800
 Subject: [PATCH] modules: add snap policy module
-Co-authored-by: Simon Fels <[e-mail]>
+
 Forwarded: not-needed
 
-This patch allows pulseaudio to limit audio recording to snaps with 
+This patch allows pulseaudio to limit audio recording to snaps with
 the audio-recording interface connected.  We will not pursue upstreaming
-this patch as the longer term solution will probably use PipeWire.  
+this patch as the longer term solution will probably use PipeWire.
 
+Co-authored-by: Simon Fels <[e-mail]>
 ---
  configure.ac                     |  17 ++
  src/Makefile.am                  |  13 ++
- src/modules/module-snap-policy.c | 347 +++++++++++++++++++++++++++++++++++++++
- 3 files changed, 377 insertions(+)
+ src/modules/module-snap-policy.c | 384 +++++++++++++++++++++++++++++++++++++++
+ 3 files changed, 414 insertions(+)
  create mode 100644 src/modules/module-snap-policy.c
 
 diff --git a/configure.ac b/configure.ac
@@ -90,10 +91,10 @@ index d623d0a..16b4d5d 100644
  module_rtp_send_la_LDFLAGS = $(MODULE_LDFLAGS)
 diff --git a/src/modules/module-snap-policy.c b/src/modules/module-snap-policy.c
 new file mode 100644
-index 0000000..8660476
+index 0000000..0a1f5f4
 --- /dev/null
 +++ b/src/modules/module-snap-policy.c
-@@ -0,0 +1,347 @@
+@@ -0,0 +1,384 @@
 +/***
 +    This file is part of PulseAudio.
 +
@@ -171,18 +172,28 @@ index 0000000..8660476
 +
 +/* ---- Code running in glib thread ---- */
 +
-+static void check_interfaces_finish(GObject *source_object,
++static void complete_check_access(struct per_client *pc, bool grant_access)
++{
++    struct userdata *u = pc->userdata;
++
++    pa_mutex_lock(u->mutex);
++    pc->grant_access = grant_access;
++    pc->completed = true;
++    pa_asyncq_push(u->results, pc, true);
++    pa_mutex_unlock(u->mutex);
++}
++
++static void get_interfaces_finished(GObject *source_object,
 +                                    GAsyncResult *result,
 +                                    gpointer user_data)
 +{
 +    struct per_client *pc = user_data;
 +    struct userdata *u = pc->userdata;
++    bool grant_access = false;
 +    g_autoptr(GError) error = NULL;
 +    g_autoptr(GPtrArray) plugs = NULL;
 +    unsigned i;
 +
-+    pa_mutex_lock(u->mutex);
-+
 +    if (!snapd_client_get_interfaces_finish(u->snapd, result, &plugs, NULL, &error)) {
 +        pa_log_warn("snapd_client_get_interfaces failed: %s", error->message);
 +        goto end;
@@ -200,24 +211,51 @@ index 0000000..8660476
 +            continue;
 +        }
 +        if (!strcmp(iface, "pulseaudio") || !strcmp(iface, "audio-record")) {
-+            pc->grant_access = true;
++            grant_access = true;
 +            break;
 +        }
 +    }
 +
 +end:
-+    pc->completed = true;
-+    pa_asyncq_push(u->results, pc, true);
-+    pa_mutex_unlock(u->mutex);
++    complete_check_access(pc, grant_access);
 +}
 +
-+static gboolean check_interfaces(void *data)
++static void get_snap_finished(GObject *source_object,
++                              GAsyncResult *result,
++                              gpointer user_data)
 +{
-+    struct per_client *pc = data;
++    struct per_client *pc = user_data;
 +    struct userdata *u = pc->userdata;
++    g_autoptr(GError) error = NULL;
++    g_autoptr(SnapdSnap) snap = NULL;
++
++    snap = snapd_client_list_one_finish(u->snapd, result, &error);
++    if (!snap) {
++        pa_log_warn("snapd_client_get_snap failed: %s", error->message);
++        complete_check_access(pc, false);
++        return;
++    }
++
++    /* Snaps using classic confinement are granted access */
++    if (snapd_snap_get_confinement(snap) == SNAPD_CONFINEMENT_CLASSIC) {
++        complete_check_access(pc, true);
++        return;
++    }
 +
++    /* We have a non-classic snap, we need to check its connected
++     * interfaces */
 +    snapd_client_get_interfaces_async(u->snapd, u->cancellable,
-+                                      check_interfaces_finish, pc);
++                                      get_interfaces_finished, pc);
++}
++
++
++static gboolean check_access(void *data)
++{
++    struct per_client *pc = data;
++    struct userdata *u = pc->userdata;
++
++    snapd_client_list_one_async(u->snapd, pc->snap_name, u->cancellable,
++                                get_snap_finished, pc);
 +    return G_SOURCE_REMOVE;
 +}
 +
@@ -351,7 +389,7 @@ index 0000000..8660476
 +    pa_dynarray_append(pc->pending_requests, d);
 +    pa_hashmap_put(u->clients, (void *) (size_t) d->client_index, pc);
 +    pa_log_info("Checking access for client %d (%s)", pc->index, pc->snap_name);
-+    g_main_context_invoke(u->main_context, check_interfaces, pc);
++    g_main_context_invoke(u->main_context, check_access, pc);
 +
 +    result = PA_HOOK_CANCEL;
 +