SDK and cordova webview applications should not use ~/.local/share/*/.QtWebKit/ for their databases

The day is coming when oneliners will rule the World again:

sudo apt-get install webbrowser-app -y;unset XDG_DATA_HOME;webbrowser-app & sleep 1;ls -l /proc/`ps aux | grep webbrowser-app|awk '{print $2}'|head -1`/fd|grep webbrowser-app;killall -9 webbrowser-app;export XDG_DATA_HOME=/tmp;webbrowser-app & sleep 1;ls -l /proc/`ps aux | grep webbrowser-app|awk '{print $2}'|head -1`/fd|grep webbrowser-app;killall -9 webbrowser-app;unset XDG_DATA_HOME

So setting the XDG_[.*] variables sounds a viable workaround

This also affects cordova-ubuntu.

Fix committed into lp:ubuntu-ui-toolkit at revision 752, scheduled for release in ubuntu-ui-toolkit, milestone Unknown

This bug was fixed in the package ubuntu-ui-toolkit - 0.1.46+13.10.20130925.1-0ubuntu1

---------------
ubuntu-ui-toolkit (0.1.46+13.10.20130925.1-0ubuntu1) saucy; urgency=low

  [ Timo Jyrinki ]
  * Temporarily disable the jokes example in order to not have
    qtmultimedia dependency from examples that is not used otherwise.
    This lessens the dependency chains of packages. It can be added back
    after Ubuntu 13.10.
  * Fix regression in qmlscene usage (LP: #1229541). (LP: #1229541)

  [ Christian Dywan ]
  * Set QCoreApplication::applicationName based on MainView. (LP:
    #1197056, #1197051, #1224126)
  * Include subfolders of Components in api check.

  [ Zsombor Egri ]
  * Organizer EDS (Evolution Data Server) integration.
  * StateSaver attached component.
  * Fix alarm status reporting, updating documentation on asynchronous
    behavior of save and cancel operations. Alarm status notification
    reports the operation the status refers to. (LP: #1226516)
  * Dialer + DialerHand components required for TimePicker. .

  [ Leo Arias ]
  * Added UbuntuUIToolkitAppTestCase as a base test case for the
    autopilot tests. (LP: #1227355)
  * Added the autopilot emulator for toggles.

  [ Nick Dedekind ]
  * Added clipping to tab bar. (LP: #1226104)

  [ Alberto Mardegan ]
  * Support re-attaching to a different QQuickView Make the plugin
    correctly handle the case when the QQuickView is destroyed and a new
    one is created: this is done by avoiding using static variables, and
    instead binding the data to the QQmlEngine, QQmlContext or QWindow
    as appropriate. . (LP: #1221707)

  [ Dennis O'Flaherty ]
  * Reword the description for easier reading.

  [ tpeeters ]
  * Fix warnings when running gallery-app autopilot tests. (LP:
    #1223329, #1223326)
  * Smarter automatic updating of Panel's opened property. Panel.open()
    and Panel.close() should be used to open/close a Panel, or when
    using a toolbar with ToolbarItems from a Page, set Page.tools.opened
    to open/close the toolbar. No API or behavior changes since the
    panel-open-close branch. Toolbar behavior changes will be done in a
    following MR.

  [ Ubuntu daily release ]
  * Automatic snapshot from revision 765
 -- Ubuntu daily release <email address hidden> Wed, 25 Sep 2013 07:08:56 +0000

This bug was fixed in the package apparmor-easyprof-ubuntu - 1.0.35

---------------
apparmor-easyprof-ubuntu (1.0.35) saucy; urgency=low

  * apparmor-easyprof-ubuntu.install: install data/hardware/*, thus allowing
    porters, OEMs, etc to ship their own policy without having to modify this
    package (LP: #1197133)
  * add data/hardware/graphics.d/* and data/hardware/audio.d/*, namespaced to
    this package. We will move these out to lxc-android-config later
  * tests/test-data.py: adjust to test data/hardware/*
  * accounts: move to reserved status until LP: 1230091 is fixed
  * calendar: remove workaround rule for gio DBus path (LP: #1227295)
  * add usermetrics policy group so apps can update the infographic
  * ubuntu-* templates:
    - allow StartServiceByName on the system bus too. This is needed by the
      new usermetrics policy group and we will presumably have more going
      forward (eg location)
    - account for /org/freedesktop/dbus object path. This seems to be used by
      the python DBus bindings (eg, friends)
    - move hardware specific accesses out of the templates into
      hardware/graphics.d/ in preparation of the move to shipping these in
      lxc-android-config (note, this doesn't change apparmor policy in any
      way)
    - add 'r' to dbus system bus socket (LP: #1208988)
    - add ixr access to thumbnailer helper (LP: #1234543)
    - finetune HUD access
    - don't use ibus abstraction but instead use 'r' access for
      owner @{HOME}/.config/ibus/**
    - don't use freedesktop.org abstraction but instead add read accesses
      for /usr/share/icons and various mime files
    - updates for new gstreamer
      - move in gstreamer accesses from audio policy groupd due to hybris
  * ubuntu-sdk template:
    - remove workaround paths now that ubuntu-ui-toolkit is using
      QCoreApplication::applicationName based on MainView's applicationName
      (LP: #1197056, #1197051, #1224126, LP: #1231863)
  * ubuntu-webapp template:
    - allow read access to /usr/share/unity-webapps/userscripts/**
    - allow rix to gst-plugin-scanner
  * add reserved friends policy group (reserved because it needs integration
    with trust-store to be used by untrusted apps)
  * remove peer from receive DBus rules in the ubuntu-* templates and the
    contacts, history, and location policy groups (LP: #1233895)
  * audio:
    - move gstreamer stuff out to templates since hybris pulls it in for all
      apps
    - include hardware/audio.d for hardware specific accesses
 -- Jamie Strandboge <email address hidden> Mon, 07 Oct 2013 13:18:27 -0500

Can the Ubuntu Cordova task be closed or is it still affected?

Cordova is still affected-- confirmed on unity7 (desktop) and unity8 (touch/mako). Here is the apparmor policy needed for cordova-ubuntu-2.8 on trusty using com.ubuntu.developer.abreu-alexandre.cordova-qrcode-reader 1.0.4:
  owner @{HOME}/.local/share/cordova-ubuntu-2.8/ rw,
  owner @{HOME}/.local/share/cordova-ubuntu-2.8/.QtWebKit/ rw,
  owner @{HOME}/.local/share/cordova-ubuntu-2.8/.QtWebKit/cache/ rw,
  owner @{HOME}/.local/share/cordova-ubuntu-2.8/.QtWebKit/cache/** rw,
  owner @{HOME}/.local/share/cordova-ubuntu-2.8/.QtWebKit/Databases/ rw,
  owner @{HOME}/.local/share/cordova-ubuntu-2.8/.QtWebKit/Databases/** rwk,
  owner @{HOME}/.local/share/cordova-ubuntu-2.8/.QtWebKit/LocalStorage/ rw,
  owner @{HOME}/.local/share/cordova-ubuntu-2.8/.QtWebKit/LocalStorage/** rwk,
  owner @{HOME}/.local/share/cordova-ubuntu-2.8/.QtWebKit/WebpageIcons.db* rwk,
  owner @{HOME}/.local/share/cordova-ubuntu-2.8/.QtWebKit/cookies.db* rwk,

cordova-ubuntu needs to somehow determine the click manifest "name" and adjust @{HOME}/.local/share/cordova-ubuntu-2.8 to be @{HOME}/.local/share/<click package name>.

Re-opening the apparmor-easyprof-ubuntu task to remove workaround accesses in 1.0.42.

Fix committed into lp:ubuntu-html5-theme at revision 114, scheduled for release in ubuntu-html5-theme, milestone 14.02

This bug was fixed in the package ubuntu-html5-theme - 0.1+14.04.20140203-0ubuntu1

---------------
ubuntu-html5-theme (0.1+14.04.20140203-0ubuntu1) trusty; urgency=low

  [ Alexandre Abreu ]
  * fix sdk package for now bc unity-webapps-qml hasn't been uploaded
    yet.

  [ Ubuntu daily release ]
  * Automatic snapshot from revision 119
 -- Ubuntu daily release <email address hidden> Mon, 03 Feb 2014 14:15:30 +0000

This bug was fixed in the package apparmor-easyprof-ubuntu - 1.1.3

---------------
apparmor-easyprof-ubuntu (1.1.3) trusty; urgency=medium

  * 1.1/webview: updates for oxide
  * 1.1/ubuntu-sdk: remove workaround policy for LP: #1197056 (cordova webview
    applications should not use ~/.local/share)
  * 1.*/ubuntu-sdk: all to receive Open on org.freedesktop.Application to
    allow UriHandler in the SDK to work with already running apps. Patch
    thanks to Ken Vandine.
  * implement autopkgtests
    - add debian/tests/control
    - add debian/tests/install_*
    - adjust debian/control for XS-Testsuite
 -- Jamie Strandboge <email address hidden> Wed, 05 Feb 2014 16:54:26 -0500

Marking cordova-ubuntu as 'Fix Released' based on status of bug #1217439.