Merge lp:~cmiller/apparmor/chromiumbrowser-fcitx-abstraction into lp:apparmor/2.12

[Chad Miller]

[Tyler Hicks (tyhicks)]

Thanks for putting this merge together, Chad. Questions/comments:

1) I'm surprised that you don't have to grant access to the Hello method on the org.freedesktop.DBus interface. Calling that method is typically required when connecting to a bus. Is that not the case with the fcitx bus?

2) Can you add 'peer=(name=org.freedesktop.DBus)' to the rules on the rules that specificy the org.freedesktop.DBus and org.freedesktop.DBus.Properties interfaces? See abstractions/dbus-accessibility-strict for a good example.

3) I'd suggest combining the last set of rules into a single rule, ala abstractions/dbus-accessibility-strict.

4) I looked at what fcitx documentation that I could find and granting access to all of the org.fcitx.Fcitx.InputContext interface and to CreateICv3 seems relatively safe so I think the first two rules are fine.

Thanks again!

review: Needs Fixing

[lp:~cmiller/apparmor/chromiumbrowser-fcitx-abstraction]

3336. By Chad Miller on 2016-01-11

Split into two pieces. The first updates the strict ruleset for the
accessibility facilities' dbus access, and adds some missing member calls like
Hello. The other groups members in fcitx abstraction together nicer.

[Tyler Hicks (tyhicks)]

I've left inline comments in hopes that it is clear what specific rules I'm talking about.

review: Needs Fixing

[lp:~cmiller/apparmor/chromiumbrowser-fcitx-abstraction]

3337. By Chad Miller on 2016-01-11

Un-splitting. Reverting dbus-accessibility-strict.

Remove unneeded rules.

3338. By Chad Miller on 2016-01-15

Finish separating accessibility rules.

[Steve Beattie (sbeattie)]

This is superceded by the commit http://bazaar.launchpad.net/~apparmor-dev/apparmor/master/revision/3479 , closing.

Thanks!

Unmerged revisions

3338. By Chad Miller on 2016-01-15

Finish separating accessibility rules.

3337. By Chad Miller on 2016-01-11

Un-splitting. Reverting dbus-accessibility-strict.

Remove unneeded rules.

3336. By Chad Miller on 2016-01-11

Split into two pieces. The first updates the strict ruleset for the
accessibility facilities' dbus access, and adds some missing member calls like
Hello. The other groups members in fcitx abstraction together nicer.

3335. By Chad Miller on 2016-01-11

Create a new input-method abstraction: pass through dbus method calls and
responses relating to the FCITX input method

=== modified file 'profiles/apparmor.d/abstractions/dbus-accessibility-strict'
--- profiles/apparmor.d/abstractions/dbus-accessibility-strict	2014-01-10 21:35:30 +0000
+++ profiles/apparmor.d/abstractions/dbus-accessibility-strict	2016-01-15 15:03:10 +0000
@@ -1,7 +1,7 @@
 # vim:syntax=apparmor
 # ------------------------------------------------------------------
 #
-#    Copyright (C) 2013 Canonical Ltd.
+#    Copyright (C) 2013, 2016 Canonical Ltd.
 #
 #    This program is free software; you can redistribute it and/or
 #    modify it under the terms of version 2 of the GNU General Public

=== added file 'profiles/apparmor.d/abstractions/fcitx'
--- profiles/apparmor.d/abstractions/fcitx	1970-01-01 00:00:00 +0000
+++ profiles/apparmor.d/abstractions/fcitx	2016-01-15 15:03:10 +0000
@@ -0,0 +1,42 @@
+# vim:syntax=apparmor
+# ------------------------------------------------------------------
+#
+#    Copyright (C) 2016 Canonical Ltd.
+#
+#    This program is free software; you can redistribute it and/or
+#    modify it under the terms of version 2 of the GNU General Public
+#    License published by the Free Software Foundation.
+#
+# ------------------------------------------------------------------
+  # abstraction for fcitx input methods
+
+  dbus send
+       bus=fcitx
+       path=/org/freedesktop/DBus
+       interface=org.freedesktop.DBus
+       member={Hello,AddMatch,RemoveMatch,GetNameOwner,StartServiceByName}
+       peer=(name=org.freedesktop.DBus),
+
+  dbus send
+       bus=fcitx
+       path=/org/freedesktop/DBus
+       interface=org.freedesktop.DBus.Properties
+       member=GetAll
+       peer=(name=org.freedesktop.DBus),
+
+  dbus send
+       bus=fcitx
+       path=/inputmethod
+       interface=org.fcitx.Fcitx.InputMethod
+       member=CreateICv3,
+
+  dbus (send,receive)
+       bus=fcitx
+       interface=org.fcitx.Fcitx.InputContext,
+
+  dbus send
+       bus=fcitx
+       path=/inputcontext_[0-9]*
+       interface=org.freedesktop.DBus.Properties
+       member=GetAll,
+