Merge lp:~elmo/apparmor-profiles/worldofgoo into lp:apparmor-profiles

[James Troup]

Add a profile for World of Goo

[Simon Déziel (sdeziel)]

James, I haven't tested the profile you're proposing but I was wondering if that would be possible to restrict the access to Pulse SHM files only to owners ?

owner /run/shm/pulse-shm-* mr,

[lp:~elmo/apparmor-profiles/worldofgoo]

83. By James Troup on 2011-12-20

Add @{HOME}/.WorldOfGoo/ top level directory as pointed out by Kees Cook. Add missing owner restrictions, suggested by Simon Déziel.

[James Troup (elmo)]

@sdeziel, good point. I've added a bunch of 'owner' restrictions to the profile in r83.

[Jamie Strandboge (jdstrand)]

review: Approve

=== added file 'ubuntu/11.10/opt.WorldOfGoo.WorldOfGoo'
--- ubuntu/11.10/opt.WorldOfGoo.WorldOfGoo	1970-01-01 00:00:00 +0000
+++ ubuntu/11.10/opt.WorldOfGoo.WorldOfGoo	2011-12-20 01:29:24 +0000
@@ -0,0 +1,42 @@
+# vim:syntax=apparmor
+# Author: James Troup <[e-mail]>
+
+#include <tunables/global>
+
+/opt/WorldOfGoo/WorldOfGoo {
+  #include <abstractions/base>
+  #include <abstractions/X>
+  #include <abstractions/audio>
+  #include <abstractions/dbus-session>
+
+  # For the wrapper script
+  /bin/dash ix,
+  /bin/readlink rix,
+  /bin/uname rix,
+  /usr/bin/dirname rix,
+
+  # The game itself
+  /opt/WorldOfGoo/** r,
+  /opt/WorldOfGoo/WorldOfGoo.bin32 rix,
+  /opt/WorldOfGoo/WorldOfGoo.bin64 rix,
+
+  /usr/bin/gnome-screensaver-command rix,
+
+  owner @{HOME}/.WorldOfGoo/ rw,
+  owner @{HOME}/.WorldOfGoo/** rw,
+
+  /etc/timidity/freepats.cfg r,
+
+  owner @{PROC}/[0-9]*/cmdline r,
+  owner @{PROC}/[0-9]*/statm r,
+  @{PROC}/filesystems r,
+
+  # World of Goo seems to like to mmap files more than some of the
+  # abstractions allow for...
+  owner /run/shm/pulse-shm-* mr,
+  /usr/share/locale-langpack/** mr,
+  /dev/dri/card0 mrw,
+
+  # https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/904548
+  /usr/lib/@{multiarch}/gconv/gconv-modules* mr,
+}