Merge lp:~intrigeri/apparmor-profiles/cleanup-pidgin-orcexec into lp:apparmor-profiles

[intrigeri]

I'd like Simon Deziel (who's been working with me on this profile in the past, and needed some rules that I'm dropping here) to review this, before asking for a merge. Particularly, it would be good to know if sound notifications work when /tmp is mounted noexec.

[Simon Déziel (sdeziel)]

On 09/10/2014 07:09 PM, intrigeri wrote:
> intrigeri has proposed merging
> lp:~intrigeri/apparmor-profiles/cleanup-pidgin-orcexec into
> lp:apparmor-profiles.
>
> Requested reviews: simon123 (simon-deziel)

I didn't know a previous me created such a user but that's quite
possible. My LP is "sdeziel"

> For more details, see:
> https://code.launchpad.net/~intrigeri/apparmor-profiles/cleanup-pidgin-orcexec/+merge/234228
>
> I'd like Simon Deziel (who's been working with me on this profile in
> the past, and needed some rules that I'm dropping here) to review
> this, before asking for a merge. Particularly, it would be good to
> know if sound notifications work when /tmp is mounted noexec.

"owner @{HOME}/orcexec.* mr," is the only missing rule in
abstractions/gstreamer to get the sound working with /tmp mounted noexec.

Regards,
Simon

[lp:~intrigeri/apparmor-profiles/cleanup-pidgin-orcexec]

137. By intrigeri on 2014-09-15

Fix gstreamer abstraction to make it work when /tmp is mounted read-only.

Thanks to Simon Déziel for testing and reporting back!

[Steve Beattie (sbeattie)]

Committed, thanks!

review: Approve

=== modified file 'ubuntu/14.10/abstractions/gstreamer'
--- ubuntu/14.10/abstractions/gstreamer	2014-07-22 17:05:59 +0000
+++ ubuntu/14.10/abstractions/gstreamer	2014-09-15 04:12:34 +0000
@@ -13,3 +13,5 @@
 
   owner /tmp/orcexec.* mrw,
   owner /{,var/}run/user/[0-9]*/orcexec.* mrw,
+  # needed if /tmp is mounted noexec:
+  owner @{HOME}/orcexec.* mr,

=== modified file 'ubuntu/14.10/usr.bin.pidgin'
--- ubuntu/14.10/usr.bin.pidgin	2014-07-17 15:33:08 +0000
+++ ubuntu/14.10/usr.bin.pidgin	2014-09-15 04:12:34 +0000
@@ -10,6 +10,7 @@
   #include <abstractions/dbus-session>
   #include <abstractions/enchant>
   #include <abstractions/gnome>
+  #include <abstractions/gstreamer>
   #include <abstractions/ibus>
   #include <abstractions/launchpad-integration>
   #include <abstractions/nameservice>
@@ -61,13 +62,6 @@
   owner @{PROC}/[0-9]*/auxv r,
   owner @{PROC}/[0-9]*/fd/ r,
 
-  # For sound notifications
-  owner /tmp/orcexec.* mr,
-  # ... if /tmp is mounted noexec
-  owner @{HOME}/orcexec.* mr,
-  owner /{,var/}run/user/[0-9]*/ r,
-  owner /{,var/}run/user/[0-9]*/orcexec.* mrw,
-
   # Site-specific additions and overrides. See local/README for details.
   #include <local/usr.bin.pidgin>
 }