Merge lp:~jdstrand/click-apparmor/click-apparmor.lstat into lp:click-apparmor

[Jamie Strandboge]

regenerate policy if hook symlink is newer than the profile (LP: #1291549)
debian/control: update for CI Train
- Set X-Auto-Uploader to no-rewrite-version
- Set Vcs-Bzr to the new target branch

High priority fix for bug #1291549. In essence, apps that were installed via the store had policy generated using CLICK_DIR="/top/click.ubuntu.com". Then when a preinstalled app used the same version in the store, click did not update the symlinks in the hooks directory to point to /usr/share/click/preinstalled. Click was then updated to update the symlinks to prefer the lowest overlay (practically speaking, to use /usr/share/click/preinstalled when it and /opt/click.ubuntu.com have the same version). However, while click was updated to update the symlinks, click-apparmor did not check to see if the hook symlink was newer than the generated profile. This branch fixes that.

Checklist:
 * Is your branch in sync with latest trunk (e.g. bzr pull lp:click-apparmor -> no changes): yes

 * Did you build your software in a clean sbuild/pbuilder chroot or ppa? yes

 * Did you build your software in a clean sbuild/pbuilder chroot or ppa on armhf? yes

 * Does the package's autopkgtests pass with exit status '0'? yes

 * Has your component TestPlan been executed successfully on emulator/supported device? yes

 * Has a 5 minute exploratory testing run been executed on emulator/supported device? yes

 * If you changed the packaging (debian), did you subscribe a core-dev to this MP? n/a

 * What components might get impacted by your changes? none

 * Have you requested review by the teams of these owning components? n/a

[Steve Beattie (sbeattie)]

This change looks correct. Thanks!

review: Approve

[Jamie Strandboge (jdstrand)]

Set to approved based on Steve's review.

[Jamie Strandboge (jdstrand)]

MP Review Checklist
 * Are any changes against your component pending/needed to land the MP under review in a functional state and are those called out explicitly by the submitter? no

 * Did you do exploratory testing related to the component you own with the MP changeset included? yes

 * Has the submitter requested review by all the relevant teams/reviewers? yes

 * If you are the reviewer owning the component the MP is against, have you checked that submitter has accurately filled out the submitter checklist and has taken no shortcut? I requested and reviewed. I doubled checked I didn't miss anything

[Jamie Strandboge (jdstrand)]

Note, I plan to update the comment in the test script to not reference symlinks since it isn't actually creating them, but I will do that in click-apparmor 0.2 rather than here to not delay on re-testing.

[lp:~jdstrand/click-apparmor/click-apparmor.lstat]

98. By Jamie Strandboge on 2014-03-13

* debian/control: update for CI Train
  - Set X-Auto-Uploader to no-rewrite-version
  - Set Vcs-Bzr to the new target branch

99. By Jamie Strandboge on 2014-03-13

update debian/changelog

100. By Jamie Strandboge on 2014-03-13

rev version in an attempt to get build going in CI Train

101. By Jamie Strandboge on 2014-03-13

rev version to 0.1.15.2 and set distribution name to UNTRUSTED

102. By Jamie Strandboge on 2014-03-13

fix typo in last commit

103. By Jamie Strandboge on 2014-03-13

rev version

104. By Jamie Strandboge on 2014-03-13

adjust urgency to low

Unmerged revisions

=== modified file 'apparmor/click.py'
--- apparmor/click.py	2014-02-05 22:39:37 +0000
+++ apparmor/click.py	2014-03-13 01:54:51 +0000
@@ -570,8 +570,15 @@
     result = []
     for hook in os.listdir(hooksdir):
         name = AppName(click_name=hook)
-        if not os.path.exists(os.path.join(profilesdir,
-                                           name.profile_filename)):
+        profile = os.path.join(profilesdir, name.profile_filename)
+        hook_full = os.path.join(hooksdir, hook)
+        if not os.path.exists(profile):
+            # If profile doesn't exist, we need to generate it
+            result.append(name.click_name)
+        elif os.lstat(hook_full).st_mtime > os.stat(profile).st_mtime:
+            # If the profile exists, but the hook symlink is newer, we need to
+            # regenerate it. Click may update the symlink from time to time, so
+            # we need to handle this (LP: #1291549)
             result.append(name.click_name)
     return result
 

=== modified file 'debian/changelog'
--- debian/changelog	2014-02-05 22:39:37 +0000
+++ debian/changelog	2014-03-13 01:54:51 +0000
@@ -1,3 +1,12 @@
+click-apparmor (0.1.15.1) trusty; urgency=medium
+
+  * regenerate policy if hook symlink is newer than the profile (LP: #1291549)
+  * debian/control: update for CI Train
+    - Set X-Auto-Uploader to no-rewrite-version
+    - Set Vcs-Bzr to the new target branch
+
+ -- Jamie Strandboge <[e-mail]>  Wed, 12 Mar 2014 20:16:48 -0500
+
 click-apparmor (0.1.14) trusty; urgency=medium
 
   * implement autopkgtests

=== modified file 'debian/control'
--- debian/control	2014-02-05 22:39:37 +0000
+++ debian/control	2014-03-13 01:54:51 +0000
@@ -12,6 +12,9 @@
  libnih-dbus1,
  apparmor-easyprof-ubuntu
 Standards-Version: 3.9.4
+Vcs-Bzr: https://code.launchpad.net/~ubuntu-security/click-apparmor/trunk
+Vcs-Browser: http://bazaar.launchpad.net/~ubuntu-security/click-apparmor/trunk/files
+X-Auto-Uploader: no-rewrite-version
 X-Python3-Version: >= 3.3
 XS-Testsuite: autopkgtest
 

=== modified file 'test-clicktool.py'
--- test-clicktool.py	2014-02-05 22:39:37 +0000
+++ test-clicktool.py	2014-03-13 01:54:51 +0000
@@ -1347,6 +1347,45 @@
         self.assertEquals(expected, result,
                           "Expected to get no click hooks, got %s" % (result))
 
+    def test_two_equal_directories_new_symlink(self):
+        '''Test two equal directories with new symlink (LP: #1291549)'''
+        c = self.clickstate
+        clicks = ["alpha_beta_gamma", "click_click_version",
+                  "wat_no-really_wat"]
+        for cname in clicks:
+            with open(os.path.join(c.click_dir, '%s.json' %
+                      (cname)), 'w+') as f:
+                f.write('invalid json here')
+            with open(os.path.join(c.profiles_dir, 'click_%s' %
+                                   (cname)), 'w+') as f:
+                f.write('profile %s { }' % (cname))
+
+        # No symlinks update yet, so everything should be the same
+        expected = []
+        result = click.get_missing_profiles(c.click_dir, c.profiles_dir)
+        self.assertEquals(expected, result,
+                          "Expected to get no profiles, got %s" % (result))
+        result = click.get_missing_clickhooks(c.click_dir, c.profiles_dir)
+        self.assertEquals(expected, result,
+                          "Expected to get no click hooks, got %s" % (result))
+
+        time.sleep(1)
+        clicks = ["alpha_beta_gamma", "click_click_version"]
+        for cname in clicks:
+            with open(os.path.join(c.click_dir, '%s.json' %
+                      (cname)), 'w+') as f:
+                f.write('invalid json here')
+
+        expected = []
+        result = click.get_missing_clickhooks(c.click_dir, c.profiles_dir)
+        self.assertEquals(expected, result,
+                          "Expected to get no click hooks, got %s" % (result))
+        expected = len(clicks)
+        result = click.get_missing_profiles(c.click_dir, c.profiles_dir)
+        self.assertEquals(expected, len(result),
+                          "Expected to get %d profiles, got %s:\n" %
+                          (expected, len(result)))
+
 
 class AppArmorPolicyModificationTests(unittest.TestCase):