Merge lp:~jdstrand/firefox/firefox-3.5-apparmor into lp:firefox/3.5

[Jamie Strandboge]

[Alexander Sack (asac)]

seems you forgot to add the profile itself? While at it, consider to use same changelog format as we usually do.

review: Needs Resubmitting

[lp:~jdstrand/firefox/firefox-3.5-apparmor]

453. By Jamie Strandboge on 2009-08-17

actually add the files

454. By Jamie Strandboge on 2009-08-17

update changelog to use what mozillateam uses

[Jamie Strandboge (jdstrand)]

Files added and changelog updated.

[lp:~jdstrand/firefox/firefox-3.5-apparmor]

455. By Jamie Strandboge on 2009-08-19

debian/usr.bin.firefox-3.5: also allow /usr/bin/totem

456. By Jamie Strandboge on 2009-08-26

add access to /proc/filesystems

457. By Jamie Strandboge on 2009-08-26

adjust profile for sun java:
- add network inet6 stream and proc entries for ipv6
- access to @{HOME}/.java
- access to /etc/java-*-sun/**
- access to /usr/lib/jvm/java-*-sun-1.*/jre/bin/java

reduce noise:
- deny write access to /usr/lib/firefox-3.*/**, /usr/lib/firefox-addons/** and
  deny /usr/lib/xulrunner-addons/**

work for new user (allow access to /bin/which)

mozplugger improvements (/etc/mozpluggerr and /usr/bin/mplayer)

adjust access to evince to be PUxr (ie use a profile if it is there, otherwise
run unconfined)

458. By Jamie Strandboge on 2009-08-26

add missing LP reference

459. By Jamie Strandboge on 2009-09-02

generalize apparmor profile packaging:
- debian/rules:
 - use .in files for firefox-3.5.postrm, firefox-3.5.preinst,
   usr.bin.firefox.apparmor, README.Debian.in
 - cp instead of dh_install the profile, since we need to rename
- debian/README.Debian.in: use @APPNAME@
- debian/firefox-3.5.postinst.in: use @APPNAME@
- debian/firefox-3.5.postrm.in: use @APPNAME@
- debian/firefox-3.5.preinst.in: use @APPNAME@
- debian/usr.bin.firefox.apparmor.in: use @APPNAME@

debian/apport/firefox-3.5.py: add apparmor info if profile is not disabled

460. By Jamie Strandboge on 2009-09-02

fix typo in changelog

461. By Jamie Strandboge on 2009-09-03

merge from trunk

462. By Jamie Strandboge on 2009-09-03

debian/firefox-3.5.preinst.in: allow for when apparmor is not installed

463. By Jamie Strandboge on 2009-09-14

merge from trunk

464. By Jamie Strandboge on 2009-09-14

merge from trunk

465. By Jamie Strandboge on 2009-09-14

[ Jamie Strandboge <email address hidden> ]
* debian/usr.bin.firefox-3.5:
  - allow gnash (LP: #429061)
  - allow access to plugins directory (LP: #428071)
  - allow access to abstractions/ubuntu-console-email,
    abstractions/ubuntu-email and abstractions/ubuntu-gnome-terminal
    for mailto:. Add commented section for using xterm and konsole

Unmerged revisions

465. By Jamie Strandboge on 2009-09-14

[ Jamie Strandboge <email address hidden> ]
* debian/usr.bin.firefox-3.5:
  - allow gnash (LP: #429061)
  - allow access to plugins directory (LP: #428071)
  - allow access to abstractions/ubuntu-console-email,
    abstractions/ubuntu-email and abstractions/ubuntu-gnome-terminal
    for mailto:. Add commented section for using xterm and konsole

464. By Jamie Strandboge on 2009-09-14

merge from trunk

463. By Jamie Strandboge on 2009-09-14

merge from trunk

=== modified file 'debian/changelog'
--- debian/changelog	2009-08-10 15:06:32 +0000
+++ debian/changelog	2009-08-13 16:15:27 +0000
@@ -1,3 +1,18 @@
+firefox-3.5 (3.5.2+nobinonly-0ubuntu3) UNRELEASED; urgency=low
+
+  * add AppArmor profile (disabled by default)
+    - debian/firefox-3.5.dirs: add etc/apparmor.d/disable
+    - add debian/firefox-3.5.preinst: disable the profile on new installs
+      and upgrades to this version
+    - debian/firefox-3.5.postinst.in: reload profile
+    - add debian/firefox-3.5.postrm: cleanup force-complain and disable
+      directories
+    - add debian/usr.bin.firefox-3.5
+    - debian/rules: install usr.bin.firefox-3.5
+    - add debian/README.Debian with note about AppArmor
+
+ -- Jamie Strandboge <[e-mail]>  Thu, 13 Aug 2009 09:09:36 -0500
+
 firefox-3.5 (3.5.2+nobinonly-0ubuntu2) karmic; urgency=low
 
   Firefox 3.5 by default upload

=== modified file 'debian/firefox-3.5.dirs'
--- debian/firefox-3.5.dirs	2009-03-18 01:10:51 +0000
+++ debian/firefox-3.5.dirs	2009-08-13 16:15:27 +0000
@@ -1,3 +1,4 @@
+etc/apparmor.d/disable
 usr/lib/firefox-addons/extensions
 usr/lib/firefox-addons/plugins
 usr/lib/firefox-addons/searchplugins

=== modified file 'debian/firefox-3.5.postinst.in'
--- debian/firefox-3.5.postinst.in	2009-07-18 18:30:27 +0000
+++ debian/firefox-3.5.postinst.in	2009-08-13 16:15:27 +0000
@@ -10,6 +10,12 @@
     update-alternatives --install /usr/bin/x-www-browser \
         x-www-browser /usr/bin/$APPNAME 40
     touch $LIBDIR/.autoreg
+
+    # Reload AppArmor profile
+    APP_PROFILE="/etc/apparmor.d/usr.bin.firefox-3.5"
+    if [ -f "$APP_PROFILE" ] && aa-status --enabled 2>/dev/null; then
+        apparmor_parser -r "$APP_PROFILE" || true
+    fi
 fi
 
 echo "Please restart all running instances of $APPNAME, or you will experience problems."

=== modified file 'debian/rules'
--- debian/rules	2009-08-10 15:05:32 +0000
+++ debian/rules	2009-08-13 16:15:27 +0000
@@ -220,6 +220,7 @@
 	dh_link usr/share/myspell/dicts $(DEBIAN_FF3_DIR)/dictionaries
 	rm -f debian/$(DEBIAN_NAME)/$(DEBIAN_FF3_DIR)/chrome/browser-branding*
 	dh_install debian/distribution.ini $(DEBIAN_FF3_DIR)/distribution/
+	dh_install debian/usr.bin.firefox-3.5 etc/apparmor.d
 
 binary-install/$(DEBIAN_NAME_OTHER)-branding::
 	dh_install -p$(DEBIAN_NAME_OTHER)-branding \