Merge lp:~jdstrand/media-hub/1356883 into lp:media-hub

[Jamie Strandboge]

debian/usr.bin.media-hub-server: update for recent denials:
- allow read access to /etc/udev/udev.conf (LP: #1356883)
- add video abstraction
- silence access to /run/udev/data/** like we do elsewhere
- allow read on /dev/video*
- allow read on /sys/devices/**/video4linux/video**
- allow read on /sys/devices/**/video4linux/**/uevent

allow read access to /etc/udev/udev.conf for gstreamer. This access is a common noisy denial and not high priority, but it may be confusing for people so just allow it (the contents of the file are harmless). Allow several other readonly accesses based on denials seen with mediascanner2.

The rules only add accesses that were previously denied so there should be no risk of regression. You can test the profile compiles with:
$ apparmor_parser -QTK ./debian/usr.bin.media-hub-server

[PS Jenkins bot (ps-jenkins)]

PASSED: Continuous integration, rev:57
http://jenkins.qa.ubuntu.com/job/media-hub-ci/86/
Executed test runs:
    SUCCESS: http://jenkins.qa.ubuntu.com/job/media-hub-utopic-amd64-ci/28
    SUCCESS: http://jenkins.qa.ubuntu.com/job/media-hub-utopic-armhf-ci/27
        deb: http://jenkins.qa.ubuntu.com/job/media-hub-utopic-armhf-ci/27/artifact/work/output/*zip*/output.zip
    SUCCESS: http://jenkins.qa.ubuntu.com/job/media-hub-utopic-i386-ci/26

Click here to trigger a rebuild:
http://s-jenkins.ubuntu-ci:8080/job/media-hub-ci/86/rebuild

review: Approve (continuous-integration)

[lp:~jdstrand/media-hub/1356883]

58. By Jamie Strandboge on 2014-09-04

few more apparmor updates:
- add video abstraction
- silence access to /run/udev/data/** like we do elsewhere
- allow read on /dev/video*
- allow read on /sys/devices/**/video4linux/**/uevent

[PS Jenkins bot (ps-jenkins)]

PASSED: Continuous integration, rev:58
http://jenkins.qa.ubuntu.com/job/media-hub-ci/113/
Executed test runs:
    SUCCESS: http://jenkins.qa.ubuntu.com/job/media-hub-utopic-amd64-ci/55
    SUCCESS: http://jenkins.qa.ubuntu.com/job/media-hub-utopic-armhf-ci/54
        deb: http://jenkins.qa.ubuntu.com/job/media-hub-utopic-armhf-ci/54/artifact/work/output/*zip*/output.zip
    SUCCESS: http://jenkins.qa.ubuntu.com/job/media-hub-utopic-i386-ci/53

Click here to trigger a rebuild:
http://s-jenkins.ubuntu-ci:8080/job/media-hub-ci/113/rebuild

review: Approve (continuous-integration)

[Jim Hodapp (jhodapp)]

Compiles fine with apparmor_parser and no regressions in functionality that I can find. Thanks

review: Approve

=== modified file 'debian/usr.bin.media-hub-server'
--- debian/usr.bin.media-hub-server	2014-08-18 19:53:50 +0000
+++ debian/usr.bin.media-hub-server	2014-09-04 19:23:51 +0000
@@ -7,6 +7,7 @@
   #include <abstractions/dbus-session>
   #include <abstractions/dbus-strict>
   #include <abstractions/user-tmp>
+  #include <abstractions/video>
   #include "/usr/share/apparmor/hardware/audio.d"
   #include "/usr/share/apparmor/hardware/graphics.d"
   #include "/usr/share/apparmor/hardware/video.d"
@@ -23,6 +24,9 @@
   owner @{PROC}/[0-9]*/task/[0-9]*/ r,
   owner @{PROC}/[0-9]*/cmdline r,
 
+  /etc/udev/udev.conf r,
+  deny /run/udev/data/** r,
+
   # specific to the mediatek soc
   @{PROC}/xlog/setfil r,
   @{PROC}/M4U_device r,
@@ -32,6 +36,10 @@
   /dev/devmap r,
   @{PROC}/mtk_mdp_cmdq r,
 
+  /dev/video*                           r,
+  /sys/devices/**/video4linux/video**   r,
+  /sys/devices/**/video4linux/**/uevent r,
+
   /sys/kernel/debug/tracing/trace_marker w,
   /dev/ashmem rw,