Merge lp:~jdstrand/ubuntu-download-manager/ubuntu-download-manager-lp1296415 into lp:ubuntu-download-manager

[Jamie Strandboge]

  * add lenient AppArmor profile to allow connecting to ofono (LP: #1296415)
    - add debian/usr.bin.ubuntu-download-manager
    - debian/control: Build-Depends on dh-apparmor
    - debian/rules: update override_dh_installdeb to use dh_apparmor
    - debian/ubuntu-download-manager.dirs: add etc/apparmor.d
    - debian/ubuntu-download-manager.install: install profile in to place

  * add lenient AppArmor profile to allow connecting to ofono (LP: #1296415)
    - add debian/usr.bin.ubuntu-download-manager
    - debian/control: Build-Depends on dh-apparmor
    - debian/rules: update override_dh_installdeb to use dh_apparmor
    - debian/ubuntu-download-manager.dirs: add etc/apparmor.d
    - debian/ubuntu-download-manager.install: install profile in to place

[PS Jenkins bot (ps-jenkins)]

PASSED: Continuous integration, rev:303
http://jenkins.qa.ubuntu.com/job/ubuntu-download-manager-ci/678/
Executed test runs:
    SUCCESS: http://jenkins.qa.ubuntu.com/job/ubuntu-download-manager-utopic-amd64-ci/37
    SUCCESS: http://jenkins.qa.ubuntu.com/job/ubuntu-download-manager-utopic-armhf-ci/37
        deb: http://jenkins.qa.ubuntu.com/job/ubuntu-download-manager-utopic-armhf-ci/37/artifact/work/output/*zip*/output.zip

Click here to trigger a rebuild:
http://s-jenkins.ubuntu-ci:8080/job/ubuntu-download-manager-ci/678/rebuild

review: Approve (continuous-integration)

[lp:~jdstrand/ubuntu-download-manager/ubuntu-download-manager-lp1296415]

304. By Jamie Strandboge on 2014-06-24

debian/usr.bin.ubuntu-download-manager: more closely mimic unconfined with
exec transitions

[PS Jenkins bot (ps-jenkins)]

PASSED: Continuous integration, rev:304
http://jenkins.qa.ubuntu.com/job/ubuntu-download-manager-ci/679/
Executed test runs:
    SUCCESS: http://jenkins.qa.ubuntu.com/job/ubuntu-download-manager-utopic-amd64-ci/38
    SUCCESS: http://jenkins.qa.ubuntu.com/job/ubuntu-download-manager-utopic-armhf-ci/38
        deb: http://jenkins.qa.ubuntu.com/job/ubuntu-download-manager-utopic-armhf-ci/38/artifact/work/output/*zip*/output.zip

Click here to trigger a rebuild:
http://s-jenkins.ubuntu-ci:8080/job/ubuntu-download-manager-ci/679/rebuild

review: Approve (continuous-integration)

[Manuel de la Peña (mandel)]

The projects has two diff binaries that need the same rights, can you please update the MP so that ubuntu-upload-manager security is correctly set?

PS: Sorry for the late review.

review: Needs Fixing

[Jamie Strandboge (jdstrand)]

Rejecting for now since we won't be implementing this (see bug description).

Unmerged revisions

304. By Jamie Strandboge on 2014-06-24

debian/usr.bin.ubuntu-download-manager: more closely mimic unconfined with
exec transitions

303. By Jamie Strandboge on 2014-06-24

 * add lenient AppArmor profile to allow connecting to ofono (LP: #1296415)
   - add debian/usr.bin.ubuntu-download-manager
   - debian/control: Build-Depends on dh-apparmor
   - debian/rules: update override_dh_installdeb to use dh_apparmor
   - debian/ubuntu-download-manager.dirs: add etc/apparmor.d
   - debian/ubuntu-download-manager.install: install profile in to place

=== modified file 'debian/control'
--- debian/control	2014-04-30 14:59:42 +0000
+++ debian/control	2014-06-24 22:25:16 +0000
@@ -16,7 +16,8 @@
                libgoogle-glog-dev,
                qtdeclarative5-dev,
                qtdeclarative5-dev-tools,
-               qtdeclarative5-test-plugin
+               qtdeclarative5-test-plugin,
+               dh-apparmor
 Maintainer: Manuel de la Peña <[e-mail]>
 Standards-Version: 3.9.5
 Homepage: https://launchpad.net/ubuntu-system-image

=== modified file 'debian/rules'
--- debian/rules	2014-04-09 11:31:21 +0000
+++ debian/rules	2014-06-24 22:25:16 +0000
@@ -26,6 +26,10 @@
 override_dh_auto_configure:
 	dh_auto_configure -- -DCMAKE_INSTALL_LIBEXECDIR=/usr/lib/$(DEB_HOST_MULTIARCH)
 
+override_dh_installdeb:
+	dh_apparmor --profile-name=usr.bin.ubuntu-download-manager -pubuntu-download-manager
+	dh_installdeb
+
 dh_auto_install:
 	rm -f debian/tmp/usr/lib/*.so
 	dh_install --fail-missing

=== added file 'debian/ubuntu-download-manager.dirs'
--- debian/ubuntu-download-manager.dirs	1970-01-01 00:00:00 +0000
+++ debian/ubuntu-download-manager.dirs	2014-06-24 22:25:16 +0000
@@ -0,0 +1,1 @@
+etc/apparmor.d

=== modified file 'debian/ubuntu-download-manager.install'
--- debian/ubuntu-download-manager.install	2014-04-21 14:14:33 +0000
+++ debian/ubuntu-download-manager.install	2014-06-24 22:25:16 +0000
@@ -2,3 +2,4 @@
 usr/share/dbus-1/services/ubuntu-download-manager.service
 usr/share/dbus-1/system-services/com.canonical.applications.Downloader.service
 etc/dbus-1/system.d/com.canonical.applications.Downloader.conf
+debian/usr.bin.ubuntu-download-manager etc/apparmor.d

=== added file 'debian/usr.bin.ubuntu-download-manager'
--- debian/usr.bin.ubuntu-download-manager	1970-01-01 00:00:00 +0000
+++ debian/usr.bin.ubuntu-download-manager	2014-06-24 22:25:16 +0000
@@ -0,0 +1,16 @@
+#include <tunables/global>
+
+# Permissive profile to have profile name to limit access to ofonod (LP: #1296415)
+/usr/bin/ubuntu-download-manager (attach_disconnected) {
+  capability,
+  mount,
+  remount,
+  umount,
+  network,
+  /   rwkl,
+  /** rwlkm,
+  /** pix,
+  dbus,
+  signal,
+  ptrace,
+}