Merge lp:~jpds/apparmor/pidgin-profile into lp:~ubuntu-core-dev/apparmor/profiles-devel

[Jonathan Davies]

[lp:~jpds/apparmor/pidgin-profile]

8. By Jonathan Davies on 2009-03-30

Removed denies for /etc/kernel and passwd.

[Jamie Strandboge (jdstrand)]

Sorry I didn't see this until now. It is approved and merged.

review: Approve

=== added file 'usr.bin.pidgin'
--- usr.bin.pidgin	1970-01-01 00:00:00 +0000
+++ usr.bin.pidgin	2009-03-30 15:41:55 +0000
@@ -0,0 +1,85 @@
+# 
+#    AppArmor Pidgin profile for Ubuntu 9.04 Jaunty
+#    
+#    This program is free software; you can redistribute it and/or
+#    modify it under the terms of version 2 of the GNU General Public
+#    License published by the Free Software Foundation.
+#
+
+
+#include <tunables/global>
+/usr/bin/pidgin {
+	#include <abstractions/audio>
+	#include <abstractions/aspell>
+	#include <abstractions/base>
+	#include <abstractions/bash>
+	#include <abstractions/consoles>
+	#include <abstractions/dbus>
+	#include <abstractions/fonts>
+	#include <abstractions/freedesktop.org>
+	#include <abstractions/gnome>
+	#include <abstractions/nameservice>
+	#include <abstractions/launchpad-integration>
+	#include <abstractions/user-download>
+	#include <abstractions/user-tmp>
+	#include <abstractions/X>
+
+	capability sys_ptrace,
+
+	deny /etc/kernel rm,
+	deny /etc/passwd rm,
+
+	deny @{HOME}/.bash* rw,
+	deny @{HOME}/.cshrc rw,
+	deny @{HOME}/.profile rw,
+	deny @{HOME}/.ssh/* rw,
+	deny @{HOME}/.zshrc rw,
+
+	owner @{HOME}/.config/enchant/ rw,
+	owner @{HOME}/.config/enchant/* rwk,
+	owner @{HOME}/.local/share/icons/ r,
+	owner @{HOME}/.local/share/mime/* r,
+	owner @{HOME}/.gnome2/nautilus-sendto/** rw,
+	owner @{HOME}/.gstreamer*/ rw,
+	owner @{HOME}/.gstreamer*/** rw,
+	owner @{HOME}/.pulse/ rw,
+	owner @{HOME}/.pulse/** rw,
+	owner @{HOME}/.pulse-cookie rwk,
+	owner @{HOME}/.purple/ rw,
+	owner @{HOME}/.purple/** rwk,
+
+	/bin/dash rix,
+
+	/dev/shm/ r,
+	/dev/shm/* rw,
+
+	/etc/ r,
+	/etc/pulse/client.conf r,
+	/etc/ssl/certs/ r,
+	/etc/ssl/certs/ssl-cert-snakeoil.pem r,
+
+	owner /tmp/orbit-*/* w,
+	owner /tmp/pulse-*/* w,
+
+	/usr/bin/gconftool-2 rix,
+	/usr/bin/gnome-default-applications-properties ix,
+	/usr/bin/gnome-network-preferences ix,
+	/usr/bin/gnome-open rmix,
+	/usr/bin/pidgin r,
+	/usr/bin/xdg-open rmix,
+
+	/usr/lib/ r,
+	/usr/lib/firefox-*/firefox.sh Px,
+	/usr/lib/libvisual-*/**.so rm,
+	/usr/lib/pidgin/*.so rm,
+	/usr/lib/purple*/*.so rm,
+
+	/usr/share/ca-certificates/*/** r,
+	/usr/share/enchant/enchant.ordering r,
+	/usr/share/locale-langpack/** rm,
+	/usr/share/purple/ca-certs/ r,
+	/usr/share/purple/ca-certs/** r,
+	/usr/share/myspell/dicts/ r,
+	/usr/share/myspell/dicts/** r,
+	/usr/share/tcltk/** r,
+}

=== renamed file 'usr.lib.firefox-3.0.7.firefox' => 'usr.lib.firefox-3.0.8.firefox'
--- usr.lib.firefox-3.0.7.firefox	2009-03-25 18:27:20 +0000
+++ usr.lib.firefox-3.0.8.firefox	2009-03-30 15:40:31 +0000
@@ -4,7 +4,7 @@
 
 #include <tunables/global>
 
-/usr/lib/firefox-3.0.7/firefox {
+/usr/lib/firefox-3.0.8/firefox {
   #include <abstractions/audio>
   #include <abstractions/base>
   #include <abstractions/cups-client>