Merge lp:~ken-vandine/apparmor-easyprof-ubuntu/pasteboard into lp:apparmor-easyprof-ubuntu

[Ken VanDine]

Added access to content-hub's Pasteboard

Added access to content-hub's Pasteboard

[lp:~ken-vandine/apparmor-easyprof-ubuntu/pasteboard]

51. By Ken VanDine on 2016-08-02

Dropped object paths for paste, we check for app focus to control access

[Jamie Strandboge (jdstrand)]

The policy looks ok, assuming that the content service doesn't allow clicks from grabbing the clipboard from other processes. Can you comment on that?

Beyond that, this will trigger a recompile for all clicks that use the default template. Pat McGowan needs to approve that this is ok.

Has the pasteboard been backported to previous frameworks? If so, you should apply these to those as well.

Is the ubuntu-sdk template the correct place for this? Should it be part of content-hub?

If this is only for the template, is this useful to more than just ubuntu-sdk apps? What about scopes? webapps? If so, then this should be applied to those templates as well.

Is this targeted for the stable overlays? If so, please also target at:
https://code.launchpad.net/~ubuntu-security/apparmor-easyprof-ubuntu/1.3-stable-phone-overlay
https://code.launchpad.net/~ubuntu-security/apparmor-easyprof-ubuntu/16.04-stable-phone-overlay

Thanks!

review: Needs Information

[Ken VanDine (ken-vandine)]

> The policy looks ok, assuming that the content service doesn't allow clicks
> from grabbing the clipboard from other processes. Can you comment on that?

This is the backend used by qtubuntu and libertine to share clipboard contents. We allow the process that has focus to access the top item on the clipboard. We use Unity8's isPidFocused API to control access.

> Beyond that, this will trigger a recompile for all clicks that use the default
> template. Pat McGowan needs to approve that this is ok.
>
> Has the pasteboard been backported to previous frameworks? If so, you should
> apply these to those as well.

Apps won't directly talk to the pasteboard, that is handled by qtubuntu. So app developers won't see a difference.

> Is the ubuntu-sdk template the correct place for this? Should it be part of
> content-hub?

We need all apps to have access, so we don't want apps to need to add content_exchange policy to have basic copy/paste support.

> If this is only for the template, is this useful to more than just ubuntu-sdk
> apps? What about scopes? webapps? If so, then this should be applied to those
> templates as well.

Good point, I thought ubuntu-sdk was the base of all things. I guess I was wrong, I'll add it to other templates as well.

> Is this targeted for the stable overlays? If so, please also target at:
> https://code.launchpad.net/~ubuntu-security/apparmor-easyprof-ubuntu/1.3
> -stable-phone-overlay
> https://code.launchpad.net/~ubuntu-security/apparmor-easyprof-ubuntu/16.04
> -stable-phone-overlay

Yes, does that mean we can't land this with our standard landing process? I'll propose branches to those as well.
>
> Thanks!

[lp:~ken-vandine/apparmor-easyprof-ubuntu/pasteboard]

52. By Ken VanDine on 2016-08-02

Allow pasteboard access to ubuntu-webapp as well

[Ken VanDine (ken-vandine)]

Merge proposals for the other requested branches:

https://code.launchpad.net/~ken-vandine/apparmor-easyprof-ubuntu/1.3-stable-phone-overlay_pasteboard/+merge/301793

https://code.launchpad.net/~ken-vandine/apparmor-easyprof-ubuntu/1.3-stable-phone-overlay_pasteboard/+merge/301793

[Pat McGowan (pat-mcgowan)]

The policy recompile is fine
Need to check if any other such changes are queued, good to add them now

review: Approve

[Jamie Strandboge (jdstrand)]

"This is the backend used by qtubuntu and libertine to share clipboard contents. We allow the process that has focus to access the top item on the clipboard. We use Unity8's isPidFocused API to control access."

PIDs are racy. Has a member of the security team taken a look at this? If not, I suggested asking Tyler and Emily to look at it/assign someone.

[Jamie Strandboge (jdstrand)]

> Apps won't directly talk to the pasteboard, that is handled by qtubuntu. So app developers won't see a difference.

Does that mean it is available to earlier frameworks for free? If so, please adjust the templates for 1.0-1.2 as well.

> > Is the ubuntu-sdk template the correct place for this? Should it be part of
> > content-hub?
> >
> We need all apps to have access, so we don't want apps to need to add
> content_exchange policy to have basic copy/paste support.

Ok

> Yes, does that mean we can't land this with our standard landing process?
> I'll propose branches to those as well.

You can't build apparmor-easyprof-ubuntu from a branch, but once the MPs are approved and committed, you can create source packages that you can upload to your silos (the citrain has processes for this).

[lp:~ken-vandine/apparmor-easyprof-ubuntu/pasteboard]

53. By Ken VanDine on 2016-08-03

Added pasteboard access for 1.0 and 1.1

54. By Ken VanDine on 2016-08-03

Dropped duplicated pasteboard in ubuntu-webapp

[Ken VanDine (ken-vandine)]

> "This is the backend used by qtubuntu and libertine to share clipboard
> contents. We allow the process that has focus to access the top item on the
> clipboard. We use Unity8's isPidFocused API to control access."
>
> PIDs are racy. Has a member of the security team taken a look at this? If not,
> I suggested asking Tyler and Emily to look at it/assign someone.

It's the same API used by the keyboard now, I'll check to see if that was reviewed.

[Tyler Hicks (tyhicks)]

> > "This is the backend used by qtubuntu and libertine to share clipboard
> > contents. We allow the process that has focus to access the top item on the
> > clipboard. We use Unity8's isPidFocused API to control access."
> >
> > PIDs are racy. Has a member of the security team taken a look at this? If
> not,
> > I suggested asking Tyler and Emily to look at it/assign someone.
>
> It's the same API used by the keyboard now, I'll check to see if that was
> reviewed.

I reviewed maliit's use of isPidFocused() here:

  https://code.launchpad.net/~michael-sheldon/maliit/obey-unity8-focus/+merge/298312

[Tyler Hicks (tyhicks)]

Ubuntu Security needs to review the clipboard MP (https://code.launchpad.net/~ken-vandine/content-hub/pasteboard/+merge/296352). We've been involved in the design stages but were not aware that an implementation existed and was ready to be merged.

[lp:~ken-vandine/apparmor-easyprof-ubuntu/pasteboard]

55. By Ken VanDine on 2016-08-25

Specify path for access to pasteboard

=== modified file 'data/templates/ubuntu/1.0/ubuntu-sdk'
--- data/templates/ubuntu/1.0/ubuntu-sdk	2016-08-25 17:22:06 +0000
+++ data/templates/ubuntu/1.0/ubuntu-sdk	2016-08-25 17:49:25 +0000
@@ -235,6 +235,38 @@
   deny dbus (bind)
        name="org.freedesktop.Application",
 
+  # Allow access to the PasteBoard
+  dbus (receive, send)
+       bus=session
+       interface="com.ubuntu.content.dbus.Service"
+       path="/"
+       member="CreatePaste"
+       peer=(label=unconfined),
+  dbus (receive, send)
+       bus=session
+       interface="com.ubuntu.content.dbus.Service"
+       path="/"
+       member="GetPasteData"
+       peer=(label=unconfined),
+  dbus (receive, send)
+       bus=session
+       interface="com.ubuntu.content.dbus.Service"
+       path="/"
+       member="GetLatestPasteData"
+       peer=(label=unconfined),
+  dbus (receive, send)
+       bus=session
+       interface="com.ubuntu.content.dbus.Service"
+       path="/"
+       member="PasteFormats"
+       peer=(label=unconfined),
+  dbus (receive)
+       bus=session
+       interface="com.ubuntu.content.dbus.Service"
+       path="/"
+       member="PasteFormatsChanged"
+       peer=(label=unconfined),
+
   #
   # end DBus rules common for all apps
   #

=== modified file 'data/templates/ubuntu/1.0/ubuntu-webapp'
--- data/templates/ubuntu/1.0/ubuntu-webapp	2016-08-25 17:22:06 +0000
+++ data/templates/ubuntu/1.0/ubuntu-webapp	2016-08-25 17:49:25 +0000
@@ -208,6 +208,38 @@
   deny dbus (bind)
             name="org.freedesktop.Application",
 
+  # Allow access to the PasteBoard
+  dbus (receive, send)
+       bus=session
+       interface="com.ubuntu.content.dbus.Service"
+       path="/"
+       member="CreatePaste"
+       peer=(label=unconfined),
+  dbus (receive, send)
+       bus=session
+       interface="com.ubuntu.content.dbus.Service"
+       path="/"
+       member="GetPasteData"
+       peer=(label=unconfined),
+  dbus (receive, send)
+       bus=session
+       interface="com.ubuntu.content.dbus.Service"
+       path="/"
+       member="GetLatestPasteData"
+       peer=(label=unconfined),
+  dbus (receive, send)
+       bus=session
+       interface="com.ubuntu.content.dbus.Service"
+       path="/"
+       member="PasteFormats"
+       peer=(label=unconfined),
+  dbus (receive)
+       bus=session
+       interface="com.ubuntu.content.dbus.Service"
+       path="/"
+       member="PasteFormatsChanged"
+       peer=(label=unconfined),
+
   #
   # end DBus rules common for all webapps
   #

=== modified file 'data/templates/ubuntu/1.1/ubuntu-sdk'
--- data/templates/ubuntu/1.1/ubuntu-sdk	2016-08-25 17:22:06 +0000
+++ data/templates/ubuntu/1.1/ubuntu-sdk	2016-08-25 17:49:25 +0000
@@ -230,6 +230,38 @@
   deny dbus (bind)
        name="org.freedesktop.Application",
 
+  # Allow access to the PasteBoard
+  dbus (receive, send)
+       bus=session
+       interface="com.ubuntu.content.dbus.Service"
+       path="/"
+       member="CreatePaste"
+       peer=(label=unconfined),
+  dbus (receive, send)
+       bus=session
+       interface="com.ubuntu.content.dbus.Service"
+       path="/"
+       member="GetPasteData"
+       peer=(label=unconfined),
+  dbus (receive, send)
+       bus=session
+       interface="com.ubuntu.content.dbus.Service"
+       path="/"
+       member="GetLatestPasteData"
+       peer=(label=unconfined),
+  dbus (receive, send)
+       bus=session
+       interface="com.ubuntu.content.dbus.Service"
+       path="/"
+       member="PasteFormats"
+       peer=(label=unconfined),
+  dbus (receive)
+       bus=session
+       interface="com.ubuntu.content.dbus.Service"
+       path="/"
+       member="PasteFormatsChanged"
+       peer=(label=unconfined),
+
   #
   # end DBus rules common for all apps
   #

=== modified file 'data/templates/ubuntu/1.1/ubuntu-webapp'
--- data/templates/ubuntu/1.1/ubuntu-webapp	2016-08-25 17:22:06 +0000
+++ data/templates/ubuntu/1.1/ubuntu-webapp	2016-08-25 17:49:25 +0000
@@ -211,6 +211,38 @@
   deny dbus (bind)
             name="org.freedesktop.Application",
 
+  # Allow access to the PasteBoard
+  dbus (receive, send)
+       bus=session
+       interface="com.ubuntu.content.dbus.Service"
+       path="/"
+       member="CreatePaste"
+       peer=(label=unconfined),
+  dbus (receive, send)
+       bus=session
+       interface="com.ubuntu.content.dbus.Service"
+       path="/"
+       member="GetPasteData"
+       peer=(label=unconfined),
+  dbus (receive, send)
+       bus=session
+       interface="com.ubuntu.content.dbus.Service"
+       path="/"
+       member="GetLatestPasteData"
+       peer=(label=unconfined),
+  dbus (receive, send)
+       bus=session
+       interface="com.ubuntu.content.dbus.Service"
+       path="/"
+       member="PasteFormats"
+       peer=(label=unconfined),
+  dbus (receive)
+       bus=session
+       interface="com.ubuntu.content.dbus.Service"
+       path="/"
+       member="PasteFormatsChanged"
+       peer=(label=unconfined),
+
   #
   # end DBus rules common for all webapps
   #

=== modified file 'data/templates/ubuntu/1.3/ubuntu-sdk'
--- data/templates/ubuntu/1.3/ubuntu-sdk	2016-08-25 17:22:06 +0000
+++ data/templates/ubuntu/1.3/ubuntu-sdk	2016-08-25 17:49:25 +0000
@@ -230,6 +230,38 @@
   deny dbus (bind)
        name="org.freedesktop.Application",
 
+  # Allow access to the PasteBoard
+  dbus (receive, send)
+       bus=session
+       interface="com.ubuntu.content.dbus.Service"
+       path="/"
+       member="CreatePaste"
+       peer=(label=unconfined),
+  dbus (receive, send)
+       bus=session
+       interface="com.ubuntu.content.dbus.Service"
+       path="/"
+       member="GetPasteData"
+       peer=(label=unconfined),
+  dbus (receive, send)
+       bus=session
+       interface="com.ubuntu.content.dbus.Service"
+       path="/"
+       member="GetLatestPasteData"
+       peer=(label=unconfined),
+  dbus (receive, send)
+       bus=session
+       interface="com.ubuntu.content.dbus.Service"
+       path="/"
+       member="PasteFormats"
+       peer=(label=unconfined),
+  dbus (receive)
+       bus=session
+       interface="com.ubuntu.content.dbus.Service"
+       path="/"
+       member="PasteFormatsChanged"
+       peer=(label=unconfined),
+
   #
   # end DBus rules common for all apps
   #