Merge lp:~lool/unity8/unity8-setcap into lp:unity8

[Loïc Minier]

Add upstart job to copy unity8 to a new tmpfs, setcap it, and bind-mount it back; this is an ugly hack to set CAP_SYS_RESOURCE until we have a root-helper for it.

Add upstart job to copy unity8 to a new tmpfs, setcap it, and bind-mount it back; this is an ugly hack to set CAP_SYS_RESOURCE until we have a root-helper for it.

[Michał Sawicz (saviq)]

Ohkay... if we have to... :/

review: Approve

[PS Jenkins bot (ps-jenkins)]

FAILED: Continuous integration, rev:464
http://jenkins.qa.ubuntu.com/job/unity8-ci/1412/
Executed test runs:
    UNSTABLE: http://jenkins.qa.ubuntu.com/job/generic-mediumtests-saucy/5017
    UNSTABLE: http://jenkins.qa.ubuntu.com/job/generic-mediumtests-touch/2943
    SUCCESS: http://jenkins.qa.ubuntu.com/job/unity-phablet-qmluitests-saucy/2279
    SUCCESS: http://jenkins.qa.ubuntu.com/job/unity8-saucy-amd64-ci/435
    SUCCESS: http://jenkins.qa.ubuntu.com/job/unity8-saucy-armhf-ci/1412
        deb: http://jenkins.qa.ubuntu.com/job/unity8-saucy-armhf-ci/1412/artifact/work/output/*zip*/output.zip
    SUCCESS: http://jenkins.qa.ubuntu.com/job/unity8-saucy-i386-ci/1411
    UNSTABLE: http://jenkins.qa.ubuntu.com/job/autopilot-testrunner-otto-saucy/1186
    SUCCESS: http://jenkins.qa.ubuntu.com/job/generic-mediumtests-builder-saucy-amd64/892
        deb: http://jenkins.qa.ubuntu.com/job/generic-mediumtests-builder-saucy-amd64/892/artifact/work/output/*zip*/output.zip
    SUCCESS: http://jenkins.qa.ubuntu.com/job/generic-mediumtests-builder-saucy-armhf/2945
        deb: http://jenkins.qa.ubuntu.com/job/generic-mediumtests-builder-saucy-armhf/2945/artifact/work/output/*zip*/output.zip
    UNSTABLE: http://jenkins.qa.ubuntu.com/job/generic-mediumtests-runner-maguro/2452
    UNSTABLE: http://jenkins.qa.ubuntu.com/job/generic-mediumtests-runner-mako/2495

Click here to trigger a rebuild:
http://10.97.0.26:8080/job/unity8-ci/1412/rebuild

review: Needs Fixing (continuous-integration)

=== added file 'data/unity8-setcap.conf'
--- data/unity8-setcap.conf	1970-01-01 00:00:00 +0000
+++ data/unity8-setcap.conf	2013-10-15 14:16:12 +0000
@@ -0,0 +1,32 @@
+# unity8-setcap - ugly hacks to arrange for /usr/bin/unity8 to have CAP_SYS_RESOURCE
+
+# XXX replace me with some root-helper to gain CAP_SYS_RESOURCE XXX
+
+author "Loïc Minier <[e-mail]>"
+description "Ugly hacks to arrange for /usr/bin/unity8 to have CAP_SYS_RESOURCE"
+
+# start when first boot-hooks event is emitted and before lightdm (lightdm
+# starts ubuntu-touch-session which starts unity8); note that /run is
+# guaranteeds to be be there because lightdm starts on filesystem
+start on boot-hooks and starting lightdm
+
+# NOT a task as otherwise this would block restarting lightdm
+
+env RUNDIR=/run/unity8-setcap
+
+# work needs to be done in pre-start as this really is a job with nothing to
+# start
+pre-start script
+    if [ ! -e "$RUNDIR" ]; then
+        mkdir "$RUNDIR"
+        # /run is noexec, hence mounting another tmpfs exec
+        # NB: unity8 is 35K; 512K should be enough for everyone
+        mount -o rw,nosuid,nodev,exec,relatime,mode=755,size=512k -t tmpfs tmpfs "$RUNDIR"
+        cp -a /usr/bin/unity8 "$RUNDIR"
+        setcap CAP_SYS_RESOURCE=+ep "$RUNDIR/unity8"
+        # bind-mount this back as unity8 checks dirname(argv[0]'s) == /usr to
+        # decide whether it's installed or not
+        mount --bind "$RUNDIR/unity8" /usr/bin/unity8
+    fi
+end script
+

=== modified file 'debian/control'
--- debian/control	2013-10-14 23:17:21 +0000
+++ debian/control	2013-10-15 14:16:12 +0000
@@ -78,6 +78,8 @@
          unity8-fake-env | qtubuntu-shell,
          unity8-private (= ${binary:Version}),
          unity8-private | unity-launcher-impl,
+# for setcap:
+         libcap2-bin,
          ${misc:Depends},
          ${shlibs:Depends},
 Recommends: ${unity-default-masterscopes},

=== modified file 'debian/unity8.install'
--- debian/unity8.install	2013-10-14 08:31:39 +0000
+++ debian/unity8.install	2013-10-15 14:16:12 +0000
@@ -14,3 +14,4 @@
 usr/share/unity8/SideStage
 usr/share/unity8/graphics
 data/unity8.conf usr/share/upstart/sessions/
+data/unity8-setcap.conf etc/init/boot-hooks/