Merge lp:~mterry/lightdm/guest-permissions into lp:lightdm

[Michael Terry]

Allow guest sessions to talk to Mir (allowing unity8)

I also threw ibus in there because I noticed it was denied in the systemd journal.

I noticed that we also don't show any installed snaps. This is because access to /run/snapd.socket is restricted. But after talking to Seth Arnold, sounds like we don't want to allow that just yet (snapd can't do the apparmor profile stacking that would be required).

[Robert Ancell (robert-ancell)]

review: Approve

=== modified file 'data/apparmor/abstractions/lightdm'
--- data/apparmor/abstractions/lightdm	2016-09-28 03:42:20 +0000
+++ data/apparmor/abstractions/lightdm	2017-03-13 18:36:25 +0000
@@ -77,6 +77,7 @@
   /{,var/}run/ r,
   # necessary for writing to sockets, etc.
   /{,var/}run/** rmkix,
+  /{,var/}run/mir_socket rw,
   /{,var/}run/screen/** wl,
   /{,var/}run/shm/** wl,
   /{,var/}run/uuidd/request w,

=== modified file 'data/apparmor/lightdm-guest-session.in'
--- data/apparmor/lightdm-guest-session.in	2016-06-04 08:14:23 +0000
+++ data/apparmor/lightdm-guest-session.in	2017-03-13 18:36:25 +0000
@@ -19,6 +19,9 @@
   /usr/bin/sogou-sys-notify ix,
   /tmp/sogou-qimpanel:* rwl,
 
+  # Allow ibus
+  unix (bind, listen) type=stream addr="@tmp/ibus/*",
+
   # mozc_server needs special treatment due to C/S design
   unix (bind, listen) type=stream addr="@tmp/.mozc.*",
 }