Merge ~paelzer/ubuntu/+source/chrony:bionic-sru-lp-1771028-man-page-apparmor-paths into ubuntu/+source/chrony:ubuntu/bionic-devel

[Christian Ehrhardt ]

[Christian Ehrhardt  (paelzer)]

Trivial backport opening up apparmor rules slightly.

Picked from what we just reviewed, tested and pushed to Cosmic.

PPA: https://launchpad.net/~ci-train-ppa-service/+archive/ubuntu/3269
Bug: https://bugs.launchpad.net/ubuntu/+source/chrony/+bug/1771028

[Christian Ehrhardt  (paelzer)]

Tested from PPA - fixing the bugs as expected.
No other issue found on the upgrade.

Also since old apparmor profile was on default there was no prompting for conffiles - this should be true for 99.999% of users as well.

[Robie Basak (racb)]

Verified in Cosmic via Debian (https://git.launchpad.net/ubuntu/+source/chrony/commit/debian/usr.sbin.chronyd?id=c670bb531fb4d3f741e3645221c1996dcd05ee4b and https://salsa.debian.org/debian/chrony/commit/294237ad25748246f79e83c177eec4809a8cf92e). The bug looks SRU ready, the changelog and proposed version is correct and the diff looks fine.

I think a conffile prompt is OK in this case.

review: Approve

diff --git a/debian/changelog b/debian/changelog
index 78c6ecc..cfa85ad 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,11 @@
+chrony (3.2-4ubuntu4.1) bionic; urgency=medium
+
+  * debian/usr.sbin.chronyd:
+    - Support all paths suggested in the man page.
+    (LP: #1771028, Closes: #898614)
+
+ -- Christian Ehrhardt <[e-mail]>  Wed, 23 May 2018 16:22:13 +0200
+
 chrony (3.2-4ubuntu4) bionic; urgency=medium
 
   * d/postrm: re-establish systemd-timesyncd on removal (LP: #1764357)
diff --git a/debian/usr.sbin.chronyd b/debian/usr.sbin.chronyd
index 92f77a5..4424e3c 100644
--- a/debian/usr.sbin.chronyd
+++ b/debian/usr.sbin.chronyd
@@ -32,6 +32,16 @@
   # changes measured by a sensor close to the oscillator.
   @{sys}/class/hwmon/hwmon[0-9]*/temp[0-9]*_input r,
 
+  # Support all paths suggested in the man page (LP: #1771028). Assume these
+  # are common use cases; others should be set as local include (see below).
+  # Configs using a 'chrony.' prefix like the tempcomp config file example
+  /etc/chrony.* r,
+  # Example gpsd socket is outside /{,var/}run/chrony/
+  /{,var/}run/chrony.tty{,*}.sock rw,
+  # To sign replies to MS-SNTP clients by the smbd daemon
+  /var/lib/samba/ntp_signd r,
+  /var/lib/samba/ntp_signd/{,*} rw,
+
   # rtc
   /etc/adjtime r,
   /dev/rtc{,[0-9]*} rw,