Merge lp:~rmcbride/ubuntu/lucid/ubuntuone-client/fix_528274 into lp:ubuntu/lucid/ubuntuone-client

[Rick McBride]

This adds an AppArmor profile for ubuntuone-syncdaemon, addressing bug #528274. It also adds postinst and postrm logic for same.

[lp:~rmcbride/ubuntu/lucid/ubuntuone-client/fix_528274]

30. By Rick McBride on 2010-03-08

restored line mistakenly deleted from ubuntuone-client.install

31. By Rick McBride on 2010-03-08

improved profile to protect things like keys and other things we shouldn't mess with

[Kees Cook (kees)]

This line:

owner "@{HOME}/**" rw,

doesn't need the double quotes any more since it doesn't include white space.

review: Needs Fixing

[Jamie Strandboge (jdstrand)]

The packaging for apparmor looks fine. I don't see where you actually install the apport hook in debian/rules though.

Unless you need access to ~/.mozilla, I suggest simply doing:

+ #include <abstractions/private-files-strict>

Instead of:
+ #include <abstractions/private-files>
+ audit deny @{HOME}/.ssh/** mrwkl,
+ audit deny @{HOME}/.gnome2_private/** mrwkl,
+
+ # comment this out if using gpg plugin/addons
+ audit deny @{HOME}/.gnupg/** mrwkl,

If you do need access to .mozilla for something, then what you have is fine, though I wonder why you need access to all of $HOME rather than just the ~/Ubuntu One directory.

[Rick McBride (rmcbride)]

Jamie,

we need all of $HOME because Ubuntu One will soon allow the user to define shareable folders anywhere in their home directory.

I'll add the simplification on abstractions/private-files as well.

Kees, thanks. I'll fix that.

[Rick McBride (rmcbride)]

fixed and pushed. Removed the unrelated apport hook stuff.

[lp:~rmcbride/ubuntu/lucid/ubuntuone-client/fix_528274]

32. By Rick McBride on 2010-03-09

several fixes based on review feedback. Simplified abstractions stuff and removed things regarding the apport-hook that wasn't required for this fix.

33. By Rick McBride on 2010-03-11

yea we need the xdg/ubuntuone directory

[Rick McBride (rmcbride)]

needed to add xdg/ubuntuone, as some global config and oauth stuff lives there.

[lp:~rmcbride/ubuntu/lucid/ubuntuone-client/fix_528274]

34. By Rick McBride on 2010-03-11

but we don't need write access to the global config

35. By Rick McBride on 2010-03-11

need to widen scope of .local/share/ubuntuone

36. By Rick McBride on 2010-03-11

need to widen scope of .local/share/ubuntuone

37. By Rick McBride on 2010-03-18

remerge from trunk and resolve conflict in debian/changelog

[Kees Cook (kees)]

This looks good to me. Thanks!

review: Approve

[lp:~rmcbride/ubuntu/lucid/ubuntuone-client/fix_528274]

38. By Rick McBride on 2010-03-29

first version of disabled profile for testing purposes

[Rick McBride (rmcbride)]

branch is in work again. I made some subtle mis-cue with the profile disabling (likely it can't be done that way in debian/rules).

Unmerged revisions

38. By Rick McBride on 2010-03-29

first version of disabled profile for testing purposes

37. By Rick McBride on 2010-03-18

remerge from trunk and resolve conflict in debian/changelog

36. By Rick McBride on 2010-03-11

need to widen scope of .local/share/ubuntuone

35. By Rick McBride on 2010-03-11

need to widen scope of .local/share/ubuntuone

34. By Rick McBride on 2010-03-11

but we don't need write access to the global config

33. By Rick McBride on 2010-03-11

yea we need the xdg/ubuntuone directory

32. By Rick McBride on 2010-03-09

several fixes based on review feedback. Simplified abstractions stuff and removed things regarding the apport-hook that wasn't required for this fix.

31. By Rick McBride on 2010-03-08

improved profile to protect things like keys and other things we shouldn't mess with

30. By Rick McBride on 2010-03-08

restored line mistakenly deleted from ubuntuone-client.install

29. By Rick McBride on 2010-03-08

fix rules to have a tab like a normal makefile entry

=== added file 'debian/apparmor-profile'
--- debian/apparmor-profile	1970-01-01 00:00:00 +0000
+++ debian/apparmor-profile	2010-03-29 17:10:56 +0000
@@ -0,0 +1,20 @@
+# Last Modified: Fri Feb 26 12:07:25 2010
+#include <tunables/global>
+
+/usr/lib/ubuntuone-client/ubuntuone-syncdaemon {
+  #include <abstractions/base>
+  #include <abstractions/nameservice>
+  #include <abstractions/python>
+  #include <abstractions/ssl_certs>
+  #include <abstractions/user-tmp>
+
+  /usr/bin/python2.6 ix,
+  owner @{HOME}/** rw,
+  owner @{HOME}/.local/share/ubuntuone/** rw,
+  owner @{HOME}/.cache/ubuntuone/log/* w,
+  owner @{HOME}/.cache/ubuntuone/partials/* rw,
+  /etc/xdg/ubuntuone/** r,
+
+  #include <abstractions/private-files-strict>
+}
+
 
=== modified file 'debian/changelog'
--- debian/changelog	2010-03-11 00:04:35 +0000
+++ debian/changelog	2010-03-29 17:10:56 +0000
@@ -1,3 +1,9 @@
+ubuntuone-client (1.1.4-0ubuntu2) lucid; urgency=low
+
+  * add apparmor profile for syncdaemon.
+
+ -- Rick McBride <[e-mail]>  Thu, 18 Mar 2010 17:25:06 -0400
+
 ubuntuone-client (1.1.4-0ubuntu1) lucid; urgency=low
 
   * New upstream release.
 
=== modified file 'debian/control'
--- debian/control	2010-03-10 23:50:45 +0000
+++ debian/control	2010-03-29 17:10:56 +0000
@@ -27,6 +27,7 @@
  python-ubuntuone-client (= ${source:Version}),
  python-configglue,
  python-apport
+Suggests: apparmor
 Provides: ${python:Provides}
 Replaces: ubuntuone-oauth-login, nautilus-ubuntuone, ubuntuone-storagefs
 Conflicts: ubuntuone-oauth-login, nautilus-ubuntuone, ubuntuone-storagefs
 
=== modified file 'debian/rules'
--- debian/rules	2009-12-07 17:35:00 +0000
+++ debian/rules	2010-03-29 17:10:56 +0000
@@ -9,6 +9,10 @@
 DEB_CONFIGURE_EXTRA_FLAGS = --enable-pycentral
 DEB_DH_MAKESHLIBS_ARGS = -Xusr/lib/nautilus
 
+binary-install/ubuntuone-client::
+	cp debian/apparmor-profile debian/ubuntuone-client/etc/apparmor.d/usr.lib.ubuntuone.client.ubuntuone-syncdaemon
+	ln -s debian/ubuntuone-client/etc/apparmor.d/usr.lib.ubuntuone-client.ubuntuone-syncdaemon debian/ubuntuone-client/etc/apparmor.d/disable/usr.lib.ubuntuone-client.ubuntuone-syncdaemon
+
 binary-post-install/ubuntuone-client::
 	find debian/tmp/usr/lib -name \*.la -exec rm {} \;
 	find debian/tmp/usr/lib -name \*.a -exec rm {} \;
 
=== added file 'debian/ubuntuone-client.dirs'
--- debian/ubuntuone-client.dirs	1970-01-01 00:00:00 +0000
+++ debian/ubuntuone-client.dirs	2010-03-29 17:10:56 +0000
@@ -0,0 +1,1 @@
+etc/apparmor.d/
 
=== added file 'debian/ubuntuone-client.postinst'
--- debian/ubuntuone-client.postinst	1970-01-01 00:00:00 +0000
+++ debian/ubuntuone-client.postinst	2010-03-29 17:10:56 +0000
@@ -0,0 +1,12 @@
+#!/bin/sh
+
+set -e
+
+#DEBHELPER#
+
+if [ "$1" = "configure" ]; then
+    APP_PROFILE="/etc/apparmor.d/usr.lib.ubuntuone-client.ubuntuone.syncdaemon"
+    if [ -f "$APP_PROFILE" ] && aa-status --enabled 2>/dev/null; then
+        apparmor_parser -r -T -W "$APP_PROFILE" || true
+    fi
+fi
 
=== added file 'debian/ubuntuone-client.postrm'
--- debian/ubuntuone-client.postrm	1970-01-01 00:00:00 +0000
+++ debian/ubuntuone-client.postrm	2010-03-29 17:10:56 +0000
@@ -0,0 +1,10 @@
+#!/bin/sh
+
+set -e
+
+#DEBHELPER#
+
+if [ "$1" = "purge" ]; then
+    APP_PROFILE="usr.lib.ubuntuone-client.ubuntuone-syncdaemon"
+    rm -f /etc/apparmor.d/force-complain/$APP_PROFILE >/dev/null 2>&1 || true
+    rm -f /etc/apparmor.d/disable/$APP_PROFILE >/dev/null 2>&1 || true