Merge lp:~sdeziel/apparmor-profiles/refresh-pulseaudio into lp:apparmor-profiles

[Simon Déziel]

[Seth Arnold (seth-arnold)]

On Thu, Jan 07, 2016 at 06:21:23PM -0000, Simon Déziel wrote:
> - /run/pulse/ rw,
> - /run/pulse/.pulse-cookie rwk,
> - /run/pulse/dbus-socket rwk,
> - /run/pulse/native rwk,
> - /run/pulse/pid rwk,
> + owner /run/pulse/ rw,
> + owner /run/pulse/.pulse-cookie rwk,
> + owner /run/pulse/dbus-socket rwk,
> + owner /run/pulse/native rwk,
> + owner /run/pulse/pid rwk,
> + owner /run/user/[0-9]*/pulse/ rw,
> + owner /run/user/[0-9]*/pulse/* rwk,
> /run/udev/data/+sound:card* r,
> + /run/udev/data/c116:[0-9]* r,
>

How does 'owner /run/pulse/' work? Are these paths bind-mounted from
per-user paths? Or are these paths when pulse is used as root in some
environments?

>
> owner /var/lib/lightdm/.Xauthority r,
> owner /var/lib/lightdm/.esd_auth rwk,
> - owner /var/lib/lightdm/.pulse-cookie rwk,
> - owner /var/lib/lightdm/.pulse/ rw,
> - owner /var/lib/lightdm/.pulse/* w,
> - owner /var/lib/lightdm/.pulse/* r,
> + owner /var/lib/lightdm/.config/pulse/cookie rwk,
> + owner /var/lib/lightdm/.config/pulse/ rw,
> + owner /var/lib/lightdm/.config/pulse/* rw,

Removing accesses like this may cause problems if the AppArmor profile is
replaced before any executing binaries that use the old pathnames. Are
these old path names unused for long enough that no executing binaries
currently use them?

Thanks

[Simon Déziel (sdeziel)]

On 2016-01-07 02:30 PM, Seth Arnold wrote:
> On Thu, Jan 07, 2016 at 06:21:23PM -0000, Simon Déziel wrote:
>> - /run/pulse/ rw,
>> - /run/pulse/.pulse-cookie rwk,
>> - /run/pulse/dbus-socket rwk,
>> - /run/pulse/native rwk,
>> - /run/pulse/pid rwk,
>> + owner /run/pulse/ rw,
>> + owner /run/pulse/.pulse-cookie rwk,
>> + owner /run/pulse/dbus-socket rwk,
>> + owner /run/pulse/native rwk,
>> + owner /run/pulse/pid rwk,
>> + owner /run/user/[0-9]*/pulse/ rw,
>> + owner /run/user/[0-9]*/pulse/* rwk,
>> /run/udev/data/+sound:card* r,
>> + /run/udev/data/c116:[0-9]* r,
>>
>
> How does 'owner /run/pulse/' work? Are these paths bind-mounted from
> per-user paths? Or are these paths when pulse is used as root in some
> environments?

It's in case pulse is used as root, I believe. I know this path doesn't
exist on my Xenial desktop.

>>
>> owner /var/lib/lightdm/.Xauthority r,
>> owner /var/lib/lightdm/.esd_auth rwk,
>> - owner /var/lib/lightdm/.pulse-cookie rwk,
>> - owner /var/lib/lightdm/.pulse/ rw,
>> - owner /var/lib/lightdm/.pulse/* w,
>> - owner /var/lib/lightdm/.pulse/* r,
>> + owner /var/lib/lightdm/.config/pulse/cookie rwk,
>> + owner /var/lib/lightdm/.config/pulse/ rw,
>> + owner /var/lib/lightdm/.config/pulse/* rw,
>
> Removing accesses like this may cause problems if the AppArmor profile is
> replaced before any executing binaries that use the old pathnames. Are
> these old path names unused for long enough that no executing binaries
> currently use them?

On Trusty, ~lightdm/.config/pulse is used so we should be good there.

Regards,
Simon

[Seth Arnold (seth-arnold)]

Thanks, LGTM

review: Approve

[Simon Déziel (sdeziel)]

Thanks Seth!

=== modified file 'ubuntu/16.04/usr.bin.pulseaudio'
--- ubuntu/16.04/usr.bin.pulseaudio	2015-10-27 01:49:53 +0000
+++ ubuntu/16.04/usr.bin.pulseaudio	2016-01-07 18:21:04 +0000
@@ -5,9 +5,20 @@
   #include <abstractions/base>
   #include <abstractions/audio>
   #include <abstractions/dbus-session>
+  #include <abstractions/dbus-strict>
   #include <abstractions/nameservice>
   #include <abstractions/X>
 
+  dbus send
+       bus=system
+       path=/org/freedesktop/RealtimeKit1
+       interface=org.freedesktop.RealtimeKit1
+       member={MakeThreadRealtime,MakeThreadHighPriority}
+       peer=(name=org.freedesktop.RealtimeKit1),
+
+  unix (connect, receive, send) type=stream peer=(addr="@/tmp/.ICE-unix/[0-9]*"),
+  ptrace (read,trace) peer=@{profile_name},
+
   /usr/bin/pulseaudio mixr,
 
   /dev/null rw,
@@ -19,22 +30,25 @@
   /etc/udev/udev.conf r,
   /etc/timidity/.pulse_cookie w,
 
-  @{HOME}/.esd_auth rwk,
-  @{HOME}/.pulse-cookie rwk,
-  @{HOME}/.config/pulse/cookie rwk,
-  @{HOME}/{.config/pulse,.pulse}/ rw,
-  @{HOME}/{.config/pulse,.pulse}/* rw,
+  owner @{HOME}/.esd_auth rwk,
+  owner @{HOME}/.pulse-cookie rwk,
+  owner @{HOME}/.config/pulse/cookie rwk,
+  owner @{HOME}/{.config/pulse,.pulse}/ rw,
+  owner @{HOME}/{.config/pulse,.pulse}/* rw,
 
-  /run/pulse/ rw,
-  /run/pulse/.pulse-cookie rwk,
-  /run/pulse/dbus-socket rwk,
-  /run/pulse/native rwk,
-  /run/pulse/pid rwk,
+  owner /run/pulse/ rw,
+  owner /run/pulse/.pulse-cookie rwk,
+  owner /run/pulse/dbus-socket rwk,
+  owner /run/pulse/native rwk,
+  owner /run/pulse/pid rwk,
+  owner /run/user/[0-9]*/pulse/  rw,
+  owner /run/user/[0-9]*/pulse/* rwk,
   /run/udev/data/+sound:card* r,
+  /run/udev/data/c116:[0-9]* r,
 
   # logind
-  /run/systemd/users/* r,
-  /run/user/*/dconf/user k,
+  /run/systemd/users/[0-9]* r,
+  /run/user/[0-9]*/dconf/user k,
 
   /sys/bus/ r,
   /sys/class/ r,
@@ -46,7 +60,7 @@
   /sys/devices/virtual/dmi/id/bios_vendor r,
   /sys/devices/virtual/dmi/id/board_vendor r,
   /sys/devices/virtual/dmi/id/sys_vendor r,
-  /sys/devices/**/sound/card[0-9]*/uevent r,
+  /sys/devices/virtual/sound/**/uevent r,
 
   /usr/share/alsa/** r,
   /usr/share/applications/ r,
@@ -61,10 +75,9 @@
 
   owner /var/lib/lightdm/.Xauthority r,
   owner /var/lib/lightdm/.esd_auth rwk,
-  owner /var/lib/lightdm/.pulse-cookie rwk,
-  owner /var/lib/lightdm/.pulse/ rw,
-  owner /var/lib/lightdm/.pulse/* w,
-  owner /var/lib/lightdm/.pulse/* r,
+  owner /var/lib/lightdm/.config/pulse/cookie rwk,
+  owner /var/lib/lightdm/.config/pulse/ rw,
+  owner /var/lib/lightdm/.config/pulse/* rw,
 
   # are these needed?
   /var/lib/pulse/ rw,
@@ -72,9 +85,9 @@
   /var/lib/pulse/*-default-source rw,
   /var/lib/pulse/*.tdb rw,
 
-  @{PROC}/[0-9]*/fd/ r,
-  @{PROC}/[0-9]*/maps r,
-  @{PROC}/[0-9]*/stat r,
+  owner @{PROC}/@{pid}/fd/ r,
+  owner @{PROC}/@{pid}/maps r,
+  owner @{PROC}/@{pid}/stat r,
 
   owner /tmp/pulse-*/pid rwk,
   owner /tmp/pulse-*/native rwk,
@@ -83,11 +96,10 @@
   owner /tmp/orcexec.* mrw,
   owner /{,var/}run/user/[0-9]*/orcexec.* mrw,
   # needed if /tmp is mounted noexec:
-  owner @{HOME}/orcexec.* mr,
+  owner @{HOME}/orcexec.* mrw,
 
-  # replace with @{pid}
-  owner /tmp/.esd-[0-9]*/ rw,
-  owner /tmp/.esd-[0-9]*/socket rw,
+  owner /tmp/.esd-@{pid}*/ rw,
+  owner /tmp/.esd-@{pid}*/socket rw,
 
   profile /usr/lib/pulseaudio/pulse/gconf-helper {
     #include <abstractions/base>