Merge lp:~ted/apparmor-easyprof-ubuntu/vivid-ual-mir-helper into lp:~ubuntu-security/apparmor-easyprof-ubuntu/1.3-stable-phone-overlay

[Ted Gould]

Backport UAL Mir socket helper stanzas

=== modified file 'data/templates/ubuntu/1.0/ubuntu-sdk'
--- data/templates/ubuntu/1.0/ubuntu-sdk	2016-06-21 11:00:20 +0000
+++ data/templates/ubuntu/1.0/ubuntu-sdk	2016-08-22 17:04:21 +0000
@@ -188,6 +188,24 @@
        member="Open"
        peer=(label=unconfined),
 
+  # Untrusted Helpers are 3rd party apps that run in a different confinement
+  # context and are in a separate Mir session from the calling app (eg, an
+  # app that uses a content provider from another app). These helpers use
+  # Trusted Prompt Sessions to overlay their window over the calling app and
+  # need to get the Mir socket that was setup by the associated trusted helper
+  # (eg, content-hub). Typical consumers are content-hub providers,
+  # pay-service, url-dispatcher and possibly online-accounts.
+  # LP: #1462492 - this rule is suboptimal and should not be needed once we
+  # move to socket activation or FD passing
+  dbus (receive, send)
+       path=/com/canonical/UbuntuAppLaunch/@{APP_ID_DBUS}/*
+       interface="com.canonical.UbuntuAppLaunch.SocketDemangler"
+       member="GetMirSocket"
+       bus=session
+       peer=(label=unconfined),
+  # Allow access to the socket-demangler (needed for the above)
+  /usr/lib/@{multiarch}/ubuntu-app-launch/socket-demangler rmix,
+
   # TODO: finetune this
   dbus (send)
        bus=session

=== modified file 'data/templates/ubuntu/1.1/ubuntu-sdk'
--- data/templates/ubuntu/1.1/ubuntu-sdk	2016-06-21 11:00:20 +0000
+++ data/templates/ubuntu/1.1/ubuntu-sdk	2016-08-22 17:04:21 +0000
@@ -183,6 +183,24 @@
        path=/com/canonical/unity/launcher/@{APP_ID_DBUS}
        peer=(label=unconfined),
 
+  # Untrusted Helpers are 3rd party apps that run in a different confinement
+  # context and are in a separate Mir session from the calling app (eg, an
+  # app that uses a content provider from another app). These helpers use
+  # Trusted Prompt Sessions to overlay their window over the calling app and
+  # need to get the Mir socket that was setup by the associated trusted helper
+  # (eg, content-hub). Typical consumers are content-hub providers,
+  # pay-service, url-dispatcher and possibly online-accounts.
+  # LP: #1462492 - this rule is suboptimal and should not be needed once we
+  # move to socket activation or FD passing
+  dbus (receive, send)
+       path=/com/canonical/UbuntuAppLaunch/@{APP_ID_DBUS}/*
+       interface="com.canonical.UbuntuAppLaunch.SocketDemangler"
+       member="GetMirSocket"
+       bus=session
+       peer=(label=unconfined),
+  # Allow access to the socket-demangler (needed for the above)
+  /usr/lib/@{multiarch}/ubuntu-app-launch/socket-demangler rmix,
+
   # TODO: finetune this
   dbus (send)
        bus=session

=== modified file 'data/templates/ubuntu/1.3/ubuntu-sdk'
--- data/templates/ubuntu/1.3/ubuntu-sdk	2016-06-21 11:00:20 +0000
+++ data/templates/ubuntu/1.3/ubuntu-sdk	2016-08-22 17:04:21 +0000
@@ -183,6 +183,24 @@
        path=/com/canonical/unity/launcher/@{APP_ID_DBUS}
        peer=(label=unconfined),
 
+  # Untrusted Helpers are 3rd party apps that run in a different confinement
+  # context and are in a separate Mir session from the calling app (eg, an
+  # app that uses a content provider from another app). These helpers use
+  # Trusted Prompt Sessions to overlay their window over the calling app and
+  # need to get the Mir socket that was setup by the associated trusted helper
+  # (eg, content-hub). Typical consumers are content-hub providers,
+  # pay-service, url-dispatcher and possibly online-accounts.
+  # LP: #1462492 - this rule is suboptimal and should not be needed once we
+  # move to socket activation or FD passing
+  dbus (receive, send)
+       path=/com/canonical/UbuntuAppLaunch/@{APP_ID_DBUS}/*
+       interface="com.canonical.UbuntuAppLaunch.SocketDemangler"
+       member="GetMirSocket"
+       bus=session
+       peer=(label=unconfined),
+  # Allow access to the socket-demangler (needed for the above)
+  /usr/lib/@{multiarch}/ubuntu-app-launch/socket-demangler rmix,
+
   # TODO: finetune this
   dbus (send)
        bus=session