Merge lp:~townsend/libertine/fix-proot-seccomp into lp:libertine

[Christopher Townsend]

Need to disable seccomp for running any proot command in a chroot container.

[Libertine CI Bot (libertine-ci-bot)]

PASSED: Continuous integration, rev:340
https://jenkins.canonical.com/libertine/job/lp-libertine-ci/241/
Executed test runs:
    SUCCESS: https://jenkins.canonical.com/libertine/job/build/504
    SUCCESS: https://jenkins.canonical.com/libertine/job/test-0-autopkgtest/label=amd64,release=vivid+overlay,testname=default/397
    SUCCESS: https://jenkins.canonical.com/libertine/job/test-0-autopkgtest/label=amd64,release=xenial+overlay,testname=default/397
    SUCCESS: https://jenkins.canonical.com/libertine/job/test-0-autopkgtest/label=amd64,release=zesty,testname=default/397
    SUCCESS: https://jenkins.canonical.com/libertine/job/test-0-autopkgtest/label=i386,release=vivid+overlay,testname=default/397
    SUCCESS: https://jenkins.canonical.com/libertine/job/test-0-autopkgtest/label=i386,release=xenial+overlay,testname=default/397
    SUCCESS: https://jenkins.canonical.com/libertine/job/test-0-autopkgtest/label=i386,release=zesty,testname=default/397
    SUCCESS: https://jenkins.canonical.com/libertine/job/build-0-fetch/514
    SUCCESS: https://jenkins.canonical.com/libertine/job/build-2-binpkg/arch=amd64,release=vivid+overlay/498
        deb: https://jenkins.canonical.com/libertine/job/build-2-binpkg/arch=amd64,release=vivid+overlay/498/artifact/output/*zip*/output.zip
    SUCCESS: https://jenkins.canonical.com/libertine/job/build-2-binpkg/arch=amd64,release=xenial+overlay/498
        deb: https://jenkins.canonical.com/libertine/job/build-2-binpkg/arch=amd64,release=xenial+overlay/498/artifact/output/*zip*/output.zip
    SUCCESS: https://jenkins.canonical.com/libertine/job/build-2-binpkg/arch=amd64,release=zesty/498
        deb: https://jenkins.canonical.com/libertine/job/build-2-binpkg/arch=amd64,release=zesty/498/artifact/output/*zip*/output.zip
    SUCCESS: https://jenkins.canonical.com/libertine/job/build-2-binpkg/arch=i386,release=vivid+overlay/498
        deb: https://jenkins.canonical.com/libertine/job/build-2-binpkg/arch=i386,release=vivid+overlay/498/artifact/output/*zip*/output.zip
    SUCCESS: https://jenkins.canonical.com/libertine/job/build-2-binpkg/arch=i386,release=xenial+overlay/498
        deb: https://jenkins.canonical.com/libertine/job/build-2-binpkg/arch=i386,release=xenial+overlay/498/artifact/output/*zip*/output.zip
    SUCCESS: https://jenkins.canonical.com/libertine/job/build-2-binpkg/arch=i386,release=zesty/498
        deb: https://jenkins.canonical.com/libertine/job/build-2-binpkg/arch=i386,release=zesty/498/artifact/output/*zip*/output.zip

Click here to trigger a rebuild:
https://jenkins.canonical.com/libertine/job/lp-libertine-ci/241/rebuild

review: Approve (continuous-integration)

[Larry Price (larryprice)]

snap city, here we come

review: Approve

=== modified file 'python/libertine/ChrootContainer.py'
--- python/libertine/ChrootContainer.py	2016-11-29 15:36:17 +0000
+++ python/libertine/ChrootContainer.py	2016-11-30 19:20:54 +0000
@@ -51,6 +51,9 @@
         super().__init__(container_id)
         self.container_type = "chroot"
         self._window_manager = None
+        # FIXME: Disabling seccomp is a temporary measure until we fully understand why we need
+        #        it or figure out when we need it.
+        environ['PROOT_NO_SECCOMP'] = '1'
         os.environ['FAKECHROOT_CMD_SUBST'] = '$FAKECHROOT_CMD_SUBST:/usr/bin/chfn=/bin/true'
         os.environ['DEBIAN_FRONTEND'] = 'noninteractive'
 
@@ -218,10 +221,6 @@
         return proot_cmd
 
     def start_application(self, app_exec_line, environ):
-        # FIXME: Disabling seccomp is a temporary measure until we fully understand why we need
-        #        it or figure out when we need it.
-        environ['PROOT_NO_SECCOMP'] = '1'
-
         # Workaround issue where a custom dconf profile is on the machine
         if 'DCONF_PROFILE' in environ:
             del environ['DCONF_PROFILE']