Merge lp:~tyhicks/apparmor-easyprof-ubuntu/lp1260103 into lp:apparmor-easyprof-ubuntu

[Tyler Hicks]

[Tyler Hicks (tyhicks)]

I haven't had a chance to test this yet but it the changes are consistent with the paths constructed by https://git.launchpad.net/oxide/commit/?id=9bbf87e80b49e6abcc9419f142655a4ce2fc0638. I'll be sure to test before actually merging into lp:apparmor-easyprof-ubuntu.

[Olivier Tilloy (osomon)]

Although I haven’t actually tested, that looks mostly good to me, and is consistent with the changeset in oxide.

Note that this change was introduced in the 1.17 branch of oxide, so you don’t want to make the change effective in apparmor-easyprof-ubuntu until oxide 1.17 is released (or the old rule should be kept temporarily until 1.17 is released).

Note that /dev/shm/@{APP_PKGNAME}.oxide is a directory under which oxide will write files. I’m no apparmor expert, but shouldn’t the rule end with a '/' to reflect that?

[Tyler Hicks (tyhicks)]

You're correct on both points. I shouldn't remove the old rules yet and I need to grant access to the directory contents. I'll adjust this merge request later today.

review: Needs Fixing

[Tyler Hicks (tyhicks)]

review: Abstain

[Tyler Hicks (tyhicks)]

@osomon can you have another look? Thanks!

[Olivier Tilloy (osomon)]

That looks good to me.

I’ve tried to test the change by rebuilding the package and installing oxide 1.17 from https://launchpad.net/~oxide-builds/+archive/ubuntu/oxide-next-for-stable-phone-overlay/ on a phone, only to realize that APP_PKGNAME is not an environment variable that is being set anywhere.
According to https://developer.ubuntu.com/en/phone/platform/guides/app-confinement/, its value can be inferred like so:

  APP_PKGNAME = APP_ID.split('_')[0]

review: Approve

[lp:~tyhicks/apparmor-easyprof-ubuntu/lp1260103]

50. By Tyler Hicks on 2016-08-25

ubuntu/webview: update to allow access to the new app-specific shared
memory files that will be used by Oxide 1.17.5, 1.18, and newer
(LP: #1260103)

[Tyler Hicks (tyhicks)]

A small update to mention the exact Oxide version numbers (1.17.5 and 1.18) that should contain the shm changes

=== modified file 'data/policygroups/ubuntu/1.1/webview'
--- data/policygroups/ubuntu/1.1/webview	2016-08-23 08:26:53 +0000
+++ data/policygroups/ubuntu/1.1/webview	2016-08-25 17:04:28 +0000
@@ -18,8 +18,8 @@
   # chrome_sandbox. Ideally, chrome-sandbox and oxide-renderer would ship
   # as standalone profiles and we would just Px/px to them, but this is not
   # practical because oxide-renderer needs to access app-specific files
-  # and shm files (when 1260103 is fixed). For now, have a single helper
-  # profile for chrome-sandbox and oxide-renderer.
+  # and shm files. For now, have a single helper profile for chrome-sandbox and
+  # oxide-renderer.
   /usr/lib/@{multiarch}/oxide-qt/oxide-renderer Cxmr -> oxide_helper,
   /usr/lib/@{multiarch}/oxide-qt/chrome-sandbox cxmr -> oxide_helper,
 
@@ -74,15 +74,22 @@
   /var/tmp/ r,
 
   # LP: #1260103
+  # old oxide shm file which is not app-specific
+  #
+  # TODO: Remove rule once we're only using oxide 1.17.5, 1.18, or newer
   owner /{dev,run}/shm/.org.chromium.Chromium.* rwk,
 
+  # app-specific oxide shm file, as used in oxide 1.17.5, 1.18, and newer
+  owner /{dev,run}/shm/@{APP_PKGNAME}.oxide/ rw,
+  owner /{dev,run}/shm/@{APP_PKGNAME}.oxide/** rwk,
+
   # LP: #1260090 - when this bug is fixed, oxide_renderer can become a
   # child profile of this profile, then we can use Cx here and Px in
   # chrome_sandbox. Ideally, chrome-sandbox and oxide-renderer would ship
   # as standalone profiles and we would just Px/px to them, but this is not
   # practical because oxide-renderer needs to access app-specific files
-  # and shm files (when 1260103 is fixed). For now, have a single helper
-  # profile for chrome-sandbox and oxide-renderer.
+  # and shm files. For now, have a single helper profile for chrome-sandbox and
+  # oxide-renderer.
   profile oxide_helper (attach_disconnected) {
     #
     # Shared by chrome-sandbox and oxide-helper
@@ -156,8 +163,15 @@
     owner @{HOME}/.local/share/@{APP_PKGNAME}/** mrwkl,
 
     # LP: #1260103
+    # old oxide shm file which is not app-specific
+    #
+    # TODO: Remove rule once we're only using oxide 1.17.5, 1.18, or newer
     /{dev,run}/shm/.org.chromium.Chromium.* rwk,
 
+    # app-specific oxide shm file, as used in oxide 1.17.5, 1.18, and newer
+    /{dev,run}/shm/@{APP_PKGNAME}.oxide/ rw,
+    /{dev,run}/shm/@{APP_PKGNAME}.oxide/** rwk,
+
     # LP: #1260048
     owner @{HOME}/.pki/nssdb/ rw,
     owner @{HOME}/.pki/nssdb/** rwk,
 
=== modified file 'debian/changelog'
--- debian/changelog	2016-08-25 13:24:01 +0000
+++ debian/changelog	2016-08-25 17:04:28 +0000
@@ -1,3 +1,4 @@
+<<<<<<< TREE
 apparmor-easyprof-ubuntu (16.10.2) UNRELEASED; urgency=medium
 
   [ You-Sheng Yang ]
@@ -5,6 +6,16 @@
 
  -- Jamie Strandboge <[e-mail]>  Thu, 25 Aug 2016 08:23:06 -0500
 
+=======
+apparmor-easyprof-ubuntu (16.10.2) UNRELEASED; urgency=medium
+
+  * ubuntu/webview: update to allow access to the new app-specific shared
+    memory files that will be used by Oxide 1.17.5, 1.18, and newer
+    (LP: #1260103)
+
+ -- Tyler Hicks <[e-mail]>  Thu, 25 Aug 2016 12:03:15 -0500
+
+>>>>>>> MERGE-SOURCE
 apparmor-easyprof-ubuntu (16.10.1) yakkety; urgency=medium
 
   * add 16.10 policy