More resources must be added into Chromium profile

Bug #1101298 reported by Gökçen Eraslan on 2013-01-18
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
AppArmor Profiles
Undecided
Unassigned

Bug Description

When I install apparmor-profiles package and set Chromium AppArmor profile to enforce mode, Chromium cannot detect the default browser and claims that it is not the default browser even though I set so. And I see this line in dmesg:

... type=1400 audit(1358526376.204:84): apparmor="DENIED" operation="exec" parent=6216 profile="/usr/lib/chromium-browser/chromium-browser//xdgsettings" name="/usr/bin/gawk" pid=6220 comm="xdg-mime" requested_mask="x" denied_mask="x" fsuid=1000 ouid=0

Now, there is only /usr/bin/mawk line in Chromium apparmor profile but users may use a different implementation thanks to the alternatives system.

In addition, my dmesg is flooded by these lines:

... type=1400 audit(1358527121.548:197): apparmor="DENIED" operation="open" parent=6072 profile="/usr/lib/chromium-browser/chromium-browser" name="/sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq" pid=8984 comm="chromium-browse" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0

It would be nice to see "/sys/devices/system/**/cpufreq/cpuinfo_max_freq r," added to the profile.

My patch regarding the issue is attached.

Gökçen Eraslan (gkcn) wrote :
Gökçen Eraslan (gkcn) wrote :

It seems that adding gawk and cpuinfo_max_freq lines to the profile is not enough, chromium also needs lsb_release command and even more important gnome-control-center command to open up proxy settings.

Maybe its better to add /usr/bin/gnome-control-center in ux Access Mode.

affects: apparmor → apparmor-profiles
summary: - Chromium cannot detect the default browser in apparmor enforce mode if
- gawk is the default awk
+ Chromium profile needs more executables to be added
Gökçen Eraslan (gkcn) on 2013-01-18
summary: - Chromium profile needs more executables to be added
+ More resources must be added into Chromium profile
To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers