SDK applications require access to /dev/log_*

[Jamie Strandboge]

Not sure where this bug should be, but Ubuntu SDK applications need write access to various /dev/log_* files. It seems rather odd that, for example, the ubuntu-calculator-app needs the following policy:

  /dev/log_main w,
  /dev/log_radio w,
  /dev/log_events w,
  /dev/log_system w,

These rules are too lenient and presumably any app could spam/attack the system via these device files.

[Launchpad Janitor (janitor)]

This bug was fixed in the package apparmor-easyprof-ubuntu - 1.0.2

---------------
apparmor-easyprof-ubuntu (1.0.2) saucy; urgency=low

  * add sdk-base policy group (based on apparmor's ubuntu-sdk-base)
    - use 'owner' with @{PROC}/cmdline
    - move gst-plugin-scanner to qmlscene-webview
    - deny accesses to /dev/log_* (LP: #1197124)
    - add bug reference for /dev/binder
    - deny access to /dev/cpuctl/apps/tasks and
      /dev/cpuctl/apps/bg_non_interactive/tasks
  * adjust qmlscene to have 'owner "@{HOME}/.local/share/Qt Project/" w,'
 -- Jamie Strandboge <email address hidden> Wed, 03 Jul 2013 17:21:09 -0500

[Timo Jyrinki (timo-jyrinki)]

Possibly qtbase, but I don't know how to debug the /dev usage. It could be also something beneath Qt in our Android interaction layer.

[Jamie Strandboge (jdstrand)]

Adding lxc-android-config task since it provides the udev rules for these devices. This may need to be reassigned. Giving priority of 'Medium', but this could perhaps be lower because apparmor-easyprof-ubuntu is currently denying the access and applications appear to be running fine.

[Jamie Strandboge (jdstrand)]

These accesses have been denied for months without any consequence. I think for now marking the non-apparmor-easyprof-ubuntu tasks as "Won't Fix" is fine. We can re-open if these denials cause problems.