pepper flash plugin disallowed from apparmor

[Sam Segers]

When launching webbrowser-app from unity8 under confinement, i get disallowed errors for /opt/google/chrome/PepperFlash/manifest.json and /opt/google/chrome/PepperFlash/libpepflashplayer.so

When I add the following to the apparmor profile of webbrowser-app and to the oxide_helper subprocess, it works:

/opt/google/** r,

/opt/google/**/*.so mr,

Don't know what's exactly needed.

[Sam Segers (sam-sgrs)]

Should also consider https://bugs.launchpad.net/oxide/+bug/1585379

[Jamie Strandboge (jdstrand)]

Perhaps:
/opt/google/chrome*/PepperFlash/ r,
/opt/google/chrome*/PepperFlash/** r,
/opt/google/chrome*/PepperFlash/**.so m,

[Jamie Strandboge (jdstrand)]

An apparmor-easyprof-ubuntu task was added, but I'm not sure why. If this is only for webbrowser-app, just add the aforementioned rules (or similar) to the webbrowser-app policy. These rules won't work on Touch (which is what apparmor-easyprof-ubuntu is primarily for) since those paths aren't found on Touch. Can you elaborate on why this should be in apparmor-easyprof-ubuntu?

[Chris Coulson (chrisccoulson)]

The browser can also load the plugin from the partner repository (in /usr/lib/adobe-flashplugin), although that's currently broken for a different reason.

[Olivier Tilloy (osomon)]

Jamie, I added an apparmor-easyprof-ubuntu task because the oxide_helper profile is part of the webview policy. Assuming that we want to allow any app embedding a webview to display flash content, we would want those rules to be added to the oxide_helper profile, wouldn’t we?