Akonadi's Apparmor profile does not work with Encrypted Private Directory overlays

[John Dong]

I am using EncryptedPrivateDirectory on my system so .local is a symlink into Private/.local which is an ecryptfs mount. As a result, akonadi dies at startup. To get it working locally, I had to add the rules:

  @{HOME}/.Private/.local/share/akonadi/** rkw,
  @{HOME}/Private/.local/share/akonadi/** rkw,

ecryptFS is a two-layer overlay so both the rules for the overlay and underlay are required.

I think it's a good idea to support this fairly standard EcryptFS setup in the default AA profile.

[Alvin (alvind)]

This is described as a common problem:
http://userbase.kde.org/Akonadi#Common_Problems

[ilia (ilia)]

I doubt the change proposed by John will work since ecryptfs encrypts file names too, so for my system I need either
  @{HOME}/.Private/** rwk,
or the encrypted path, manually set per each user :( like the following
  @{HOME}/.Private/ECRYPTFS_FNEK_ENCRYPTED.FWZNv58uMVCY0ER-NWgY7HvO.usFvEvRTYBUko1cAvbwnRrOeZS1sWs02---/ECRYPTFS_FNEK_ENCRYPTED.FWZNv58uMVCY0ER-NWgY7HvO.usFvEvRTYBU.s4vCLVHHxArf7P1VoQSG---/ECRYPTFS_FNEK_ENCRYPTED.FWZNv58uMVCY0ER-NWgY7HvO.usFvEvRTYBUaHK9TmE8gP6V6buosKP4CU--/** rwk,

None of these solutions looks satisfactory. Any ideas from apparmor people?

[Harald Sitter (apachelogger)]

Setting status to confirmed, we don't have a sensible solution to this at hand,
@{HOME}/.Private/** rwk
is not that much of a solution either, since it makes apparmor mostly useless in this particular case, though I am not sure that this is incredibly awful either. All in all, needing input on how to address this issue. We probably can ship what John Dong suggested meanwhile?