clock app, gallery, etc using incorrect path for config file due to StateSaver

[Jamie Strandboge]

The following apparmor denials were observed with 1.0.349 of the clock-app:
Mar 6 07:22:07 ubuntu-phablet kernel: [167149.647858] type=1400 audit(1394112127.627:121): apparmor="DENIED" operation="mknod" parent=1696 profile="com.ubuntu.clock_clock_1.0.349" name="/home/phablet/.config/com.ubuntu.clock.conf.J16567" pid=16567 comm="qmlscene" requested_mask="c" denied_mask="c" fsuid=32011 ouid=32011
Mar 6 07:22:07 ubuntu-phablet kernel: [167149.648224] type=1400 audit(1394112127.627:122): apparmor="DENIED" operation="mknod" parent=1696 profile="com.ubuntu.clock_clock_1.0.349" name="/home/phablet/.config/com.ubuntu.clock.conf.T16567" pid=16567 comm="qmlscene" requested_mask="c" denied_mask="c" fsuid=32011 ouid=32011

The above looks to be a temporary file that would be written before moving the final file to /home/phablet/.config/com.ubuntu.clock.conf. This denial is preventing saving to the config file. AppArmor policy already has these rules:

@{APP_PKGNAME}="com.ubuntu.clock"
  ...
  owner @{HOME}/.config/@{APP_PKGNAME}/ rw, # subdir of XDG_CONFIG_HOME
  owner @{HOME}/.config/@{APP_PKGNAME}/** mrwkl,

Please adjust the clock app to use ~/.config/com.ubuntu.clock/com.ubuntu.clock.conf instead of ~/.config/com.ubuntu.clock.conf. I couldn't find anything in the clock app that showed it specified this file itself, so this is likely a toolkit issue.

Adding an ubuntu-ui-toolkit task. Please feel free to close the clock app task if the bug is in ubuntu-ui-toolkit or vice versa.

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Jamie Strandboge (jdstrand)]

I added the qtorganizer5-eds task since it was assigned via the just now duped bug, but it seems odd that the clock app would be using qtorganizer5-eds. Please adjust as necessary.

[Nekhelesh Ramananthan (nik90)]

The clock app uses qtorganizer5-eds for the alarms feature. But it doesn't do it directly. It uses the Alarms API (provided by the SDK) which in turn uses EDS for storing and retrieving alarms.

[Nekhelesh Ramananthan (nik90)]

Closing clock-app bug since this is a bug upstream in qtorganizer5-eds and ui-toolkit-plugin.

[Jamie Strandboge (jdstrand)]

Actually, sarnold pointed out that the temp file seems to try to be unpredictable, but really isn't:
16:25 <@jdstrand> com.ubuntu.clock.conf.T16567
16:25 <@jdstrand> pid=16567
16:25 <@jdstrand> com.ubuntu.clock.conf.J16567
16:25 <@jdstrand> pid=16567

It would probably be a good idea to use mkstemp() or some safe Qt temporary file API instead. I'm pretty sure this applies to /tmp/*.sci files as well:
/tmp/J16373.sci
/tmp/J16461.sci

[Cris Dywan (kalikiana)]

I think this is StateSaver using QSettings which writes the $APP_ID.conf file - the temporariy file is not being created from within the StateSaver code.

[Zsombor Egri (zsombi)]

Yes, Christian is right. The file has been created by the StateSaver using QSettings default behavior. There is an MR which forces the creation of the file into /tmp folder. The MR has not been landed yet.

[Cris Dywan (kalikiana)]

Still discussing this issue, there may be a branch which would solve this effectively which I'm going to review.

[Jamie Strandboge (jdstrand)]

Note: be sure to honor TMPDIR and not hardcode /tmp. Also, the tmp file path that is used suggests that the final config file will be ~/.config/com.ubuntu.clock.conf, but this is not an allowed path. Plesae verify/adjust to use this instead:
  ~/.config/com.ubuntu.clock/com.ubuntu.clock.conf

[Zsombor Egri (zsombi)]

The MP attached uses QStandardPaths::standardLocations(QStandardPaths::TempLocation)[0] to get the first temp folder to store the file.

[Jamie Strandboge (jdstrand)]

This is also affecting the gallery-app. Eg:
Mar 24 15:12:32 ubuntu-phablet kernel: [ 520.697146] type=1400 audit(1395673952.384:176): apparmor="DENIED" operation="mknod" parent=2068 profile="com.ubuntu.gallery_gallery_2.9.1.931" name="/home/phablet/.config/com.ubuntu.gallery_gallery_2.9.1.931.conf.TJ3909" pid=3909 comm="gallery-app" requested_mask="c" denied_mask="c" fsuid=32011 ouid=32011
Mar 24 15:12:32 ubuntu-phablet kernel: [ 520.698183] type=1400 audit(1395673952.384:177): apparmor="DENIED" operation="mknod" parent=2068 profile="com.ubuntu.gallery_gallery_2.9.1.931" name="/home/phablet/.config/com.ubuntu.gallery_gallery_2.9.1.931.conf.XM3909" pid=3909 comm="gallery-app" requested_mask="c" denied_mask="c" fsuid=32011 ouid=32011
Mar 24 15:12:32 ubuntu-phablet kernel: [ 520.699313] type=1400 audit(1395673952.384:178): apparmor="DENIED" operation="mknod" parent=2068 profile="com.ubuntu.gallery_gallery_2.9.1.931" name="/home/phablet/.config/com.ubuntu.gallery_gallery_2.9.1.931.conf.Lh3909" pid=3909 comm="gallery-app" requested_mask="c" denied_mask="c" fsuid=32011 ouid=32011

[Zsombor Egri (zsombi)]

The MP from UITK should come in the next UITK release.

[Jamie Strandboge (jdstrand)]

This was fixed a long time ago.