Dekko can't open webviews on a Xenial (+Unity8) laptop

[Andrea Bernabei]

This is happening on a Xenial laptop with apparmor-easyprof 2.10-0ubuntu11

I cloned Dekko's repo, built it with
cmake -DCLICK_MODE=on .
make -j4
make DESTDIR=./click_dir install
click build ./click_dir

and installed the package with
sudo click install --user=<username> --allow-unauthenticated dekko.click

When Dekko tried to load a WebView
(source: https://git.launchpad.net/dekko/tree/qml/MessageView/DekkoWebView.qml?id=dd98e6f085ddb19c093d17c86e99dfb061c7088f )

I get the following denials:
in Dekko's log -> http://pastebin.ubuntu.com/14678125/
in Journal -> http://pastebin.ubuntu.com/14678118/

Dekko's apparmor profile:
https://git.launchpad.net/dekko/tree/click/dekko.apparmor?id=dd98e6f085ddb19c093d17c86e99dfb061c7088f

[Jamie Strandboge (jdstrand)]

The problem is that shm moved from /run to /dev. I'll fix the profile.

[Andrea Bernabei (faenil)]

isn't it what http://bazaar.launchpad.net/~ubuntu-security/apparmor-easyprof-ubuntu/trunk/revision/39 was for?

[Jamie Strandboge (jdstrand)]

This should be fixed in 16.04.3, which I just uploaded.

[Jamie Strandboge (jdstrand)]

@Andrea: yes but the fix wasn't applied to policy version 1.3, which is what you specified in your security manifest.

[Andrea Bernabei (faenil)]

right. Thanks!

[Andrea Bernabei (faenil)]

so this means laptops running vivid+ppa will not get the fix, is that right?

[Jamie Strandboge (jdstrand)]

You said that xenial was affected, so I fixed xenial. :) I don't know what ppa you are referring to, but I did check if vivid desktop uses /dev/shm (it does), so it would need the fix. Perhaps ask the owner of the ppa to add the fix to it? Do note, vivid is EOL next week.

[Launchpad Janitor (janitor)]

This bug was fixed in the package apparmor-easyprof-ubuntu - 16.04.3

---------------
apparmor-easyprof-ubuntu (16.04.3) xenial; urgency=medium

  [ Tiago Salem Herrmann ]
  * ubuntu/history: add owner read access to
    @{HOME}/.local/share/history-service/attachments/

  [ Jamie Strandboge ]
  * ubuntu/webview: apply shm changes in last upload to previous policy and
    adjust symlinks (LP: #1538475)

 -- Jamie Strandboge <email address hidden> Wed, 27 Jan 2016 08:16:28 -0600

[Andrea Bernabei (faenil)]

yeah, I'm just looking for other places that need fixing, that's all...

I don't know if we support running Unity8 on top of Vivid, but if we do, then I guess that needs fixing as well :)

[Łukasz Zemczak (sil2100)]

If this also happens for our stable/rc/rc-proposed phones, I suppose we need to get this siloed up and queued for release in the CI Train.