various apparmor denials when using ubuntu-account-plugin template
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
Canonical System Image |
Fix Released
|
Critical
|
David Barth | ||
Online Accounts setup for Ubuntu Touch |
Fix Released
|
Critical
|
Alberto Mardegan | ||
apparmor-easyprof-ubuntu (Ubuntu) |
Fix Released
|
Undecided
|
Unassigned | ||
click-reviewers-tools (Ubuntu) |
Fix Released
|
Low
|
Jamie Strandboge | ||
ubuntu-system-settings-online-accounts (Ubuntu) |
Fix Released
|
Undecided
|
Unassigned |
Bug Description
This is a new bug for the problems seen in bug #1219644. Specifically:
1. There is a denial to create this directory if it does not exist already:
Jun 24 17:02:55 ubuntu-phablet kernel: [44001.684473] type=1400 audit(143518337
2. If you create that directory, the next denial is not application specific (ie, it doesn't use the APP_ID):
Jun 24 17:12:00 ubuntu-phablet kernel: [44546.645041] type=1400 audit(143518392
3. The apparmor policy has rules for this:
owner @{HOME}
owner @{HOME}
but *not* for:
owner @{HOME}
owner @{HOME}
It is not clear if '3' will be fixed if '2' is or if the policy will need this added after '2' is fixed:
# Allow writes to application-
owner @{HOME}
owner @{HOME}
Related branches
- PS Jenkins bot (community): Approve (continuous-integration)
- David Barth (community): Approve
-
Diff: 150 lines (+77/-2)4 files modifiedonline-accounts-service/ui-proxy.cpp (+2/-1)
tests/online-accounts-service/data/com.ubuntu.test_confined.provider (+6/-0)
tests/online-accounts-service/tst_ui_proxy.cpp (+67/-0)
tests/online-accounts-service/tst_ui_proxy.pro (+2/-1)
Changed in ubuntu-system-settings-online-accounts: | |
status: | New → In Progress |
importance: | Undecided → Critical |
assignee: | nobody → Alberto Mardegan (mardy) |
Changed in canonical-devices-system-image: | |
assignee: | nobody → David Barth (dbarth) |
importance: | Undecided → Critical |
milestone: | none → ww34-2015 |
status: | New → Fix Released |
Changed in ubuntu-system-settings-online-accounts: | |
status: | In Progress → Fix Released |
Adding an apparmor- easyprof- ubuntu task for now, but depending on what Alberto finds, it may not need a fix.