Needed policy groups for sync-monitor service

[Renato Araujo Oliveira Filho]

We need policy groups to access sync-monitor from click apps.

Today the apps that need access to sync-monitor are address-book-app and calendar-app.

[Jamie Strandboge (jdstrand)]

What is the output of 'grep DEN /var/log/syslog' at the time of the denial?

[Bill Filler (bfiller)]

phablet@ubuntu-phablet:~$ grep DEN /var/log/syslog
May 15 15:43:10 ubuntu-phablet kernel: [ 1259.888051] type=1400 audit(1400168590.312:106): apparmor="DENIED" operation="open" parent=1323 profile="com.ubuntu.camera_camera_2.9.1.258" name="/dev/fb0" pid=6425 comm="camera-app" requested_mask="rw" denied_mask="rw" fsuid=32011 ouid=0
May 15 13:52:00 ubuntu-phablet dbus[1908]: apparmor="DENIED" operation="dbus_method_call" bus="session" path="/com/canonical/SyncMonitor" interface="org.freedesktop.DBus.Introspectable" member="Introspect" mask="send" name="com.canonical.SyncMonitor" pid=2698 profile="com.ubuntu.calendar_calendar_0.4.271" peer_pid=2299 peer_profile="unconfined"

[Launchpad Janitor (janitor)]

This bug was fixed in the package apparmor-easyprof-ubuntu - 1.1.18

---------------
apparmor-easyprof-ubuntu (1.1.18) utopic; urgency=medium

  * ubuntu/*: adjust audio/video policy groups comment to mention that the
    media-hub server allows playing remote content
  * ubuntu/networking:
    - correct member portion of DBus rules to not include interface
      (LP: #1311164)
    - adjust explit deny DownloadManager rules to include interface
  * 1.*/ubuntu-sdk:
    - allow read of /usr/share/qtdeclarative5-ubuntu-ui-extras-browser-plugin/
    - allow read access of /etc/machine-id
    - allow ptrace read of ourself
  * 1.1/webview: allow capability dac_read_search for oxide_helper
  * 1.*/video: allow read access to video4linux for playback
  * 1.*/audio: allow calling GetAlbumArt from the thumbnailer DBus API
  * 1.1/ubuntu-*: remove temporary rule for /usr/share/libthai/thbrk.tri
  * ubuntu/*: adjust the calendar and contacts reserved policy groups to
    allow access to the sync monitor (LP: #1319544). This should be removed
    when LP: 1319546 is fixed.
  * 1.1/music_files_read: allow read of @{HOME}/.cache/mediascanner/ until
    LP: 1303962 and LP: 1315381 are fixed
 -- Jamie Strandboge <email address hidden> Thu, 15 May 2014 13:37:06 -0500

[Mihir Soni (mihirsoni)]

Is there anything that needs to be updated on Calendar app side ?