Comment 4 for bug 1191858

Thank you for your quick reply. I added your suggested lines to Skype's profile. After reloading it, the only message that appears to kern.log is the error below. It should be noted that my webcam is an internal one but I guess Skype still wants to search for external webcams.

type=1400 audit(1371504139.242:295): apparmor="DENIED" operation="file_lock" parent=1 profile="/usr/bin/skype" name="/home/asentaja/.config/Skype/Skype.conf" pid=16177 comm="skype" requested_mask="k" denied_mask="k" fsuid=1000 ouid=1000

The error message appears twice in the log, the first time occurs at the beginning of a call and the second one at its end. I noticed that it disappears with the following rule (though I’m not sure what exactly the k parameter does):

owner @{HOME}/.config/Skype/Skype.conf krw,

Apart from the above errors, log in/out, calling and video all work well. However, I noticed that clicking on the credit balance button and then any of the purchase/account links leads to the following error:

type=1400 audit(1371506546.785:308): apparmor="DENIED" operation="exec" parent=16740 profile="/usr/bin/skype" name="/usr/bin/gvfs-open" pid=16741 comm="xdg-open" requested_mask="x" denied_mask="x" fsuid=1000 ouid=0

Can you advice me what rule could fix it?

As for the file browser, I realise the security issue for allowing full access to the home folder and understand that there has to be a compromise between usability and security. Since the root of the home folder is not really the best place for downloaded files, and an empty directory listing is a bit confusing, would it be possible to add an access to at least the ~Downloads folder to the default profile?

I tried to add the rules below to the profile but reloading the profile complained about an undeclared XDG_DOWNLOAD variable. Could you please confirm whether AppArmor should work with that variable or should I open a new bug to get support for it?

@{XDG_DOWNLOAD} r,
"@{XDG_DOWNLOAD}/**" rw,

I am completely new to writing AppArmor profiles so I might just be doing something wrong with the above rules. Thanks.