add apparmor profile for transmission-gtk

[Lars Noodén]

There should be an apparmor profile for transmission-gtk. Attached is a draft for discussion.

ProblemType: Bug
DistroRelease: Ubuntu 14.04
Package: apparmor-profiles 2.8.0-0ubuntu38
ProcVersionSignature: Ubuntu 3.13.0-17.37-generic 3.13.6
Uname: Linux 3.13.0-17-generic x86_64
ApportVersion: 2.13.3-0ubuntu1
Architecture: amd64
CurrentDesktop: LXDE
Date: Mon Mar 17 13:36:19 2014
InstallationDate: Installed on 2014-03-07 (9 days ago)
InstallationMedia: Lubuntu 14.04 "Trusty Tahr" - Alpha amd64+mac (20140307)
PackageArchitecture: all
ProcKernelCmdline: BOOT_IMAGE=/boot/vmlinuz-3.13.0-17-generic root=UUID=b44a2e83-f3f2-4e70-800d-04964b932c90 ro quiet splash
SourcePackage: apparmor
UpgradeStatus: No upgrade log present (probably fresh install)

[Christian Boltz (cboltz)]

Some notes without knowing transmission-gtk:

All the @{HOME}/... lines should have the "owner" flag added.

  @{HOME}/.local/share/gvfs-metadata/home-84502876.log r,
  @{HOME}/.local/share/gvfs-metadata/root-65c8c135.log r,
  @{HOME}/.local/share/gvfs-metadata/root-d4e9f38e.log r,

Are those hex numbers in the filename a fixed value or random? Should it be home-*.log and root-*.log instead?

  /tmp/** rw,

Adding the "owner" flag would be nice - and would mean that you can remove the line because "owner /tmp/**" is covered by abstractions/user-tmp

[Lars Noodén (larsnooden)]

Thanks. Here is another try. I've been running it for some hours and nothing turns up in kern.log so far, even after erasing Transmission's configuration and starting it fresh and getting new torrents.

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Ruud Koot (ruudkoot)]

I tried this under Ubuntu GNOME 14.04.

- Transmission crashes when opening the Preferences dialog. Adding "/usr/** r" solved this. I think this can be made more specific as in usr.lib.telepathy.
- This profiles is probably too restrictive when trying to select a download location other than @{HOME}/Downloads. The file selector dialog gives access denied error, so you can only type the correct path manually.
- Help (F1) does not seem to work (needs /usr/bin/xdg-open?).
- Donate does not form (needs firefox.sh?).
- I needed to remove #include <abstraction/lightdm> (I guess this is Ubuntu GNOME specific).
- I added abstaction/dbus, abstraction/dbus-session and abstraction/ibus to silence some complaints.
- I added some dconf related rules from usr.lib.telepathy to silence some complaints.
- I added read access to /etc/mtab, /etc/fstab to silence some complaints.

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Jamie Strandboge (jdstrand)]

This should be submitted to the apparmor mailing list for inclusion in the apparmor-profiles repository. See http://wiki.apparmor.net/index.php/Profiles#How_to_contribute_AppArmor_profiles for details.