Cannot add U1 account on Unity8 Desktop

[Alan Pope 🍺🐧🐱 🦄]

Using https://wiki.ubuntu.com/Unity8inLXC on my Wily desktop I setup a Unity8 login

I cannot add an Ubuntu One account.

System settings -> Accounts -> Add account -> Click Ubuntu One.
Window flickers briefly, no expected dialog to enter credentials appears.

http://paste.ubuntu.com/11729603/ is my .cache/upstart/application-legacy-ubuntu-system-settings-.log

ProblemType: Bug
DistroRelease: Ubuntu 15.10
Package: ubuntu-system-settings 0.3+15.10.20150615-0ubuntu1
ProcVersionSignature: Ubuntu 3.19.0-20.20-generic 3.19.8
Uname: Linux 3.19.0-20-generic x86_64
ApportVersion: 2.17.3-0ubuntu4
Architecture: amd64
Date: Wed Jun 17 10:21:55 2015
EcryptfsInUse: Yes
InstallationDate: Installed on 2012-01-02 (1261 days ago)
InstallationMedia: Ubuntu 12.04 LTS "Precise Pangolin" - Alpha amd64 (20120102)
SourcePackage: ubuntu-system-settings
UpgradeStatus: Upgraded to wily on 2015-05-28 (19 days ago)

[Sebastien Bacher (seb128)]

could be due to bug #1466012 since that's using a webview

[Alberto Mardegan (mardy)]

No, the U1 account is not using a webview.
There might be something wrong with the apparmor profile of the system settings app, because the message

    RequestAccess failed: QDBusError("com.ubuntu.OnlineAccountsUi.InvalidApplication", "Invalid client application")

hints at something in that direction.

Alan, can you please run a "ps -feZ | grep system-settings" and see what's the first field there?

Last but not least, does this happen with other account types as well (google, facebook)?

[Alan Pope 🍺🐧🐱 🦄 (popey)]

lxc-container-default-with-nesting alan 8556 4245 2 11:38 ? 00:00:00 system-settings

Happens with all accounts.

[Alberto Mardegan (mardy)]

Thanks Alan. The problem is that OA has a special treatment for clients whose apparmor label is "unconfined", such as the system-settings running in the phone.
For some reason, when you run unity8 inside LXC, the apparmor label assigned to the system-settings process is "lxc-container-default-with-nesting", which gets refused access to create the account.
Adding the apparmor project to the bug for investigation.

[Jamie Strandboge (jdstrand)]

LXC is launching the container under an apparmor profile and all processing within that container end up having the same profile. You currently cannot have separate and distinct host policy and container policy in the form that unity8 lxc is currently looking for. This requires namespace stacking support in AppArmor (and kernel LSMs in general)-- this is being worked on but won't be available for a while. OA could be modified (at least for unity8 lxc) to treat "lxc-container-default-with-nesting" like you do as unconfined. Or unity8 lxc could run under unconfined instead of "lxc-container-default-with-nesting". This would workaround the OA part, but I have little confidence that unity8 lxc would be able to launch and use applications, at least not without changes to UAL to launch everything unconfined (which probably defaults the purposes of testing an app within unity8 lxc).

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.