Hi Simon,
Simon Deziel wrote (28 Jan 2014 02:43:17 GMT) :
> So I went ahead and installed 14.04 and tried your profile. I made some
> changes:
> * removed abstractions/dconf (does not exist as you said)
> * added ~/.config/dconf/user
OK, I'm ignoring these backporting changes.
> * dropped /{,var/}run/ compat (not needed anymore I think)
I'd like to keep the profile working on older distros, so I think I'll
keep the compat stuff for now.
> * re-added ~/.config/indicators/ (my previous problem is corrected so
> the blacklisting behaviour is fine
> and depends on the libnotify plugin)
OK, added to my profile (attached).
> * added /run/user/[0-9]*/orcexec.* rw, (sound notifications again)
I've added the two lines seen in the lastest version of your profile,
then:
owner /run/user/[0-9]*/ r,
owner /run/user/[0-9]*/orcexec.* mrw,
I see other changes in your profile:
* In commit 03e6e407, you've added "#include
<abstractions/ubuntu-helpers>" and various other stuff, because
"abstractions/ubuntu-helpers is needed for the sanitized_helper".
I'm fine with the abstraction, *but* most of the other stuff is
covered by the freedesktop.org abstraction, that is included by the
gnome one, that is in turn included by the Pidgin profile. So I'm
not merging this as is right now. Do you want to clean up this a bit
and remove the added duplicate lines?
* Compared to the dconf abstraction, you're adding 'w' to "owner
@{HOME}/.config/dconf/user". Is it really needed? (Not for
me, apparently.)
* Compared to the dconf abstraction, you're adding 'w' to
"/run/user/[0-9]*/dconf/user". Is it really needed? (Not for
me, apparently.)
I'm glad we're converging on something that works for both of us! :)
Regards
--
intrigeri
| GnuPG key @ https://gaffer.ptitcanardnoir.org/intrigeri/intrigeri.asc
| OTR fingerprint @ https://gaffer.ptitcanardnoir.org/intrigeri/otr.asc
# vim:syntax=apparmor
#include <tunables/global>
/usr/bin/pidgin {
#include <abstractions/audio>
#include <abstractions/base>
#include <abstractions/bash>
#include <abstractions/dbus>
#include <abstractions/dbus-session>
#include <abstractions/dconf>
#include <abstractions/enchant>
#include <abstractions/gnome>
#include <abstractions/ibus>
#include <abstractions/launchpad-integration>
#include <abstractions/nameservice>
#include <abstractions/private-files-strict>
#include <abstractions/ssl_certs>
#include <abstractions/ubuntu-browsers>
#include <abstractions/user-download>
deny capability sys_ptrace,
owner @{HOME}/.gstreamer*/ rw,
owner @{HOME}/.gstreamer*/** rw,
owner @{HOME}/.purple/ rw,
owner @{HOME}/.purple/** rwk,
owner @{HOME}/.cache/dconf/user rw,
owner @{HOME}/.config/indicators/ rw,
owner @{HOME}/.config/indicators/** rw,
owner /{,var/}run/user/*/dconf/user rwk,
/bin/dash rix,
/bin/which rix,
# NB: the preferred browser and proxy settings must be configured
# in the GNOME preferences: this profile does not allow running
# the corresponding external configuration applications.
/usr/bin/gconftool-2 rPix,
/usr/bin/gnome-open rmix,
/usr/bin/gsettings rix,
/usr/bin/gvfs-open rmix,
/usr/bin/pidgin r,
/usr/bin/xdg-open rmix,
/usr/share/glib-2.0/schemas/gschemas.compiled r,
/usr/lib/frei0r-1/*.so rm,
/usr/lib/@{multiarch}/libvisual-*/**.so rm,
/usr/lib/pidgin/*.so rm,
/usr/lib/purple*/*.so rm,
/usr/share/purple/ca-certs/ r,
/usr/share/purple/ca-certs/** r,
/usr/share/tcltk/** r,
/usr/share/themes/ r,
owner @{PROC}/[0-9]*/auxv r,
owner @{PROC}/[0-9]*/fd/ r,
# For sound notifications
owner /tmp/orcexec.* mr,
# ... if /tmp is mounted noexec
owner @{HOME}/orcexec.* mr,
owner /run/user/[0-9]*/ r,
owner /run/user/[0-9]*/orcexec.* mrw,
# Site-specific additions and overrides. See local/README for details.
#include <local/usr.bin.pidgin>
}
--
AppArmor mailing list
[email protected]
Modify settings or unsubscribe at:
https://lists.ubuntu.com/mailman/listinfo/apparmor
