Re: [apparmor] [Merge] ~sdeziel/apparmor-profiles/+git/apparmor-profiles:thunderbird-bug-880425 into apparmor-profiles:master

2017-11-05 Thread intrigeri
Review: Approve Thanks! Merged in GitLab: https://gitlab.com/apparmor/apparmor-profiles/commit/5c48d9f2174c14e3fc3c8401decf1f57e8cdd3ed -- https://code.launchpad.net/~sdeziel/apparmor-profiles/+git/apparmor-profiles/+merge/333081 Your team AppArmor Developers is subscribed to branch apparmor-pro

[apparmor] [Merge] ~sdeziel/apparmor-profiles/+git/apparmor-profiles:thunderbird-bug-880425 into apparmor-profiles:master

2017-11-05 Thread intrigeri
The proposal to merge ~sdeziel/apparmor-profiles/+git/apparmor-profiles:thunderbird-bug-880425 into apparmor-profiles:master has been updated. Status: Needs review => Merged For more details, see: https://code.launchpad.net/~sdeziel/apparmor-profiles/+git/apparmor-profiles/+merge/333081 --

Re: [apparmor] [Merge] ~talkless/apparmor-profiles:thunderbird-mozilla-java-plugins into apparmor-profiles:master

2017-11-05 Thread intrigeri
Review: Approve It seems something went wrong: John marked this as merged but apparently it was not, so I just merged it myself (+ applied the same change to 18.04): https://gitlab.com/apparmor/apparmor-profiles/commit/5ecd985737ca1e1bb6954525dfc1a405f1fe16b7. -- https://code.launchpad.net/~tal

[apparmor] Understanding child profiles and file_inherit

2017-11-05 Thread Vincas Dargis
Hi, While developing `usr.bin.skypeforlinux` (for the new Skype version, it's an Electron app) profile on Ubuntu 17.10 VM, I have discovered file_inherit denies which I would like to understand with your help. `usr.bin.skypeforlinux` profile has these lines to allow executing `/usr/bin/locale

Re: [apparmor] Understanding child profiles and file_inherit

2017-11-05 Thread intrigeri
Vincas Dargis: > And no, it does not actually opens files from `/usr/share/skypeforlinux/*`, > etc. > So, basically, what's happening here? Is it because `skypeforlinux` executed > child > process in some "special" way, or it's just "natural" way of how Linux > applications > work..? file_inhe

Re: [apparmor] [administrivia] git conversion complete; gitlab projects set up

2017-11-05 Thread intrigeri
Steve Beattie: > As agreed upon in the last meeting, I've converted the apparmor bzr > branches to a git repository. I have also pushed that repository and the > apparmor-profiles git repository to the apparmor project on gitlib. Excellent, thanks! > I did set up launchpad to mirror the gitlab tr

[apparmor] Moving Debian/Ubuntu packaging to Git

2017-11-05 Thread intrigeri
Hi! So far the Debian packaging lives in bzr and I regularly merge from the apparmor-ubuntu-citrain branch. I want to move it to Git ASAP. Does Ubuntu have a plan wrt. packaging src:apparmor in Git? If not, I will set something up. My preferred workflow is: - use git-buildpackage + pristine-ta

Re: [apparmor] [administrivia] git conversion complete; gitlab projects set up

2017-11-05 Thread Steve Beattie
On Sun, Nov 05, 2017 at 12:34:42PM +0100, intrigeri wrote: > Steve Beattie: > > As agreed upon in the last meeting, I've converted the apparmor bzr > > branches to a git repository. I have also pushed that repository and the > > apparmor-profiles git repository to the apparmor project on gitlib. >

Re: [apparmor] [administrivia] git conversion complete; gitlab projects set up

2017-11-05 Thread intrigeri
Hi, John Johansen: > So I am not a fan of the merge commit, it creates a messier history and > can break bisecting, especially where its an interaction between certain > patches you are looking for not just a single breaking commit. > But I can live with it, with some provisos. > The person who

Re: [apparmor] Understanding child profiles and file_inherit

2017-11-05 Thread Vincas Dargis
On 2017.11.05 13:10, intrigeri wrote: Is it possible to deny all of these file_inherit somehow? Probably, with a wide deny rule such as (/**). It it possible to select file_inherit only? I mean, this will not allow even mmap executable itself, and it would deny all these file rules in , woul