** Also affects: apparmor Importance: Undecided Status: New ** Changed in: apparmor Importance: Undecided => Low
** Changed in: apparmor Status: New => Triaged ** Changed in: apparmor (Ubuntu) Status: Triaged => Confirmed -- You received this bug notification because you are a member of Ubuntu SDK bug tracking, which is subscribed to qtbase-opensource-src in Ubuntu. https://bugs.launchpad.net/bugs/1370218 Title: Fine-grained shm mediation (confined applications need access to /run/shm/shmfd*) Status in AppArmor Linux application security framework: Triaged Status in “apparmor” package in Ubuntu: Confirmed Status in “apparmor-easyprof-ubuntu” package in Ubuntu: Fix Released Status in “qtbase-opensource-src” package in Ubuntu: New Status in “qtmultimedia-opensource-src” package in Ubuntu: New Status in “apparmor-easyprof-ubuntu” package in Ubuntu RTM: Fix Released Bug description: QAudioRecoder needed the following rules: owner /{run,dev}/shm/shmfd* rwk, but then it was discovered that confined apps on utopic also need: owner /{run,dev}/shm/shmfd* rwk, The rules are this way because the shared memory files are not app specific and is possible for one app to access another app's shared memory file. Please update qtbase-opensource-src so the files are app- specific to better isolation the apps (this is something we are doing elsewhere). Longer term we'd like to have shared memory file mediation in AppArmor. Original report: I recently wrote a small application[1] to spot an ancient issue I had using QAudioRecorder on Ubuntu devices. After I have installer gstreamer0.10-pulseaudio (otherwise "pulseaudio:" is not listed as available source), I tried to start a record through QAudioRecorder but it failed, giving me this output: "shm_open() failed: Permission denied" I've checked for some denials from apparmor (using 'dmesg | grep DEN'), but none was found. If I change the apparmor profile[2], so that my test application is launched in a unconfined environment, QAudioRecorder works properly as expected. I run this test on my Nexus 5 (utopic-devel-proposed #185), but this problem with shm happens also on i386 ubuntu-emulator (utopic-devel #206). Just for reference, this is the link to the original mail, stored in the ubuntu-phone team mailing list archive: http://lists.launchpad.net/ubuntu-phone/msg09842.html [1] - http://bazaar.launchpad.net/~verzegnassi-stefano/+junk/recorder-test/files [2] { "policy_version": 1.2, "template": "unconfined", "policy_groups": [] } To manage notifications about this bug go to: https://bugs.launchpad.net/apparmor/+bug/1370218/+subscriptions -- Mailing list: https://launchpad.net/~ubuntu-sdk-bugs Post to : ubuntu-sdk-bugs@lists.launchpad.net Unsubscribe : https://launchpad.net/~ubuntu-sdk-bugs More help : https://help.launchpad.net/ListHelp