[apparmor] [patch] dconf locations

[Jamie Strandboge]

On 06/09/2013 01:25 PM, intrigeri wrote:
> Hi,
> 
> on my Debian sid (running systemd, in case it matters), I see some
> GNOME applications start to put stuff in /run/user/$USER/ (e.g.
> evince wanted rwc access to /run/user/intrigeri/dconf/user), and read
> from ~/.config/dconf/user. Neither of these is allowed by the upstream
> AppArmor profiles.
> 
> The following patch fixes this for me:
> 
> diff --git a/apparmor.d/abstractions/gnome b/apparmor.d/abstractions/gnome
> index f83c3c5..49dd870 100644
> --- a/apparmor.d/abstractions/gnome
> +++ b/apparmor.d/abstractions/gnome
> @@ -84,3 +84,7 @@
>    # mime-types
>    /etc/gnome/defaults.list r,
>    /usr/share/gnome/applications/mimeinfo.cache r,
> +
> +  # dconf locations
> +  owner /run/user/*/dconf/user rw,
> +  owner @{HOME}/.config/dconf/user r,
> 
> I've seen Ubuntu added similar settings in usr.bin.chromium-browser
> and abstractions/ubuntu-browsers.d/ubuntu-integration, so perhaps now
> would be a good time to factorize this stuff a bit :)
> 
> I did not bother using /{,var/}run, since I guess any system recent
> enough to run dconf probably has moved to /run already, but feel free
> to fix this or to ask me to resubmit if you think differently.
> 
> To end with, it's my first patch submission here IIRC, so feel free to
> tell me how I can do better next time.
> 

Because of the way dconf works, the 'w' access allows updating anything
in the specified database as opposed to only certain keys and IMO is too
permissive for the gnome abstraction. My gut feeling is that dconf
should be in its own abstraction and only allow 'r' access and
applications can add 'w' as necessary (or maybe have dconf and
dconf-write abstractions that applications could use).

I might also mention that the DBus patches should be landing soonish and
we'll need to specify DBus rules for dconf access as well - not that it
would affect these rules, but it might affect how people want to
organize things.


-- 
Jamie Strandboge                 http://www.ubuntu.com/

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 899 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/apparmor/attachments/20130610/b5a9f11c/attachment.pgp>