[apparmor] RFC: handling xdg-open and similar helpers

Vincas Dargis vindrg at gmail.com
Tue Mar 20 16:37:56 UTC 2018


On 3/19/18 1:37 PM, intrigeri wrote:
>> As you can see, I have included `ubuntu-helpers` so that
>> `abstractions/ubuntu-browsers` could work (as it needs sanitized_helper). At least
>> I imagined it should.
> 
> I suspect you need to include abstractions/ubuntu-helpers in the
> xdg_open profile.

I believe I've tried that, there is some kind of issue due to the fact 
that `ubuntu-helpers` defines new child profile.. in this case _within_ 
another child profile.

On IRC I got suggestion to try like this:

```

...
/usr/bin/xdg-open rCx -> aatest_xdg_open//xdg_open,
...

}

# outside of main application profile:

profile aatest_xdg_open//xdg_open {
  #include <abstractions/xdg-open>
  #include <abstractions/ubuntu-helpers>
  ...
}


```

But it fails due to some parser bug.

Basically, I'm waiting for parser to be updated to finish my work on 
xdg-open, gvfs-open, gio-open, kde-open, aaaand exo-open abstractions.

Although meanwhile I could do some testing on openSUSE for the helpers 
themselves, even if I get that "transition" failure while trying to 
actually launch a browser.



More information about the AppArmor mailing list