← Back to branch summary

~ubuntu-branches/ubuntu/saucy/apparmor/saucy-updates

« back to all changes in this revision

Viewing changes to .pc/0070-etc-writable.patch/profiles/apparmor.d/abstractions/ubuntu-browsers.d/java

  • Committer: Package Import Robot
  • Author(s): Martin Pitt
  • Date: 2013-10-01 09:55:15 UTC
  • Revision ID: package-import@ubuntu.com-20131001095515-tw7rmk87h1odlrgl
Tags: 2.8.0-0ubuntu29
https://launchpad.net/bugs/1227520
Add 0070-etc-writable.patch: Allow reading time configuration from
/etc/writable, as we have it on the phone. (LP: #1227520)

Show diffs side-by-side

added added

removed removed

Lines of Context:
.pc/0070-etc-writable.patch/profiles/apparmor.d/abstractions/ubuntu-browsers.d/java
 
1
# vim:syntax=apparmor
 
2
 
 
3
  # Java plugin
 
4
  owner @{HOME}/.java/deployment/deployment.properties k,
 
5
  /etc/java-*/ r,
 
6
  /etc/java-*/** r,
 
7
  /usr/lib/jvm/java-{6,7}-openjdk*/jre/lib/*/IcedTeaPlugin.so mr,
 
8
  /usr/lib/jvm/java-6-openjdk/jre/bin/java cx -> browser_openjdk,
 
9
  /usr/lib/jvm/java-6-openjdk-{amd64,armel,armhf,i386,powerpc}/jre/bin/java cx -> browser_openjdk,
 
10
  /usr/lib/jvm/java-7-openjdk/jre/bin/java cx -> browser_openjdk,
 
11
  /usr/lib/jvm/java-7-openjdk-{amd64,armel,armhf,i386,powerpc}/jre/bin/java cx -> browser_openjdk,
 
12
  /usr/lib/jvm/java-*-sun-1.*/jre/bin/java{,_vm} cx -> browser_java,
 
13
  /usr/lib/jvm/java-*-sun-1.*/jre/lib/*/libnp*.so cx -> browser_java,
 
14
  /usr/lib/j2*-ibm/jre/bin/java cx -> browser_java,
 
15
 
 
16
  # Profile for the supported OpenJDK in Ubuntu. This doesn't require the
 
17
  # unfortunate workarounds of the proprietary Javas, so have a separate
 
18
  # profile.
 
19
  profile browser_openjdk {
 
20
    #include <abstractions/base>
 
21
    #include <abstractions/fonts>
 
22
    #include <abstractions/gnome>
 
23
    #include <abstractions/kde>
 
24
    #include <abstractions/nameservice>
 
25
    #include <abstractions/ssl_certs>
 
26
    #include <abstractions/user-tmp>
 
27
    #include <abstractions/private-files-strict>
 
28
 
 
29
    network inet stream,
 
30
    network inet6 stream,
 
31
    @{PROC}/[0-9]*/net/if_inet6 r,
 
32
    @{PROC}/[0-9]*/net/ipv6_route r,
 
33
 
 
34
    /etc/java-*/ r,
 
35
    /etc/java-*/** r,
 
36
    /etc/lsb-release r,
 
37
    /etc/ssl/certs/java/* r,
 
38
    /etc/timezone r,
 
39
 
 
40
    @{PROC}/[0-9]*/ r,
 
41
    @{PROC}/[0-9]*/fd/ r,
 
42
    @{PROC}/filesystems r,
 
43
    /sys/devices/system/cpu/ r,
 
44
    /sys/devices/system/cpu/** r,
 
45
    /usr/share/** r,
 
46
    /var/lib/dbus/machine-id r,
 
47
 
 
48
    /usr/bin/env ix,
 
49
    /usr/lib/jvm/java-{6,7}-openjdk*/jre/bin/java ix,
 
50
    /usr/lib/jvm/java-{6,7}-openjdk*/jre/lib/i386/client/classes.jsa m,
 
51
 
 
52
    # Why would java need this?
 
53
    deny /usr/bin/gconftool-2 x,
 
54
 
 
55
    owner @{HOME}/ r,
 
56
    owner @{HOME}/** rwk,
 
57
  }
 
58
 
 
59
  # Profile for commercial Javas. These need workarounds to work right (eg
 
60
  # Sun's forcing of an executable stack (LP: #535247)).
 
61
  profile browser_java {
 
62
    #include <abstractions/base>
 
63
    #include <abstractions/fonts>
 
64
    #include <abstractions/gnome>
 
65
    #include <abstractions/kde>
 
66
    #include <abstractions/nameservice>
 
67
    #include <abstractions/ssl_certs>
 
68
    #include <abstractions/user-tmp>
 
69
    #include <abstractions/private-files-strict>
 
70
 
 
71
    network inet stream,
 
72
    network inet6 stream,
 
73
    @{PROC}/[0-9]*/net/if_inet6 r,
 
74
    @{PROC}/[0-9]*/net/ipv6_route r,
 
75
    @{PROC}/loadavg r,
 
76
 
 
77
    /etc/debian_version r,
 
78
    /etc/java-*/ r,
 
79
    /etc/java-*/** r,
 
80
    /etc/lsb-release r,
 
81
    /etc/ssl/certs/java/* r,
 
82
    /etc/timezone r,
 
83
 
 
84
    @{PROC}/[0-9]*/ r,
 
85
    @{PROC}/[0-9]*/fd/ r,
 
86
    @{PROC}/filesystems r,
 
87
    /sys/devices/system/cpu/ r,
 
88
    /sys/devices/system/cpu/** r,
 
89
    /usr/share/** r,
 
90
    /var/lib/dbus/machine-id r,
 
91
 
 
92
    /usr/bin/env ix,
 
93
    /usr/lib/jvm/java-*-sun-1.*/jre/bin/java{,_vm} ix,
 
94
    /usr/lib/jvm/java-*-sun-1.*/jre/lib/i386/client/classes.jsa m,
 
95
    /usr/lib/j2*-ibm/jre/bin/java ix,
 
96
 
 
97
    # noisy, can't write here anyway
 
98
    deny /etc/.java/ w,
 
99
    deny /etc/.java/** w,
 
100
 
 
101
    deny /usr/bin/gconftool-2 x,
 
102
 
 
103
    owner @{HOME}/ r,
 
104
    owner @{HOME}/** rwk,
 
105
 
 
106
    # These are seriously unfortunate, but required due to LP: #535247
 
107
    /etc/passwd m,
 
108
    owner @{HOME}/.java/**/cache/** m,
 
109
    owner /tmp/** m,
 
110
    /usr/lib{,32,64}/jvm/**/*.jar mr,
 
111
    /usr/share/fonts/** m,
 
112
  }