~ubuntu-branches/ubuntu/utopic/apparmor-easyprof-ubuntu/utopic-proposed : changes

~ubuntu-branches/ubuntu/utopic/apparmor-easyprof-ubuntu/utopic-proposed » Changes from revision 95

From Revision 95 to 76

Rev	Summary	Authors	Tags	Date
95	ubuntu/networking: add rules for app-specific ubuntu-downloa... ubuntu/networking: add rules for app-specific ubuntu-download-manager file downloads (LP: #1384349)	Jamie Strandboge	1.2.38	9 years ago
94	ubuntu/audio: also allow access to GetArtistArt when accessi... ubuntu/audio: also allow access to GetArtistArt when accessing the thumbnailer (LP: #1381102)	Jamie Strandboge	1.2.37	9 years ago
93	* ubuntu/accounts: allow all on org.freedesktop.DBus.Propert... * ubuntu/accounts: allow all on org.freedesktop.DBus.Properties for /com/google/code/AccountsSSO/SingleSignOn/** (LP: #1378809) * ubuntu/ubuntu-*, pending/ubuntu-scope-local-content, ubuntu/webview: also allow read on /android/system/build.prop (LP: #1378838)	Jamie Strandboge	1.2.36	9 years ago
92	* ubuntu/1.2/push-notification-client: don't deny access to ... * ubuntu/1.2/push-notification-client: don't deny access to the clipboard since sdk apps are supposed to be able to specify this policy group * ubuntu/1.2: add ubuntu-push-helper for push-helpers to use which (among other things) explicitly disables access to the clipboard (LP: #1371170) * adjust autopackagetest for ubuntu-push-helper * ubuntu/accounts: allow all on org.freedesktop.DBus.Properties for /com/google/code/AccountsSSO/SingleSignOn * ubuntu/1.2/ubuntu-scope-network, pending/ubuntu-scope-local-content: also add remaining libhybris paths (/{,var/}run/shm/hybris_shm_data and /system/build.prop) * ubuntu/ubuntu-sdk: explicitly disallow gsettings (dconf) access (LP: #1378115)	Jamie Strandboge	1.2.35	9 years ago
91	ubuntu/1.[12]/ubuntu-{sdk,webapp}: re-add still needed rule ... ubuntu/1.[12]/ubuntu-{sdk,webapp}: re-add still needed rule for /{,run/}shm/shm/WK2SharedMemory.[0-9]*. This needs to stay until qtwebkit is removed from the image (LP: #1377648)	Jamie Strandboge	1.2.34	9 years ago
90	* ubuntu/accounts: allow access to GetAll on org.freedesktop... * ubuntu/accounts: allow access to GetAll on org.freedesktop.DBus.Properties for /com/google/code/AccountsSSO/SingleSignOn (LP: #1377205) * ubuntu/webview: also deny access to /custom/etc/dconf_profile. This is fallout from Oxide trying to use gsettings, but we've been silently denying that access since the webview policy group was added, so just silence this denial too (LP: #1260101) * ubuntu/ubuntu-{sdk,webapp}: also allow talking to clipboard on freedesktop interface (LP: #1377221) * tests/test-data.py: update hardware dir handling and also adjust policy groups to use tmpdir * debian/control: Build-Depends on apparmor so we can check syntax during builds	Jamie Strandboge	1.2.33	9 years ago
89	* ubuntu/1.2/ubuntu-scope-network, pending/ubuntu-scope-loca... * ubuntu/1.2/ubuntu-scope-network, pending/ubuntu-scope-local-content: allow access to android libraries (LP: #1376430) * ubuntu/ubuntu-{sdk,webapp}: allow read access for thumbnailer icons (LP: #1376436)	Jamie Strandboge	1.2.32	9 years ago
88	* ubuntu/ubuntu-: add owner /{run,dev}/shm/shmfd- rwk (LP:... * ubuntu/ubuntu-: add owner /{run,dev}/shm/shmfd- rwk (LP: #1370218) * ubuntu/microphone: remove shmfd access since it is in the templates now	Jamie Strandboge		9 years ago
87	ubuntu/webview: explicitly deny write access to @{PROC}/[0-9... ubuntu/webview: explicitly deny write access to @{PROC}/[0-9]/oom_adj and @{PROC}/[0-9]/oom_score_adj. This is confirmed as a way to escape application lifecycle (LP: #1260115)	Jamie Strandboge		9 years ago
86	* ubuntu/calendar: add missing rule for org.freedesktop.DBus... * ubuntu/calendar: add missing rule for org.freedesktop.DBus.Introspectable on path /com/canonical/indicator/datetime/AlarmProperties (LP: #1374623) * ubuntu/1.[12]/ubuntu-{sdk,webapp}: remove no longer needed rule for /{,run/}shm/shm/WK2SharedMemory.[0-9]* (LP: #1197060) * ubuntu/microphone: - add temporary write access to /{run,dev}/shm/shmfd-* for QAudioRecorder (LP: #1370218) - explicitly deny read on /dev/ * ubuntu/1.1/webview: allow dbus send to RequestName on org.freedesktop.DBus webapp-container needs corresponding 'bind' call on org.freedesktop.Application, which we block elsewhere. webapp-container shouldn't be doing this under confinement, but we allow this rule in content_exchange, so just allow it to avoid confusion. (LP: #1357371)	Jamie Strandboge		9 years ago
85	* ubuntu/ubuntu-{sdk,webapp}: all apps can access the Mir cl... * ubuntu/ubuntu-{sdk,webapp}: all apps can access the Mir clipboard (LP: #1372579). Note, LP: 1371170 will be fixed in a future update * ubuntu/push-notification-client: explit deny (with auditing) for access to the Mir clipboard (background apps should not have access) * ubuntu/ubuntu-scope-network: explicit deny (with auditing) for access to the Mir clipboard (scopes should not have access) * pending/ubuntu-scope-local-content: bring up to date with changes to ubuntu-scope-network	Jamie Strandboge		9 years ago
84	ubuntu/{audio,video}: allow mediascanner to send us signals ubuntu/{audio,video}: allow mediascanner to send us signals	Jamie Strandboge		9 years ago
83	ubuntu/location: don't filter receive on interface (allows P... ubuntu/location: don't filter receive on interface (allows PropertyChanged on org.freedesktop.DBus.Properties but also helps future proof)	Jamie Strandboge		9 years ago
82	* ubuntu/camera: allow DBus communications with media-hub (L... * ubuntu/camera: allow DBus communications with media-hub (LP: #1369512) * ubuntu/*: drop redundnat 'ptrace (read) peer=@{profile_name}' since we include it in the base abstraction now	Jamie Strandboge		9 years ago
81	* ubuntu-scope-network: * ubuntu-scope-network: - don't needlessly escape '-' in zmq access rule - silence @{PROC}/[0-9]/attr/current denial since the scopes runner uses aa_getcon() and the denial is noisy (LP: #1367264) ubuntu-webapp: explicitly deny noisy denial to dbus bind on org.freedesktop.Application * debian/apparmor-easyprof-ubuntu.postinst: update the cached .md5sums file on upgrade to avoid running on install and then again on first boot after upgrade. This change only affects apt upgrades and not system-image upgrades since system-image upgrades always use the existing .md5sums if they exist (see /etc/system-image/writable-paths).	Jamie Strandboge		9 years ago
80	* Updates for abstract and anonymous socket mediation (LP: #... * Updates for abstract and anonymous socket mediation (LP: #1362199): - ubuntu//ubuntu-: + use dbus-strict and dbus-session-strict abstractions and remove duplicated policy + allow ubuntu-sdk and ubuntu-webapp connect, receive and send on the maliit abstract socket + allow write access to owner /{,var/}run/user//@{APP_PKGNAME}/{,} - ubuntu//unconfined: allow unix - ubuntu/webview: + allow oxide to talk to sandbox via unix sockets + allow sandbox to talk to @{APP_PKGNAME}_@{APP_APPNAME}_@{APP_VERSION} peer + allow various unix perms from base abstract for the sandbox to use unix sockets - debian/control: Depends on apparmor >= 2.8.96~2541-0ubuntu4 * ubuntu/webview: use @{APP_PKGNAME}_@{APP_APPNAME}_@{APP_VERSION} for signal now that we have @{APP_APPNAME} available (LP: #1363112) * ubuntu/debug: 'audit deny @{HOME}/.local/share/ r' which is used by the SDK to see if confined * debian/control: Depends on apparmor >= 2.8.96~2541-0ubuntu4~	Jamie Strandboge		9 years ago
79	* ubuntu/1.2/accounts: online accounts now has Mir trusted s... * ubuntu/1.2/accounts: online accounts now has Mir trusted session support so move accounts policy group to reserved (LP: #1230091) * ubuntu/1.2/ubuntu-scope-network, pending/ubuntu-scope-local-content: - add DBus session and system accesses to scope templates like we have in the app templates. This allows scopes to talk to trusted helpers like online accounts and location-service. Actual communication with the services is still controlled by the respective policy groups. - add scope-specific access to /run/user/[0-9]/scopes/leaf-{net,fs}/ * ubuntu/1.2/ubuntu-scope-network, pending/ubuntu-scope-local-content: adjust path to settings, it was renamed to settings.ini (LP: #1356930) * ubuntu/1.2/ubuntu-scope-network, pending/ubuntu-scope-local-content: - allow rk access to scope specific settings.db - explicitly noisy deny rw access to unconfined directory * ubuntu/: explicitly deny 'w' access to /dev/xLog (LP: #1352432) ubuntu/1.2/connectivity: update to use upcoming connectivity DBus API (LP: #1341548) * ubuntu/1.[12]/contacts: remove workaround policy since address-book-app no longer uses the telepathy API (LP: #1227818) * ubuntu/: explicitly deny rw access to /dev/fb0. It is both dangerous and noisy with the camera app ubuntu/ubuntu-webapp: receive application-specific Open on org.freedesktop.Application to allow url-dispatcher working with already running webapps (LP: #1342129) * ubuntu/*: explicitly deny noisy access to @{PROC}/xlog (LP: #1352432)	Jamie Strandboge		9 years ago
78	ubuntu/camera: update to allow write access to the finalized... ubuntu/camera: update to allow write access to the finalized path for the microphone socket (/dev/socket/micshm) (ref. LP: 1337582)	Jamie Strandboge	1.2.14	9 years ago
77	* ubuntu/1.2/ubuntu-scope-network: allow 'w' for leaf-net/@{... * ubuntu/1.2/ubuntu-scope-network: allow 'w' for leaf-net/@{APP_PKGNAME}/ * pending/ubuntu-scope-local-content: - add 'w' for leaf-fs/@{APP_PKGNAME}/ - add missing fix for LP: 1347177 (LP: #1348210) * include openssl abstraction in templates instead of in the networking policy group. This is needed due to changes in newer curl and gnutls28 (LP: #1350152)	Jamie Strandboge	1.2.13	9 years ago
76	ubuntu/1.2/ubuntu-scope-network: allow rw on zmq/-r reply e... ubuntu/1.2/ubuntu-scope-network: allow rw on zmq/-r reply endpoints. The scopes-api has protections for malformed or non-UUID-matching replies, so use a glob here to allow aggregating scopes to work. (LP: #1347177)	Jamie Strandboge	1.2.12	9 years ago

Older »