~ubuntu-branches/ubuntu/vivid/apparmor-easyprof-ubuntu/vivid : changes

~ubuntu-branches/ubuntu/vivid/apparmor-easyprof-ubuntu/vivid » Changes from revision 105

From Revision 105 to 86

Rev	Summary	Authors	Tags	Date
105	templates/: explicitly deny noisy access to accountsservice templates/: explicitly deny noisy access to accountsservice (LP: #1433590)	Jamie Strandboge	1.3.10	9 years ago
104	* templates/ubuntu-sdk\|ubuntu-webapp: explicitly deny noisy ... * templates/ubuntu-sdk\|ubuntu-webapp: explicitly deny noisy /dev/tty access * policygroups/accounts: also deny 'r' to /{,var/}run/user/*/signond/socket to silence expected noisy denial (LP: #1415492)	Jamie Strandboge	1.3.9	9 years ago
103	hardware/video.d/apparmor-easyprof-ubuntu_mako: add accesses... hardware/video.d/apparmor-easyprof-ubuntu_mako: add accesses for video4linux 1 and 2 devices needed by mediascanner2 (gst-plugin-scanner) et al	Jamie Strandboge	1.3.8	9 years ago
102	ubuntu/webview: allow oxide_helper read access to /sys/devic... ubuntu/webview: allow oxide_helper read access to /sys/devices/system/cpu/ and /sys/devices/system/cpu/cpu[0-9]*/cpufreq/cpuinfo_max_freq	Jamie Strandboge	1.3.7	9 years ago
101	ubuntu/1.0/ubuntu-{sdk,webapp}: also allow access to mir lib... ubuntu/1.0/ubuntu-{sdk,webapp}: also allow access to mir libraries via the new mir abstraction for 1.0 templates (LP: #1422521)	Steve Beattie	1.3.6	9 years ago
100	[ Alberto Mardegan ] [ Alberto Mardegan ] * ubuntu/accounts: explictly deny access to the p2p socket. This will now be available only to unconfined apps to support a trusted socket for privileged processes (LP: #1415492) [ Jamie Strandboge ] * add ubuntu/1.2/ubuntu-account-plugin template and add to 1.3 policy (LP: #1219644) * adjust expected_templates_12 in autopkgtests to have ubuntu-account-plugin * ubuntu/webview: allow /sys/devices/system/cpu/*/cpufreq/cpuinfo_max_freq readonly access	Jamie Strandboge	1.3.4	9 years ago
99	ubuntu/{music,pictures,video}_files: temporarily allow read... ubuntu/{music,pictures,video}_files: temporarily allow read access to global SD card user directory (LP: #1392368). This can be removed once there is a proper API for apps to find the SD card label.	Jamie Strandboge	1.3.3	9 years ago
98	[ Ricardo Salveti de Araujo ] [ Ricardo Salveti de Araujo ] Adding hardware/video.d/apparmor-easyprof-ubuntu_manta to allow rw on /dev/video, needed for hardware video decoding (LP: #1408130). (Note: we may need to add rw on /dev/v4l-subdev, but this seems to be enough for now)	Jamie Strandboge	1.3.2	9 years ago
97	* ubuntu/ubuntu-sdk: * ubuntu/ubuntu-sdk: - explicitly deny reads on ~/.cache/QML/Apps/ to silence noisy denials. Undo this when LP: 1381620 is fixed in qtdeclarative-opensource-src - explicitly deny dbus bind on name="org.freedesktop.Application" since it is noisy. Undo this when LP: 1378823 is fixed in ubuntu-ui-toolkit * ubuntu/1.3/ubuntu-sdk: drop html5-container policy. html5 apps should use webapp-container and specify the 'webview' policy group with 1.3 (15.04) policy (LP: #1392461) * ubuntu/ubuntu-scope-network, pending/ubuntu-scope-local-content: allow scopes to read data from the apps data dir (LP: #1384286) * adjust all dbus rules to use peer=(label=unconfined) to prevent coordinated communications between apps over DBus (LP: #1383824) * ubuntu/{music,pictures,video}_files: allow access to global SD card directories (LP: #1391930) debian/control: Depends on apparmor >= 2.8.98-0ubuntu2~ for the dbus peer changes (we need at least apparmor_parser 2.9.beta4 for these)	Jamie Strandboge	1.3.1	9 years ago
96	* debian/control: * debian/control: - add Vcs-Bzr and Vcs-Browser now that we have them - adjust Standards-Version * add debian/make-new-version.sh and document how to use it * create policy version 1.3 * adjust autopkgtests: - add tests for policy version 1.3 - fix lintian warnings in naming of the tests * debian/apparmor-easyprof-ubuntu.postinst: add #DEBHELPER# token	Jamie Strandboge	1.3.0	9 years ago
95	ubuntu/networking: add rules for app-specific ubuntu-downloa... ubuntu/networking: add rules for app-specific ubuntu-download-manager file downloads (LP: #1384349)	Jamie Strandboge	1.2.38	9 years ago
94	ubuntu/audio: also allow access to GetArtistArt when accessi... ubuntu/audio: also allow access to GetArtistArt when accessing the thumbnailer (LP: #1381102)	Jamie Strandboge	1.2.37	9 years ago
93	* ubuntu/accounts: allow all on org.freedesktop.DBus.Propert... * ubuntu/accounts: allow all on org.freedesktop.DBus.Properties for /com/google/code/AccountsSSO/SingleSignOn/** (LP: #1378809) * ubuntu/ubuntu-*, pending/ubuntu-scope-local-content, ubuntu/webview: also allow read on /android/system/build.prop (LP: #1378838)	Jamie Strandboge	1.2.36	9 years ago
92	* ubuntu/1.2/push-notification-client: don't deny access to ... * ubuntu/1.2/push-notification-client: don't deny access to the clipboard since sdk apps are supposed to be able to specify this policy group * ubuntu/1.2: add ubuntu-push-helper for push-helpers to use which (among other things) explicitly disables access to the clipboard (LP: #1371170) * adjust autopackagetest for ubuntu-push-helper * ubuntu/accounts: allow all on org.freedesktop.DBus.Properties for /com/google/code/AccountsSSO/SingleSignOn * ubuntu/1.2/ubuntu-scope-network, pending/ubuntu-scope-local-content: also add remaining libhybris paths (/{,var/}run/shm/hybris_shm_data and /system/build.prop) * ubuntu/ubuntu-sdk: explicitly disallow gsettings (dconf) access (LP: #1378115)	Jamie Strandboge	1.2.35	9 years ago
91	ubuntu/1.[12]/ubuntu-{sdk,webapp}: re-add still needed rule ... ubuntu/1.[12]/ubuntu-{sdk,webapp}: re-add still needed rule for /{,run/}shm/shm/WK2SharedMemory.[0-9]*. This needs to stay until qtwebkit is removed from the image (LP: #1377648)	Jamie Strandboge	1.2.34	9 years ago
90	* ubuntu/accounts: allow access to GetAll on org.freedesktop... * ubuntu/accounts: allow access to GetAll on org.freedesktop.DBus.Properties for /com/google/code/AccountsSSO/SingleSignOn (LP: #1377205) * ubuntu/webview: also deny access to /custom/etc/dconf_profile. This is fallout from Oxide trying to use gsettings, but we've been silently denying that access since the webview policy group was added, so just silence this denial too (LP: #1260101) * ubuntu/ubuntu-{sdk,webapp}: also allow talking to clipboard on freedesktop interface (LP: #1377221) * tests/test-data.py: update hardware dir handling and also adjust policy groups to use tmpdir * debian/control: Build-Depends on apparmor so we can check syntax during builds	Jamie Strandboge	1.2.33	9 years ago
89	* ubuntu/1.2/ubuntu-scope-network, pending/ubuntu-scope-loca... * ubuntu/1.2/ubuntu-scope-network, pending/ubuntu-scope-local-content: allow access to android libraries (LP: #1376430) * ubuntu/ubuntu-{sdk,webapp}: allow read access for thumbnailer icons (LP: #1376436)	Jamie Strandboge	1.2.32	9 years ago
88	* ubuntu/ubuntu-: add owner /{run,dev}/shm/shmfd- rwk (LP:... * ubuntu/ubuntu-: add owner /{run,dev}/shm/shmfd- rwk (LP: #1370218) * ubuntu/microphone: remove shmfd access since it is in the templates now	Jamie Strandboge		9 years ago
87	ubuntu/webview: explicitly deny write access to @{PROC}/[0-9... ubuntu/webview: explicitly deny write access to @{PROC}/[0-9]/oom_adj and @{PROC}/[0-9]/oom_score_adj. This is confirmed as a way to escape application lifecycle (LP: #1260115)	Jamie Strandboge		9 years ago
86	* ubuntu/calendar: add missing rule for org.freedesktop.DBus... * ubuntu/calendar: add missing rule for org.freedesktop.DBus.Introspectable on path /com/canonical/indicator/datetime/AlarmProperties (LP: #1374623) * ubuntu/1.[12]/ubuntu-{sdk,webapp}: remove no longer needed rule for /{,run/}shm/shm/WK2SharedMemory.[0-9]* (LP: #1197060) * ubuntu/microphone: - add temporary write access to /{run,dev}/shm/shmfd-* for QAudioRecorder (LP: #1370218) - explicitly deny read on /dev/ * ubuntu/1.1/webview: allow dbus send to RequestName on org.freedesktop.DBus webapp-container needs corresponding 'bind' call on org.freedesktop.Application, which we block elsewhere. webapp-container shouldn't be doing this under confinement, but we allow this rule in content_exchange, so just allow it to avoid confusion. (LP: #1357371)	Jamie Strandboge		9 years ago

Older »