~ubuntu-branches/ubuntu/wily/apparmor-easyprof-ubuntu/wily : changes

~ubuntu-branches/ubuntu/wily/apparmor-easyprof-ubuntu/wily » Changes from revision 116

From Revision 85 to 66

Rev	Summary	Authors	Tags	Date
85	* ubuntu/ubuntu-{sdk,webapp}: all apps can access the Mir cl... * ubuntu/ubuntu-{sdk,webapp}: all apps can access the Mir clipboard (LP: #1372579). Note, LP: 1371170 will be fixed in a future update * ubuntu/push-notification-client: explit deny (with auditing) for access to the Mir clipboard (background apps should not have access) * ubuntu/ubuntu-scope-network: explicit deny (with auditing) for access to the Mir clipboard (scopes should not have access) * pending/ubuntu-scope-local-content: bring up to date with changes to ubuntu-scope-network	Jamie Strandboge		9 years ago
84	ubuntu/{audio,video}: allow mediascanner to send us signals ubuntu/{audio,video}: allow mediascanner to send us signals	Jamie Strandboge		9 years ago
83	ubuntu/location: don't filter receive on interface (allows P... ubuntu/location: don't filter receive on interface (allows PropertyChanged on org.freedesktop.DBus.Properties but also helps future proof)	Jamie Strandboge		9 years ago
82	* ubuntu/camera: allow DBus communications with media-hub (L... * ubuntu/camera: allow DBus communications with media-hub (LP: #1369512) * ubuntu/*: drop redundnat 'ptrace (read) peer=@{profile_name}' since we include it in the base abstraction now	Jamie Strandboge		9 years ago
81	* ubuntu-scope-network: * ubuntu-scope-network: - don't needlessly escape '-' in zmq access rule - silence @{PROC}/[0-9]/attr/current denial since the scopes runner uses aa_getcon() and the denial is noisy (LP: #1367264) ubuntu-webapp: explicitly deny noisy denial to dbus bind on org.freedesktop.Application * debian/apparmor-easyprof-ubuntu.postinst: update the cached .md5sums file on upgrade to avoid running on install and then again on first boot after upgrade. This change only affects apt upgrades and not system-image upgrades since system-image upgrades always use the existing .md5sums if they exist (see /etc/system-image/writable-paths).	Jamie Strandboge		9 years ago
80	* Updates for abstract and anonymous socket mediation (LP: #... * Updates for abstract and anonymous socket mediation (LP: #1362199): - ubuntu//ubuntu-: + use dbus-strict and dbus-session-strict abstractions and remove duplicated policy + allow ubuntu-sdk and ubuntu-webapp connect, receive and send on the maliit abstract socket + allow write access to owner /{,var/}run/user//@{APP_PKGNAME}/{,} - ubuntu//unconfined: allow unix - ubuntu/webview: + allow oxide to talk to sandbox via unix sockets + allow sandbox to talk to @{APP_PKGNAME}_@{APP_APPNAME}_@{APP_VERSION} peer + allow various unix perms from base abstract for the sandbox to use unix sockets - debian/control: Depends on apparmor >= 2.8.96~2541-0ubuntu4 * ubuntu/webview: use @{APP_PKGNAME}_@{APP_APPNAME}_@{APP_VERSION} for signal now that we have @{APP_APPNAME} available (LP: #1363112) * ubuntu/debug: 'audit deny @{HOME}/.local/share/ r' which is used by the SDK to see if confined * debian/control: Depends on apparmor >= 2.8.96~2541-0ubuntu4~	Jamie Strandboge		9 years ago
79	* ubuntu/1.2/accounts: online accounts now has Mir trusted s... * ubuntu/1.2/accounts: online accounts now has Mir trusted session support so move accounts policy group to reserved (LP: #1230091) * ubuntu/1.2/ubuntu-scope-network, pending/ubuntu-scope-local-content: - add DBus session and system accesses to scope templates like we have in the app templates. This allows scopes to talk to trusted helpers like online accounts and location-service. Actual communication with the services is still controlled by the respective policy groups. - add scope-specific access to /run/user/[0-9]/scopes/leaf-{net,fs}/ * ubuntu/1.2/ubuntu-scope-network, pending/ubuntu-scope-local-content: adjust path to settings, it was renamed to settings.ini (LP: #1356930) * ubuntu/1.2/ubuntu-scope-network, pending/ubuntu-scope-local-content: - allow rk access to scope specific settings.db - explicitly noisy deny rw access to unconfined directory * ubuntu/: explicitly deny 'w' access to /dev/xLog (LP: #1352432) ubuntu/1.2/connectivity: update to use upcoming connectivity DBus API (LP: #1341548) * ubuntu/1.[12]/contacts: remove workaround policy since address-book-app no longer uses the telepathy API (LP: #1227818) * ubuntu/: explicitly deny rw access to /dev/fb0. It is both dangerous and noisy with the camera app ubuntu/ubuntu-webapp: receive application-specific Open on org.freedesktop.Application to allow url-dispatcher working with already running webapps (LP: #1342129) * ubuntu/*: explicitly deny noisy access to @{PROC}/xlog (LP: #1352432)	Jamie Strandboge		9 years ago
78	ubuntu/camera: update to allow write access to the finalized... ubuntu/camera: update to allow write access to the finalized path for the microphone socket (/dev/socket/micshm) (ref. LP: 1337582)	Jamie Strandboge	1.2.14	9 years ago
77	* ubuntu/1.2/ubuntu-scope-network: allow 'w' for leaf-net/@{... * ubuntu/1.2/ubuntu-scope-network: allow 'w' for leaf-net/@{APP_PKGNAME}/ * pending/ubuntu-scope-local-content: - add 'w' for leaf-fs/@{APP_PKGNAME}/ - add missing fix for LP: 1347177 (LP: #1348210) * include openssl abstraction in templates instead of in the networking policy group. This is needed due to changes in newer curl and gnutls28 (LP: #1350152)	Jamie Strandboge	1.2.13	9 years ago
76	ubuntu/1.2/ubuntu-scope-network: allow rw on zmq/-r reply e... ubuntu/1.2/ubuntu-scope-network: allow rw on zmq/-r reply endpoints. The scopes-api has protections for malformed or non-UUID-matching replies, so use a glob here to allow aggregating scopes to work. (LP: #1347177)	Jamie Strandboge	1.2.12	9 years ago
75	add data/hardware/graphics.d/apparmor-easyprof-ubuntu_hammer... add data/hardware/graphics.d/apparmor-easyprof-ubuntu_hammerhead in support of Nexus 5 devices	Jamie Strandboge	1.2.11	9 years ago
74	* remove ubuntu/1.2/friends policy group and adjust autopack... * remove ubuntu/1.2/friends policy group and adjust autopackagetest accordingly (LP: #1340869) * ubuntu/calendar: com.canonical.indicator.datetime.AlarmProperties should also be allowed on the org.freedesktop.DBus.Properties interface (LP: #1342708)	Jamie Strandboge	1.2.10	9 years ago
73	* ubuntu/webview: * ubuntu/webview: - adjust to allow oxide_render access to WebCore databases (LP: #1339724) - adjust for updated path for QML web plugin (LP: #1339777) * ubuntu/1.2: add new push-notification-client policy group * ubuntu/ubuntu-{sdk,webapp}: adjust for updated path for QML web plugin * ubuntu/audio: allow read access for /usr/share/sounds and /custom/usr/share/sounds (LP: #1340326) * ubuntu/audio: allow write access to /android/micshm (LP: #1337582)	Jamie Strandboge	1.2.9	9 years ago
72	* ubuntu//calendar: com.canonical.indicator.datetime.AlarmP... ubuntu//calendar: com.canonical.indicator.datetime.AlarmProperties should be allowed to confined apps ubuntu/ubuntu-scope-network (and pending ubuntu-scope-local-content): - allow exec of scoperunner for .so scopes - remove unused policy for .so files (the scope click hook creates symlinks to the click install directory instead)	Jamie Strandboge	1.2.8	9 years ago
71	* update for usensors (LP: #1334701) * update for usensors (LP: #1334701) - ubuntu/*/ubuntu-sdk, ubuntu-webapp: update for haptic feedback - ubuntu/1.2/sensors: + remove /dev/binder + add access to all of usensors DBus API	Jamie Strandboge	1.2.7	9 years ago
70	* ubuntu//ubuntu-sdk, ubuntu-webapp: ubuntu//ubuntu-sdk, ubuntu-webapp: - allow read access to /custom/usr/share/fonts/{,*} - allow read access to /custom/xdg/data/themes/ - group /custom rules together	Jamie Strandboge	1.2.6	9 years ago
69	* ubuntu/ubuntu-scope-network (and pending ubuntu-scope-loca... * ubuntu/ubuntu-scope-network (and pending ubuntu-scope-local-content): adjust to use @{APP_PKGNAME}_@{APP_APPNAME}* for zmq endpoints * tests/test-data.py: updates for new click-apparmor variables which are now needed since easyprof now more carefully verifies the policy	Jamie Strandboge	1.2.5	9 years ago
68	* ubuntu/1.2: refinements to scopes policy * ubuntu/1.2: refinements to scopes policy - use private-files-strict abstraction - finetune client endpoint policy - explicitly deny access to the zmq directory for the ubuntu-sdk and ubuntu-webapp templates - explicitly deny direct interaction with URL dispatcher to prevent data leaks - move ubuntu-scope-local-content template to 'pending' since there are unresolved issues surrounding its interaction with URL dispatcher. Adjust autopkgtests accordingly * ubuntu/calendar: update for upcoming calendar management landing * ubuntu//audio,video: add mediascanner2 DBus access (LP: #1303962) ubuntu/1.[12]/music_files_read: remove temporary access to @{HOME}/.cache/mediascanner/ now that we have policy for mediascanner2 DBus access. Note: normally this would require the change in only the latest policy, but this policy group has only been used by the music-app and it is still unconfined * ubuntu/1.1: also ship debug policy group for 1.1 policy and update autopkgtests for this (LP: #1323233)	Jamie Strandboge	1.2.4	10 years ago
67	fix autopkgtests for new templates and policy group fix autopkgtests for new templates and policy group	Jamie Strandboge	1.2.3	10 years ago
66	* ubuntu/1.2: * ubuntu/1.2: - add ubuntu-scope-network template - add ubuntu-scope-local-content template - add debug policy group (LP: #1323233) * ubuntu/1.[12]: add ptrace read to @{profile_name}	Jamie Strandboge	1.2.2	10 years ago