Apply debian/patches/06_apparmor-unix.patch, make note that this requires Apparmor 2.9

2 files changed, 25 insertions, 0 deletions

diff --git a/data/apparmor/abstractions/lightdm b/data/apparmor/abstractions/lightdm
index 42341e0a..17e32e22 100644
--- a/data/apparmor/abstractions/lightdm
+++ b/data/apparmor/abstractions/lightdm
@@ -7,6 +7,8 @@
 # confinement for the various lightdm sessions (guest, freerdp, uccsconfigure,
 # etc). Note that this profile intentionally omits chromium-browser.
 
+# Requires apparmor 2.9
+
   #include <abstractions/authentication>
   #include <abstractions/cups-client>
   #include <abstractions/dbus>
@@ -84,6 +86,20 @@
   # needed when logging out of the guest session
   signal (receive) peer=unconfined,
 
+  unix peer=(label=@{profile_name}),
+  unix (receive) peer=(label=unconfined),
+  unix (create),
+  unix (getattr, getopt, setopt, shutdown),
+  unix (bind, listen) type=stream addr="@/com/ubuntu/upstart-session/**",
+  unix (bind, listen) type=stream addr="@/tmp/dbus-*",
+  unix (bind, listen) type=stream addr="@/tmp/.ICE-unix/[0-9]*",
+  unix (bind, listen) type=stream addr="@/dbus-vfs-daemon/*",
+  unix (bind, listen) type=stream addr="@guest*",
+  unix (connect, receive, send) type=stream peer=(addr="@/tmp/dbus-*"),
+  unix (connect, receive, send) type=stream peer=(addr="@/tmp/.X11-unix/X[0-9]*"),
+  unix (connect, receive, send) type=stream peer=(addr="@/dbus-vfs-daemon/*"),
+  unix (connect, receive, send) type=stream peer=(addr="@guest*"),
+
   # silence warnings for stuff that we really don't want to grant
   deny capability dac_override,
   deny capability dac_read_search,
diff --git a/data/apparmor/abstractions/lightdm_chromium-browser b/data/apparmor/abstractions/lightdm_chromium-browser
index 9f3671bd..99089693 100644
--- a/data/apparmor/abstractions/lightdm_chromium-browser
+++ b/data/apparmor/abstractions/lightdm_chromium-browser
@@ -8,6 +8,8 @@
 # provided in abstractions/lightdm, this abstraction must be separate from
 # abstractions/lightdm.
 
+# Requires apparmor 2.9
+
   /usr/lib/chromium-browser/chromium-browser Cx -> chromium,
   /usr/bin/webapp-container Cx -> chromium,
   /usr/bin/webbrowser-app Cx -> chromium,
@@ -23,6 +25,9 @@
   # Allow receiving and sending signals to processes in the chromium child profile
   signal (receive, send) peer=/usr/lib/lightdm/lightdm-guest-session//chromium,
 
+  # Allow communications with chromium child profile via unix sockets
+  unix peer=(label=/usr/lib/lightdm/lightdm-guest-session//chromium),
+
   profile chromium {
     # Allow all the same accesses as other applications in the guest session
     #include <abstractions/lightdm>
@@ -48,6 +53,10 @@
     # lightdm-guest-session
     signal (receive, send) set=("exists") peer=/usr/lib/lightdm/lightdm-guest-session,
 
+    # Allow us to receive and send on unix sockets from processes in the
+    # lightdm-guest-session
+    unix (receive, send) peer=(label=/usr/lib/lightdm/lightdm-guest-session),
+
     @{PROC}/[0-9]*/ r,                 # sandbox wants these
     @{PROC}/[0-9]*/fd/ r,              # sandbox wants these
     @{PROC}/[0-9]*/statm r,            # sandbox wants these