Limit /media access to guest owned devices

https://launchpad.net/bugs/882862

diff --git a/data/guest-session.apparmor b/data/guest-session.apparmor
index e652d34aa8b3e52170fd809158ff4d9a6c07535f..cf90d5f1bf740eda871a4b7452203c75c83dbcc4 100644 (file)
--- a/data/guest-session.apparmor
+++ b/data/guest-session.apparmor
@@ -28,8 +28,8 @@ LIBEXECDIR/lightdm-guest-session-wrapper {
   /lib32/** rmixk,
   /lib64/ r,
   /lib64/** rmixk,
-  /media/ r,
-  /media/** rmwlixk,  # we want access to USB sticks and the like
+  owner /media/ r,
+  owner /media/** rmwlixk,  # we want access to USB sticks and the like
   /opt/ r,
   /opt/** rmixk,
   @{PROC}/ r,