Use read-only for bindfs mounts

diff --git a/data/apparmor/abstractions/lightdm_chromium-browser b/data/apparmor/abstractions/lightdm_chromium-browser
index 9908969318b1f266cb16d7bfd2d822de300e84a6..bc5e11a24c2a4ea99c7e562f7e2b404513cce817 100644 (file)
--- a/data/apparmor/abstractions/lightdm_chromium-browser
+++ b/data/apparmor/abstractions/lightdm_chromium-browser
@@ -62,6 +62,10 @@
     @{PROC}/[0-9]*/statm r,            # sandbox wants these
     @{PROC}/[0-9]*/task/[0-9]*/stat r, # sandbox wants these
 
+    owner @{PROC}/@{pid}/setgroups w,
+    owner @{PROC}/@{pid}/uid_map w,
+    owner @{PROC}/@{pid}/gid_map w,
+
     /selinux/ r,
 
     /usr/lib/chromium-browser/chromium-browser-sandbox ix,

diff --git a/debian/changelog b/debian/changelog
index 640b9b21ef5a028248fba818a8ebfa93baccbca1..36f20f8461cc018ddfb4c4b569e3a84ea13ae262 100644 (file)
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,15 @@
+lightdm (1.17.0-0ubuntu1) UNRELEASED; urgency=medium
+
+  * New upstream release:
+    - ...
+  * Build with multi-arch
+  * debian/patches/xorg-1.17.patch:
+    - Fix xserver-allow-tcp=true option not working with X.org 1.17
+  * data/apparmor/abstractions/lightdm_chromium-browser: cgroups support for
+    guest sessions. (LP: #1504049, LP: #1464958)
+
+ -- Robert Ancell <robert.ancell@canonical.com>  Mon, 12 Oct 2015 14:57:47 +0100
+
 lightdm (1.16.0-0ubuntu1) wily; urgency=medium
 
   * New upstream release:

diff --git a/debian/patches/series b/debian/patches/series
index d3ba2550a2c08550df7ba0b12a73746f218837a5..7f14c0ad7b1f3876637262c0911958e2b663ddaa 100644 (file)
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -1,3 +1,4 @@
 04_language_handling.patch
 05_translate_debian_files.patch
 autologin-session-workaround.patch
+xorg-1.17.patch

diff --git a/debian/patches/xorg-1.17.patch b/debian/patches/xorg-1.17.patch
new file mode 100644 (file)
index 0000000..9f7ecfd
--- /dev/null
+++ b/debian/patches/xorg-1.17.patch
@@ -0,0 +1,26 @@
+Description: The X.org X server 1.17 doesn't listen on TCP by default, we need to pass -listen to enable it
+Author: Robert Ancell <robert.ancell@canonical.com>
+Bug: https://bugs.launchpad.net/bugs/1449282
+
+=== modified file 'src/x-server-local.c'
+Index: 1.16/src/x-server-local.c
+===================================================================
+--- 1.16.orig/src/x-server-local.c
++++ 1.16/src/x-server-local.c
+@@ -477,6 +477,7 @@ x_server_local_start (DisplayServer *dis
+     /* Connect to a remote server using XDMCP */
+     if (server->priv->xdmcp_server != NULL)
+     {
++        g_string_append (command, " -listen tcp");
+         if (server->priv->xdmcp_port != 0)
+             g_string_append_printf (command, " -port %d", server->priv->xdmcp_port);
+         g_string_append_printf (command, " -query %s", server->priv->xdmcp_server);
+@@ -485,6 +486,8 @@ x_server_local_start (DisplayServer *dis
+     }
+     else if (!server->priv->allow_tcp)
+         g_string_append (command, " -nolisten tcp");
++    else
++        g_string_append (command, " -listen tcp");
+ 
+     if (server->priv->vt >= 0)
+         g_string_append_printf (command, " vt%d -novtswitch", server->priv->vt);