Update the lightdm AppArmor abstraction to allow the guest session to start when...

diff --git a/data/apparmor/abstractions/lightdm b/data/apparmor/abstractions/lightdm
index d94edc3e74d9d4cde1884bf66bc3754ef9ca4e4c..0052569e21131ef3b1ecd6776f14cfcb173c3912 100644 (file)
--- a/data/apparmor/abstractions/lightdm
+++ b/data/apparmor/abstractions/lightdm
@@ -47,6 +47,8 @@
   owner @{PROC}/** rm,
   # needed for gnome-keyring-daemon
   @{PROC}/*/status r,
+  # needed for bamfdaemon and utilities such as ps and killall
+  @{PROC}/*/stat r,
   /sbin/ r,
   /sbin/** rmixk,
   /sys/ r,
@@ -71,6 +73,12 @@
 
   capability ipc_lock,
 
+  # allow processes in the guest session to signal and ptrace each other
+  signal peer=@{profile_name},
+  ptrace peer=@{profile_name},
+  # needed when logging out of the guest session
+  signal (receive) peer=unconfined,
+
   # silence warnings for stuff that we really don't want to grant
   deny capability dac_override,
   deny capability dac_read_search,

diff --git a/debian/changelog b/debian/changelog
index fa956debc4c24f32f0b9abf8a6b600bb570d23cb..12bd846728cdf3a0d8d94d974836d55dc7cc561d 100644 (file)
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,15 @@
+lightdm (1.9.14-0ubuntu2) trusty; urgency=medium
+
+  * debian/patches/06_guest_signal_and_ptrace_aa_rules.patch: Grant
+    permission for guest session processes to signal and ptrace each
+    other (LP: #1298611)
+  * debian/patches/07_guest_proc_pid_stat_aa_rule.patch: Grant permission for
+    guest session processes to read /proc/<PID>/stat. This prevents AppArmor
+    denial messages caused by bamfdaemon and common utilities such as ps and
+    killall. (LP: #1301625)
+
+ -- Tyler Hicks <tyhicks@canonical.com>  Thu, 03 Apr 2014 02:48:51 -0500
+
 lightdm (1.9.14-0ubuntu1) trusty; urgency=medium
 
   * New upstream release: