etc/apparmor.d/usr.bin.evince should allow /run/user/*/gvfs-metadata/**

Bug #1344810 reported by Sergio Gelato
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
evince (Ubuntu)
Fix Released
Undecided
Unassigned

Bug Description

/etc/apparmor.d/usr.bin.evince has a line

  @{HOME}/.local/share/gvfs-metadata/** l,

However, it is possible (seen on trusty) for session state files to be stored under /run/user/<uid>/ instead of ~/.local/share/ . Please consider adding
  owner /run/user/*/gvfs-metadata/** l,
to the apparmor profile.

Moreover (but this may be worth discussing and tracking separately) I've seen evince being denied "r" access to gvfs-metadata/home-[[:xdigit:]]+.log . I'm not sure what it needs that access for, but maybe there is a legitimate need?

Tags: apparmor

Related branches

Changed in evince (Ubuntu):
status: New → In Progress
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package evince - 3.10.3-0ubuntu15

---------------
evince (3.10.3-0ubuntu15) utopic; urgency=medium

  * debian/apparmor-profile:
    - allow site-wide dconf. Thanks to Lars Masden. (LP: #1355804)
    - allow read/write to files we own in /media (LP: #1096837)
    - allow read/write to files we own in /run/user/1000/at-spi2-*
      (LP: #1308488)
    - allow 'l' to /run/user/*/gvfs-metadata/** (LP: #1344810)
    - allow read/write of @{HOME}/.cache/dconf/user (LP: #1024605)
  * debian/apparmor-profile.abstraction:
    - allow read of /etc/xdg/lubuntu/applications/defaults.list (LP: #1290157,
      LP: #1299239)
    - allow read of /**.[eE][pP][sS][fFiI23] (LP: #1330430)
 -- Jamie Strandboge <email address hidden> Tue, 12 Aug 2014 14:30:43 -0500

Changed in evince (Ubuntu):
status: In Progress → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.