-
apparmor-easyprof-ubuntu (1.1.16) trusty; urgency=medium
* 1.1/webview: update to allow exec of chrome-sandbox now that oxide is
doing a proper fork/exec
-- Jamie Strandboge <email address hidden> Wed, 09 Apr 2014 13:58:10 -0500
-
apparmor-easyprof-ubuntu (1.1.15) trusty; urgency=medium
* 1.*/unconfined: update for ptrace and signal
* 1.1/music_files*: add rules for talking to the media-hub-server and read
access to mediascanner files
* 1.1/video_files*: add rules for talking to the media-hub-server and read
access to mediascanner files
-- Jamie Strandboge <email address hidden> Tue, 08 Apr 2014 07:09:42 -0500
-
apparmor-easyprof-ubuntu (1.1.14) trusty; urgency=medium
* 1.1/webview: update for ptrace and signal mediation (LP: #1298611)
* debian/control: Depends on apparmor >= 2.8.95~2430-0ubuntu4
-- Jamie Strandboge <email address hidden> Thu, 03 Apr 2014 15:19:23 -0500
-
apparmor-easyprof-ubuntu (1.1.13) trusty; urgency=medium
* 1.1/webview (LP: #1301351)
- add 'mr' for chrome-sandbox and oxide-renderer
- allow 'r' for @{PROC}/sys/kernel/yama/ptrace_scope
-- Jamie Strandboge <email address hidden> Wed, 02 Apr 2014 09:11:49 -0500
-
apparmor-easyprof-ubuntu (1.1.12) trusty; urgency=medium
* 1.1/webview: suppress denial for write to /usr/bin/locales/ like we do for
/usr/lib/@{multiarch}/oxide-qt/locales/ already since it is confusing for
people who are diagnosing oxide issues (LP: #1260044)
-- Jamie Strandboge <email address hidden> Mon, 31 Mar 2014 13:14:37 -0500
-
apparmor-easyprof-ubuntu (1.1.11) trusty; urgency=medium
* 1.0/ubuntu-*: explicitly deny access to oxide files so webbrowser-app's
fallback mechanism to QtWebKit works correctly. This is needed so 13.10
framework webapps don't regress
* 1.1/webview: prevent certificate db poisoning and disallow write access to
@{HOME}/.pki/nssdb/*. Note, while this prevents cert attacks, it doesn't
prevent information disclosure so once LP: 1260048 is fixed in oxide, we
can remove the read access.
-- Jamie Strandboge <email address hidden> Fri, 28 Mar 2014 09:57:13 -0500
-
apparmor-easyprof-ubuntu (1.1.10) trusty; urgency=medium
* 1.*/ubuntu-*:
- add read access to /usr/share/unity/icons/**. Why this isn't under
/usr/share/icons/unity instead, I don't know, but the access is
harmless, so allow it. This is currently needed by the gallery
- explicitly deny access to com.canonical.snapdecisions interface
(LP: #1291234)
* 1.*/friends: allow freedesktop.org notifications which is needed by the
gallery app to show that a picture has been uploaded (LP: #1279969)
* debian/control: Build-Depends on apparmor-easyprof since it is needed by
the testsuite. This is needed because dh-apparmor now only Suggests
apparmor-easyprof
-- Jamie Strandboge <email address hidden> Mon, 24 Mar 2014 17:20:42 -0500
-
apparmor-easyprof-ubuntu (1.1.9) trusty; urgency=medium
* adjustments for Qt5.2
- 1.*/networking: like with other NetworkManager access, explicitly deny
connecting to peer=(name=org.freedesktop.NetworkManager)
* 1.1/content_exchange: deny 'w' on ~/.cache/@{APP_PKGNAME}/HubIncoming/**.
The content-hub will create hard links in this directory for volatile
data, but using hard links means the content source file could be modified
by the app. This prevents that. (LP: #1293771)
-- Jamie Strandboge <email address hidden> Mon, 17 Mar 2014 15:04:33 -0500
-
apparmor-easyprof-ubuntu (1.1.8) trusty; urgency=medium
* 1.*/ubuntu-sdk: allow accesses to workaround intel driver crash on X
- allow read of /sys/devices/pci[0-9]*/**/uevent
- allow read of /etc/udev/udev.conf
- explicityly deny /run/udev/data/**, like we do elsewhere
- LP: #1286162
-- Jamie Strandboge <email address hidden> Wed, 05 Mar 2014 12:16:44 -0600
-
apparmor-easyprof-ubuntu (1.1.7) trusty; urgency=medium
* 1.*/ubuntu-sdk: /usr/share/ubuntu-html5-theme moved to
/usr/share/ubuntu-html5-ui-toolkit (LP: #1287297)
-- Jamie Strandboge <email address hidden> Mon, 03 Mar 2014 12:18:22 -0600
-
apparmor-easyprof-ubuntu (1.1.6) trusty; urgency=medium
* add hardware/graphics.d/apparmor-easyprof-ubuntu_flo
* update hardware/graphics.d/apparmor-easyprof-ubuntu_mako: allow read of
/sys/devices/platform/kgsl-3d0.0/kgsl/kgsl-3d0/gpuclk r,
* 1.*/ubuntu-*: add read for /sys/devices/system/cpu/
-- Jamie Strandboge <email address hidden> Sat, 22 Feb 2014 11:22:12 -0600
-
apparmor-easyprof-ubuntu (1.1.5) trusty; urgency=medium
* 1.0/ubuntu-sdk: add read to qtdeclarative5-ubuntu-ui-extras-browser-plugin
for applications that use UbuntuWebview (LP: #1280293)
* 1.1/webview: add read to qtdeclarative5-ubuntu-ui-extras-browser-plugin.
With 1.1 we will use oxide so all applications using UbuntuWebview will
need to specify this policy group, so just add it here rather than
the ubuntu-sdk template
* adjust ubuntu-* templates to allow read to /usr/share/libthai/thbrk.tri
as a temporary fix until the AppArmor fonts abstraction has the real fix
(LP: #1278702)
* 1.1/ubuntu-webapp: explicitly deny noicy read access to /sys/bus/ and
/sys/class/
-- Jamie Strandboge <email address hidden> Tue, 18 Feb 2014 09:00:55 -0600
-
apparmor-easyprof-ubuntu (1.1.4) trusty; urgency=medium
* 1.*/ubuntu-sdk: adjust for ubuntu-html5-app-launcher (LP: #1274640)
- allow reexec for /usr/bin/ubuntu-html5-app-launcher to handle HTML5 apps
launched via upstart-app-launch
- allow read access to /usr/share/ubuntu-html5-app-launcher/**
* 1.*/accounts:
- allow read on @{HOME}/.local/share/accounts/** to dereference click
symlinks for online accounts providers (LP: #1278859)
- add comment about usage of com.nokia.singlesignonui.cookiesForIdentity
* 1.*/networking: finetune DownloadManager DBus access (LP: #1277578)
- explicitly allow safe and explicitly disallow unsafe DownloadManager
APIs
- restrict apps to their own downloads
* 1.*/ubuntu-webapp: allow the webapps access to SignonUi API for retrieving
web cookies for an account (com.nokia.singlesignonui.cookiesForIdentity).
This is being added to the ubuntu-webapp template instead of the accounts
policy group because this API should only be available to the webapp
container and is not needed to use online accounts in general
(LP: #1278934)
-- Jamie Strandboge <email address hidden> Wed, 12 Feb 2014 09:20:58 -0600
-
apparmor-easyprof-ubuntu (1.1.3) trusty; urgency=medium
* 1.1/webview: updates for oxide
* 1.1/ubuntu-sdk: remove workaround policy for LP: #1197056 (cordova webview
applications should not use ~/.local/share)
* 1.*/ubuntu-sdk: all to receive Open on org.freedesktop.Application to
allow UriHandler in the SDK to work with already running apps. Patch
thanks to Ken Vandine.
* implement autopkgtests
- add debian/tests/control
- add debian/tests/install_*
- adjust debian/control for XS-Testsuite
-- Jamie Strandboge <email address hidden> Wed, 05 Feb 2014 16:54:26 -0500
-
apparmor-easyprof-ubuntu (1.1.2) trusty; urgency=medium
* 1.*/ubuntu-* templates: allow ro access to /etc/xdg/QtProject/Sensors.conf
(LP: #1267972)
-- Jamie Strandboge <email address hidden> Fri, 10 Jan 2014 13:39:00 -0600
-
apparmor-easyprof-ubuntu (1.1.1) trusty; urgency=medium
* adjust policy for webapp-container (LP: #1267183)
- 1.0/ubuntu-webapp template adds /usr/bin/webapp-container rmix since
apps can currently only use ubuntu-sdk-13.10 framework
- 1.1/ubuntu-webapp template replaces /usr/bin/webbrowser-app with
/usr/bin/webapp-container since 1.1 policy will only be allowed with
ubuntu-sdk-14.04 framework
-- Jamie Strandboge <email address hidden> Thu, 09 Jan 2014 07:53:56 -0600
-
apparmor-easyprof-ubuntu (1.1.0) trusty; urgency=medium
* no change over last version except the minor version of the packaging
version which I forgot to increment in the last upload
-- Jamie Strandboge <email address hidden> Fri, 20 Dec 2013 14:29:06 -0600
-
apparmor-easyprof-ubuntu (1.0.44) trusty; urgency=low
* add ubuntu/1.1 policy, symlinking to 1.0 for things with no changes
* adjust tests/test-data.py for 1.1 policy
* add webview policy group for oxide
* 1.*/ubuntu-* templates:
- remove old comment about Click packages being installed in /opt
- explicitly deny /run/shm/lttng-ust-* (LP: #1260491)
- also allow /custom/xdg/data/themes (LP: #1261875)
* 1.1/ubuntu-* templates: remove access to /tmp/mir_socket (LP: #1236912)
* add hardware/graphics.d/apparmor-easyprof-ubuntu_goldfish
-- Jamie Strandboge <email address hidden> Fri, 20 Dec 2013 08:13:36 -0600
-
apparmor-easyprof-ubuntu (1.0.43) trusty; urgency=low
* ubuntu-* templates: explicitly disable access to /dev/input/* (with audit)
to ensure they aren't ever accidentally enabled
* accounts: add policy for account change notifications and invoking the
trusted helper (LP: #1245903)
* ubuntu-* templates: also allow rw access to
/sys/devices/virtual/timed_output/vibrator/enable
-- Jamie Strandboge <email address hidden> Thu, 21 Nov 2013 06:15:03 -0600
-
apparmor-easyprof-ubuntu (1.0.42) trusty; urgency=low
* ubuntu-sdk template:
- workaround non-app-specific cordova-ubuntu file accesses (LP: 1197056)
- allow reexec for /usr/bin/cordova-ubuntu* to handle cordova apps
launched via upstart-app-launch (LP: #1244655)
-- Jamie Strandboge <email address hidden> Fri, 25 Oct 2013 15:39:29 -0500
-
apparmor-easyprof-ubuntu (1.0.41) trusty; urgency=low
* ubuntu-* templates:
- allow rw access to /sys/class/timed_output/vibrator/enable
(LP: #1241735)
- comment on how NameHasOwner and GetNameOwner may leak information
* networking: explicitly deny receive messages and signals from network
manager and ofono in addition to send to silence denials for apps and
libraries with too broad AddMatch calls
* hardware/video.d: add hardware specific accesses for mako and maguro
(LP: #1243198)
* hardware/audio.d: add hardware specific accesses for mako
* video:
- include hardware/video.d
- add /dev/ashmem
* audio: add /dev/ashmem
-- Jamie Strandboge <email address hidden> Tue, 22 Oct 2013 07:37:43 -0500
-
apparmor-easyprof-ubuntu (1.0.40) saucy; urgency=low
* unconfined template: updates for terminal app
- due to AF_UNIX use attach_disconnected
- allow mount, remount and umount
-- Jamie Strandboge <email address hidden> Tue, 15 Oct 2013 08:37:54 -0500
