pool/apparmor
SHA256
2
0
Fork 1
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Accepting request 1178599 from home:cboltz

Browse Source 
- add sddm-xauth.diff - sddm uses a new path for xauth (boo#1223900)
- add plasmashell.diff - fix QtWebEngineProcess path to prevent a
  crash in plasmashell (boo#1225961)

OBS-URL: https://build.opensuse.org/request/show/1178599
OBS-URL: https://build.opensuse.org/package/show/security:apparmor/apparmor?expand=0&rev=415
This commit is contained in:
Christian Boltz 2024-06-04 19:56:31 +00:00 committed by Git OBS Bridge
parent e9f8add613
commit 9312f36a2c
4 changed files with 68 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
apparmor.changes
View File

@ -1,3 +1,10 @@
-------------------------------------------------------------------
Tue Jun 4 19:48:47 UTC 2024 - Christian Boltz <suse-beta@cboltz.de>
- add sddm-xauth.diff - sddm uses a new path for xauth (boo#1223900)
- add plasmashell.diff - fix QtWebEngineProcess path to prevent a
crash in plasmashell (boo#1225961)
-------------------------------------------------------------------
Thu May 30 10:19:32 UTC 2024 - Guillaume GARDET <guillaume.gardet@opensuse.org>

8
apparmor.spec
View File

@ -98,6 +98,12 @@ Patch13: teardown-unconfined.diff
Patch14: utils-relax-mount-rules.diff
Patch15: utils-relax-mount-rules-2.diff
# Fix QtWebEngineProcess path in plasmashell profile (merged upstream 2024-06-04 in 4.0 and master - https://gitlab.com/apparmor/apparmor/-/merge_requests/1248)
Patch16: plasmashell.diff
# latest sddm uses yet another path for xauth (submitted upstream 2024-06-04 https://gitlab.com/apparmor/apparmor/-/merge_requests/1249)
Patch17: sddm-xauth.diff
PreReq: sed
BuildRoot: %{_tmppath}/%{name}-%{version}-build
BuildRequires: autoconf
@ -371,6 +377,8 @@ mv -v profiles/apparmor.d/usr.lib.apache2.mpm-prefork.apache2 profiles/apparmor/
%patch -P 13 -p1
%patch -P 14 -p1
%patch -P 15 -p1
%patch -P 16 -p1
%patch -P 17 -p1
%build
export SUSE_ASNEEDED=0

31
plasmashell.diff Normal file
View File

@ -0,0 +1,31 @@
commit 64469afa2c65eb8a90a19d2b658a9559fb3964b0
Author: Christian Boltz <apparmor@cboltz.de>
Date: Tue Jun 4 21:14:50 2024 +0200
Add openSUSE path to plasmashell profile
While on it,
- add some comments explaining what the profile does
- adjust the rule with the Debian/Ubuntu path to work with Qt6
Fixes: https://bugzilla.opensuse.org/show_bug.cgi?id=1225961
diff --git a/profiles/apparmor.d/plasmashell b/profiles/apparmor.d/plasmashell
index d743ff7a3..51c50a689 100644
--- a/profiles/apparmor.d/plasmashell
+++ b/profiles/apparmor.d/plasmashell
@@ -17,8 +17,13 @@ profile plasmashell /usr/bin/plasmashell {
unix,
ptrace,
- /usr/lib/x86_64-linux-gnu/qt5/libexec/QtWebEngineProcess cx -> &plasmashell//QtWebEngineProcess,
+ # allow executing QtWebEngineProcess with full permissions including userns (using profile stacking to avoid no_new_privs issues)
+ /usr/lib/x86_64-linux-gnu/qt[56]/libexec/QtWebEngineProcess cx -> &plasmashell//QtWebEngineProcess,
+ /usr/libexec/qt[56]/QtWebEngineProcess cx -> &plasmashell//QtWebEngineProcess,
+
+ # allow to execute all other programs under their own profile, or to run unconfined
/** pux,
+
/{,**} mrwlk,
profile QtWebEngineProcess {

22
sddm-xauth.diff Normal file
View File

@ -0,0 +1,22 @@
commit 0c6e031c02fb18affd3bb7f15e269d9dd5c3317a
Author: Christian Boltz <apparmor@cboltz.de>
Date: Tue Jun 4 21:45:06 2024 +0200
abstractions/X: add another xauth path
This time it's /tmp/xauth_?????? r, which gets used by latest sddm.
Fixes: https://bugzilla.opensuse.org/show_bug.cgi?id=1223900
diff --git a/profiles/apparmor.d/abstractions/X b/profiles/apparmor.d/abstractions/X
index 6f0272d64..6df891185 100644
--- a/profiles/apparmor.d/abstractions/X
+++ b/profiles/apparmor.d/abstractions/X
@@ -28,6 +28,7 @@
owner @{run}/user/*/gdm/Xauthority r,
owner @{run}/user/*/X11/Xauthority r,
owner @{run}/user/*/xauth_* r,
+ owner /tmp/xauth_?????? r,
# the unix socket to use to connect to the display
/tmp/.X11-unix/* rw,