Accepting request 701733 from home:jsegitz:branches:Printing

- Set AA profile to complain and added fixes for ps2epsi (boo#1134327)

OBS-URL: https://build.opensuse.org/request/show/701733
OBS-URL: https://build.opensuse.org/package/show/Printing/ghostscript?expand=0&rev=113

apparmor_ghostscript

@@ -2,8 +2,10 @@
 
 # this profile is mainly intended to prevent easy exploitation of
 # issues in ghostscript. This is mainly intended as a hardening
-# measure and doesn't alleviate the need for regular updates
-profile ghostscript /usr/bin/{dvipdf,eps2eps,gs,gsbj,gsdj,gsdj500,gslj,gslp,gsnd,ps2ascii,ps2epsi,ps2pdf,ps2pdf12,ps2pdf13,ps2pdf14,ps2pdfwr,ps2ps,ps2ps2} {
+# measure and doesn't alleviate the need for regular updates.
+# Currently this profile is in complain mode since it caused regressions
+# for tumbleweed users
+profile ghostscript /usr/bin/{dvipdf,eps2eps,gs,gsbj,gsdj,gsdj500,gslj,gslp,gsnd,ps2ascii,ps2epsi,ps2pdf,ps2pdf12,ps2pdf13,ps2pdf14,ps2pdfwr,ps2ps,ps2ps2} flags=(complain) {
   #include <abstractions/base>
   #include <abstractions/consoles>
   #include <abstractions/nameservice>
@@ -45,4 +47,15 @@ profile ghostscript /usr/bin/{dvipdf,eps2eps,gs,gsbj,gsdj,gsdj500,gslj,gslp,gsnd
     #include <abstractions/base>
     /usr/bin/dirname mr,
   }
+
+  # for gsbj
+  /usr/bin/date mrix,
+  # for ps2epsi
+  /usr/bin/{gawk,cat,ls,sed,which} mrix,
+  /usr/bin/{mktemp,rm} Cx -> tempdir,
+  profile tempdir {
+    #include <abstractions/base>
+    /usr/bin/{mktemp,rm} mr,
+    owner /tmp/ps2epsi.* rw,
+  }
 }