On Thu, Jan 07, 2016 at 06:21:23PM -0000, Simon Déziel wrote: > - /run/pulse/ rw, > - /run/pulse/.pulse-cookie rwk, > - /run/pulse/dbus-socket rwk, > - /run/pulse/native rwk, > - /run/pulse/pid rwk, > + owner /run/pulse/ rw, > + owner /run/pulse/.pulse-cookie rwk, > + owner /run/pulse/dbus-socket rwk, > + owner /run/pulse/native rwk, > + owner /run/pulse/pid rwk, > + owner /run/user/[0-9]*/pulse/ rw, > + owner /run/user/[0-9]*/pulse/* rwk, > /run/udev/data/+sound:card* r, > + /run/udev/data/c116:[0-9]* r, >
How does 'owner /run/pulse/' work? Are these paths bind-mounted from per-user paths? Or are these paths when pulse is used as root in some environments? > > owner /var/lib/lightdm/.Xauthority r, > owner /var/lib/lightdm/.esd_auth rwk, > - owner /var/lib/lightdm/.pulse-cookie rwk, > - owner /var/lib/lightdm/.pulse/ rw, > - owner /var/lib/lightdm/.pulse/* w, > - owner /var/lib/lightdm/.pulse/* r, > + owner /var/lib/lightdm/.config/pulse/cookie rwk, > + owner /var/lib/lightdm/.config/pulse/ rw, > + owner /var/lib/lightdm/.config/pulse/* rw, Removing accesses like this may cause problems if the AppArmor profile is replaced before any executing binaries that use the old pathnames. Are these old path names unused for long enough that no executing binaries currently use them? Thanks -- https://code.launchpad.net/~sdeziel/apparmor-profiles/refresh-pulseaudio/+merge/281910 Your team AppArmor Developers is requested to review the proposed merge of lp:~sdeziel/apparmor-profiles/refresh-pulseaudio into lp:apparmor-profiles. -- AppArmor mailing list [email protected] Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/apparmor
