Hi Jamie, so, there are two pieces that the accounts policy group should allow: 1) Access the signond dbus interfaces and socket (correctly done by the policy you pasted in comment #3) 2) Allow access to the accounts DB, as in https://wiki.ubuntu.com/SecurityTeam/Specifications/ApplicationConfinement#Ubuntu_Online_Accounts
The accounts DB is a sqlite file containing the list of the accounts, what services are enabled/disabled, and maybe some settings. It does not contain passwords or authentication tokens. It might contain usernames, but we agreed that we have to live with that, because usernames are going to be shown in the UIs in order to differentiate the accounts. -- You received this bug notification because you are a member of Desktop Packages, which is subscribed to signon in Ubuntu. https://bugs.launchpad.net/bugs/1220552 Title: App Armor denies access, despite appropriate security policy groups in manifest Status in “apparmor-easyprof-ubuntu” package in Ubuntu: Incomplete Status in “signon” package in Ubuntu: Confirmed Status in “apparmor-easyprof-ubuntu” source package in Saucy: Incomplete Status in “signon” source package in Saucy: Confirmed Bug description: My application does not play audio or have access to Online Accounts when run under app armor on a N4. Everything works fine if I qmlscene the file located in /opt directly. My manifest has networking, audio, and accounts. System Log: Sep 4 07:07:09 ubuntu-phablet kernel: [30790.164043] type=1400 audit(1378278429.378:2806): apparmor="DENIED" operation="open" parent=716 profile="com.wellsb.blackjack-app_blackjack-app_0.0.1" name="/home/phablet/.gstreamer-0.10/registry.arm.bin" pid=24322 comm="qmlscene" requested_mask="r" denied_mask="r" fsuid=32011 ouid=32011 Sep 4 07:07:09 ubuntu-phablet kernel: [30790.164195] type=1400 audit(1378278429.378:2807): apparmor="DENIED" operation="open" parent=716 profile="com.wellsb.blackjack-app_blackjack-app_0.0.1" name="/home/phablet/.gstreamer-0.10/registry.arm.bin" pid=24322 comm="qmlscene" requested_mask="r" denied_mask="r" fsuid=32011 ouid=32011 Sep 4 07:07:10 ubuntu-phablet kernel: [30791.353025] type=1400 audit(1378278430.559:2808): apparmor="DENIED" operation="mknod" parent=716 profile="com.wellsb.blackjack-app_blackjack-app_0.0.1" name="/home/phablet/.gstreamer-0.10/registry.arm.bin.tmpIL852W" pid=24322 comm="qmlscene" requested_mask="c" denied_mask="c" fsuid=32011 ouid=32011 Sep 4 07:07:10 ubuntu-phablet kernel: [30791.353208] type=1400 audit(1378278430.559:2809): apparmor="DENIED" operation="mknod" parent=716 profile="com.wellsb.blackjack-app_blackjack-app_0.0.1" name="/home/phablet/.gstreamer-0.10/registry.arm.bin.tmpC6652W" pid=24322 comm="qmlscene" requested_mask="c" denied_mask="c" fsuid=32011 ouid=32011 Sep 4 07:07:11 ubuntu-phablet kernel: [30791.811075] type=1400 audit(1378278431.009:2810): apparmor="DENIED" operation="open" parent=716 profile="com.wellsb.blackjack-app_blackjack-app_0.0.1" name="/home/phablet/.config/libaccounts-glib/accounts.db" pid=24322 comm="qmlscene" requested_mask="rwc" denied_mask="rwc" fsuid=32011 ouid=32011 Sep 4 07:07:11 ubuntu-phablet kernel: [30791.811136] type=1400 audit(1378278431.009:2811): apparmor="DENIED" operation="open" parent=716 profile="com.wellsb.blackjack-app_blackjack-app_0.0.1" name="/home/phablet/.config/libaccounts-glib/accounts.db" pid=24322 comm="qmlscene" requested_mask="r" denied_mask="r" fsuid=32011 ouid=32011 Sep 4 07:07:11 ubuntu-phablet kernel: [30791.845685] type=1400 audit(1378278431.049:2812): apparmor="DENIED" operation="open" parent=716 profile="com.wellsb.blackjack-app_blackjack-app_0.0.1" name="/run/shm/" pid=24322 comm="qmlscene" requested_mask="r" denied_mask="r" fsuid=32011 ouid=0 Sep 4 07:07:11 ubuntu-phablet kernel: [30791.846387] type=1400 audit(1378278431.049:2813): apparmor="DENIED" operation="open" parent=716 profile="com.wellsb.blackjack-app_blackjack-app_0.0.1" name="/run/shm/" pid=24322 comm="qmlscene" requested_mask="r" denied_mask="r" fsuid=32011 ouid=0 Sep 4 07:07:11 ubuntu-phablet kernel: [30791.847119] type=1400 audit(1378278431.049:2814): apparmor="DENIED" operation="chown" parent=716 profile="com.wellsb.blackjack-app_blackjack-app_0.0.1" name="/run/user/32011/pulse/" pid=24322 comm="qmlscene" requested_mask="w" denied_mask="w" fsuid=32011 ouid=32011 Sep 4 07:07:11 ubuntu-phablet kernel: [30791.847180] type=1400 audit(1378278431.049:2815): apparmor="DENIED" operation="rmdir" parent=716 profile="com.wellsb.blackjack-app_blackjack-app_0.0.1" name="/run/user/32011/pulse/" pid=24322 comm="qmlscene" requested_mask="d" denied_mask="d" fsuid=32011 ouid=32011 To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/apparmor-easyprof-ubuntu/+bug/1220552/+subscriptions -- Mailing list: https://launchpad.net/~desktop-packages Post to : [email protected] Unsubscribe : https://launchpad.net/~desktop-packages More help : https://help.launchpad.net/ListHelp
