Marking bug as Critical because without the workaround rule, webapps
will break when Mir is the default.
** Description changed:
When a webapp is launched via the upstart job, it re-execs itself,
causing an apparmor denial and failure to launch the browser:
First, install the facebook app from the appstore.
Then, from adb shell:
root@ubuntu-phablet:/# sudo -H -u phablet -i
phablet@ubuntu-phablet:~$ start application
APP_ID=com.ubuntu.developer.webapps.webapp-facebook_webapp-facebook_1.0
This results in the following denial in /var/log/syslog:
Sep 20 15:58:17 ubuntu-phablet kernel: [ 6505.474410] type=1400
audit(1379692697.211:80): apparmor="DENIED" operation="exec" parent=1479
profile="com.ubuntu.developer.webapps.webapp-facebook_webapp-facebook_1.0"
name="/usr/bin/webbrowser-app" pid=6248 comm="sh" requested_mask="x"
denied_mask="x" fsuid=32011 ouid=0
Adding the following rule to
/var/lib/apparmor/profiles/click_com.ubuntu.developer.webapps.webapp-facebook_webapp-facebook_1.0:
- /usr/bin/webbrowser-app rmix,
+ /usr/bin/webbrowser-app rmix,
and reloading policy with 'sudo apparmor_parser -r
/var/lib/apparmor/profiles/click_com.ubuntu.developer.webapps.webapp-
facebook_webapp-facebook_1.0' works around the issue.
This is a harmless addition to the ubuntu-webapp template, so I will do
that. However I'm concerned that HTML5/PhoneGap apps that use a webview
may also suffer from this, so it is worth investigating.
+
+ Interestingly, the re-exec only happens when running under upstart-app-
+ launch, not when using aa-exec-click.
** Also affects: upstart-app-launch (Ubuntu)
Importance: Undecided
Status: New
** Description changed:
When a webapp is launched via the upstart job, it re-execs itself,
causing an apparmor denial and failure to launch the browser:
First, install the facebook app from the appstore.
Then, from adb shell:
root@ubuntu-phablet:/# sudo -H -u phablet -i
phablet@ubuntu-phablet:~$ start application
APP_ID=com.ubuntu.developer.webapps.webapp-facebook_webapp-facebook_1.0
This results in the following denial in /var/log/syslog:
Sep 20 15:58:17 ubuntu-phablet kernel: [ 6505.474410] type=1400
audit(1379692697.211:80): apparmor="DENIED" operation="exec" parent=1479
profile="com.ubuntu.developer.webapps.webapp-facebook_webapp-facebook_1.0"
name="/usr/bin/webbrowser-app" pid=6248 comm="sh" requested_mask="x"
denied_mask="x" fsuid=32011 ouid=0
Adding the following rule to
/var/lib/apparmor/profiles/click_com.ubuntu.developer.webapps.webapp-facebook_webapp-facebook_1.0:
/usr/bin/webbrowser-app rmix,
and reloading policy with 'sudo apparmor_parser -r
/var/lib/apparmor/profiles/click_com.ubuntu.developer.webapps.webapp-
facebook_webapp-facebook_1.0' works around the issue.
This is a harmless addition to the ubuntu-webapp template, so I will do
that. However I'm concerned that HTML5/PhoneGap apps that use a webview
- may also suffer from this, so it is worth investigating.
+ may also suffer from this, so it is worth investigating. That said, we
+ do have an rmix rule for qtchooser in the ubuntu-sdk template, so we
+ might be ok there.
Interestingly, the re-exec only happens when running under upstart-app-
launch, not when using aa-exec-click.
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1228236
Title:
webbrowser-app re-execs itself which breaks webapps under application
confinement
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/apparmor-easyprof-ubuntu/+bug/1228236/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
