Skip to content

Abstractions need write access to create/update some common config dirs

Daniel Richard G. requested to merge iskunk/apparmor:drg-mods-1 into master

Inspired by this bug report, I did some testing with the broad-brush homedir permissions (e.g. owner @{HOME}/** w) commented out from abstractions/ubuntu-browsers.d/user-files and abstractions/ubuntu-browsers.d/java. That turned up a few places where existing abstractions were lacking, mainly to allow creating certain directories if they don't already exist, and writing to files therein (e.g. the fontconfig cache directory).

This brings us closer to making possible a user option to allow/disallow broad permissions to the homedir, without everything breaking if such access is disallowed.

(It should probably be a matter of course that the broad permissions in user-files and java be commented out in testing/developing the abstractions, since those permissions can mask oversights in the rules elsewhere.)

Merge request reports