Merge lp://staging/~jamesh/thumbnailer/dbus-aa-credentials into lp://staging/thumbnailer/devel
Status: | Merged | ||||
---|---|---|---|---|---|
Approved by: | Michi Henning | ||||
Approved revision: | 223 | ||||
Merged at revision: | 214 | ||||
Proposed branch: | lp://staging/~jamesh/thumbnailer/dbus-aa-credentials | ||||
Merge into: | lp://staging/thumbnailer/devel | ||||
Diff against target: |
526 lines (+324/-7) 11 files modified
CMakeLists.txt (+1/-0) debian/control (+1/-0) src/service/CMakeLists.txt (+8/-2) src/service/bus.xml (+9/-0) src/service/credentialscache.cpp (+179/-0) src/service/credentialscache.h (+81/-0) src/service/dbusinterface.cpp (+16/-3) src/service/dbusinterface.h (+4/-0) src/service/handler.cpp (+21/-1) src/service/handler.h (+3/-0) tests/qml/CMakeLists.txt (+1/-1) |
||||
To merge this branch: | bzr merge lp://staging/~jamesh/thumbnailer/dbus-aa-credentials | ||||
Related bugs: |
|
Reviewer | Review Type | Date Requested | Status |
---|---|---|---|
Michi Henning (community) | Approve | ||
PS Jenkins bot (community) | continuous-integration | Approve | |
Review via email: mp+261824@code.staging.launchpad.net |
Commit message
Track the credentials (user ID, AppArmor label) of clients connecting to the D-Bus service. This is not yet used to make security decisions.
Description of the change
This is the first step of the changing our security policy to rely on aa_query_label().
I've introduced a new step for the request handler to determine the AppArmor security context of the client. At the moment we're only printing it out in a log message, but eventually this information will be pushed down to the ThumbnailRequest where it can be used to make the security decision.
You can test this on the desktop by running thumbnailer-service in one terminal and in another run something like:
aa-exec -p $profile thumbnailer-admin get $filename outdir/
You can get a list of available profiles on the system with "sudo aa-status". When run on the phone, you should see the labels for confined clients.
To avoid excessive GetConnectionCr
PASSED: Continuous integration, rev:220 jenkins. qa.ubuntu. com/job/ thumbnailer- devel-ci/ 269/ jenkins. qa.ubuntu. com/job/ thumbnailer- devel-wily- amd64-ci/ 78 jenkins. qa.ubuntu. com/job/ thumbnailer- devel-wily- armhf-ci/ 78 jenkins. qa.ubuntu. com/job/ thumbnailer- devel-wily- armhf-ci/ 78/artifact/ work/output/ *zip*/output. zip jenkins. qa.ubuntu. com/job/ thumbnailer- devel-wily- i386-ci/ 78
http://
Executed test runs:
SUCCESS: http://
SUCCESS: http://
deb: http://
SUCCESS: http://
Click here to trigger a rebuild: s-jenkins. ubuntu- ci:8080/ job/thumbnailer -devel- ci/269/ rebuild
http://