File: apparmor-gnupg-tofu.diff

package info (click to toggle)
libreoffice 4%3A7.4.7-1%2Bdeb12u9
  • links: PTS, VCS
  • area: main
  • in suites: bookworm
  • size: 3,601,024 kB
  • sloc: cpp: 4,235,177; xml: 385,692; java: 273,650; python: 72,159; ansic: 36,750; perl: 31,520; javascript: 18,215; sh: 11,445; yacc: 10,839; makefile: 9,490; cs: 6,703; objc: 1,969; lex: 1,885; asm: 1,047; awk: 1,018; pascal: 940; php: 79; csh: 20; sed: 5
file content (28 lines) | stat: -rw-r--r-- 1,075 bytes parent folder | download | duplicates (7) 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
 
From: Benjamin Barenblat <bbaren@google.com>
Subject: Support tofu+pgp trust model in GnuPG
Bug-Debian: https://bugs.debian.org/955271
Forwarded: no

GnuPG supports a trust-on-first-use layer that sits on top of the
standard PGP trust model. If this is enabled, 'gpg --list-keys' needs
write and lock permissions on the TOFU database to return any useful
data. Allow this access through AppArmor.

--- libreoffice-7.1.2.2/sysui/desktop/apparmor/program.soffice.bin
+++ libreoffice-7.1.2.2/sysui/desktop/apparmor/program.soffice.bin
@@ -2,6 +2,7 @@
 #
 #    Copyright (C) 2016 Canonical Ltd.
 #    Copyright (C) 2018 Software in the Public Interest, Inc.
+#    Copyright (C) 2021 Google LLC
 #
 #    This Source Code Form is subject to the terms of the Mozilla Public
 #    License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -215,6 +216,7 @@   profile gpg {
 
     owner @{HOME}/.gnupg/* r,
     owner @{HOME}/.gnupg/random_seed rk,
+    owner @{HOME}/.gnupg/tofu.db rwk,
   }
 
   # probably should become a subprofile like gpg above, but then it doesn't