From 1bc84f3e53f66abf4ee246e89f20f72626a199de Mon Sep 17 00:00:00 2001 From: smitsohu Date: Mon, 26 Mar 2018 18:59:29 +0200 Subject: rework akonadi integration the usr.sbin.mysqld-akonadi apparmor profile, enforced by default in ubuntu and debian testing (and probably opensuse), doesn't play well with a number of firejail options. the reason for this is that once the no_new_privs bit is set, apparmor profile transitions are forbidden. enforcing our own apparmor policy instead is also no solution, because these programs don't even start without d-bus. relaxing the kmail profile was necessary so that kmail can fire up akonadi itself, just in case akonadi has not been started earlier already by another program. this is always an issue when kmail is the only installed akonadi client, but there may be more circumstances. for reasons outlined above this doesn't help debian and ubuntu (opensuse?) users though :-/ a brief summary of the seccomp exceptions: chroot is needed for qt webengine, io_prioset for the akonadi indexing agent, io_getevents, io_submit, io_setup are needed for mysqld. when akonadi has an sqlite3 backend, less exceptions to the seccomp filter are necessary, but mysqld is the default. in the future all kontact suite profiles (itm only kmail, knotes) should probably be redirections to akonadi_control, but the issues with apparmor make this somewhat impractical for now (options like 'protocol' couldn't go to akonadi_control.local any more, if current kmail redirected to there). --- etc/kmail.profile | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) (limited to 'etc/kmail.profile') diff --git a/etc/kmail.profile b/etc/kmail.profile index 952af55c8..e33eae84f 100644 --- a/etc/kmail.profile +++ b/etc/kmail.profile @@ -5,20 +5,22 @@ include /etc/firejail/kmail.local # Persistent global definitions include /etc/firejail/globals.local -# if akonadi has a mysql backend, starting it inside this sandbox will fail. -# one solution is to have akonadi already running when kmail is launched +# kmail has problems launching akonadi in debian and ubuntu. +# one solution is to have akonadi already running when kmail is started noblacklist ${HOME}/.cache/akonadi* noblacklist ${HOME}/.config/akonadi* noblacklist ${HOME}/.config/baloorc noblacklist ${HOME}/.config/emailidentities noblacklist ${HOME}/.config/kmail2rc -noblacklist ${HOME}/.local/share/akonadi/* +noblacklist ${HOME}/.gnupg +noblacklist ${HOME}/.local/share/akonadi* noblacklist ${HOME}/.local/share/contacts noblacklist ${HOME}/.local/share/emailidentities noblacklist ${HOME}/.local/share/kmail2 noblacklist ${HOME}/.local/share/local-mail -noblacklist ${HOME}/.gnupg +noblacklist ${HOME}/.local/share/notes +noblacklist /tmp/akonadi-* include /etc/firejail/disable-common.inc include /etc/firejail/disable-devel.inc @@ -36,8 +38,8 @@ nosound notv novideo protocol unix,inet,inet6,netlink -# we need to allow chroot and ioprio_set system calls -seccomp.drop @clock,@cpu-emulation,@debug,@module,@obsolete,@raw-io,@reboot,@resources,@swap,acct,add_key,bpf,fanotify_init,io_cancel,io_destroy,io_getevents,io_setup,io_submit,kcmp,keyctl,mount,name_to_handle_at,nfsservctl,ni_syscall,open_by_handle_at,personality,pivot_root,process_vm_readv,ptrace,remap_file_pages,request_key,setdomainname,sethostname,syslog,umount,umount2,userfaultfd,vhangup,vmsplice +# we need to allow chroot, io_getevents, ioprio_set, io_setup, io_submit system calls +seccomp.drop @clock,@cpu-emulation,@debug,@module,@obsolete,@raw-io,@reboot,@resources,@swap,acct,add_key,bpf,fanotify_init,io_cancel,io_destroy,kcmp,keyctl,mount,name_to_handle_at,nfsservctl,ni_syscall,open_by_handle_at,personality,pivot_root,process_vm_readv,ptrace,remap_file_pages,request_key,setdomainname,sethostname,syslog,umount,umount2,userfaultfd,vhangup,vmsplice # tracelog # writable-run-user is needed for signing and encrypting emails writable-run-user -- cgit v1.2.3-54-g00ecf