From 1bc84f3e53f66abf4ee246e89f20f72626a199de Mon Sep 17 00:00:00 2001 From: smitsohu Date: Mon, 26 Mar 2018 18:59:29 +0200 Subject: rework akonadi integration the usr.sbin.mysqld-akonadi apparmor profile, enforced by default in ubuntu and debian testing (and probably opensuse), doesn't play well with a number of firejail options. the reason for this is that once the no_new_privs bit is set, apparmor profile transitions are forbidden. enforcing our own apparmor policy instead is also no solution, because these programs don't even start without d-bus. relaxing the kmail profile was necessary so that kmail can fire up akonadi itself, just in case akonadi has not been started earlier already by another program. this is always an issue when kmail is the only installed akonadi client, but there may be more circumstances. for reasons outlined above this doesn't help debian and ubuntu (opensuse?) users though :-/ a brief summary of the seccomp exceptions: chroot is needed for qt webengine, io_prioset for the akonadi indexing agent, io_getevents, io_submit, io_setup are needed for mysqld. when akonadi has an sqlite3 backend, less exceptions to the seccomp filter are necessary, but mysqld is the default. in the future all kontact suite profiles (itm only kmail, knotes) should probably be redirections to akonadi_control, but the issues with apparmor make this somewhat impractical for now (options like 'protocol' couldn't go to akonadi_control.local any more, if current kmail redirected to there). --- etc/knotes.profile | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'etc/knotes.profile') diff --git a/etc/knotes.profile b/etc/knotes.profile index 091c3a8e5..85b267f8b 100644 --- a/etc/knotes.profile +++ b/etc/knotes.profile @@ -7,7 +7,8 @@ include /etc/firejail/globals.local noblacklist ${HOME}/.config/akonadi* noblacklist ${HOME}/.config/knotesrc -noblacklist ${HOME}/.local/share/akonadi/* +noblacklist ${HOME}/.local/share/akonadi* +noblacklist /tmp/akonadi-* include /etc/firejail/disable-common.inc include /etc/firejail/disable-devel.inc -- cgit v1.2.3-54-g00ecf