interfaces/builtin: remove the name=org.freedesktop.DBus restriction in cups-control AppArmor rules

[jhenstridge]

While testing the CUPS snap, @tillkamppeter noticed that some D-Bus broadcast signals were being blocked by AppArmor.

On closer inspection, the rules related to the org.cups.cupsd.Notifier D-Bus interface all had a restriction like peer=(name=org.freedesktop.DBus,label=...). This seemed weird to me, as that name is reserved for dbus-daemon, and these messages are not being sent to or received from the bus. Removing the name= restriction allowed the messages to be delivered.

I asked @alexmurray for his opinion, and he couldn't think of a reason the name conditional was included here either, so I've submitted this PR to remove it.

In this case, there isn't a different D-Bus name that could be used in the rule. The messages are sent by a short lived notifier plugin process:

https://github.com/OpenPrinting/cups/blob/master/notifier/dbus.c

It does not try to own a name, and the clients watching for the signal broadcasts don't match on a well known bus name either.

[mvo5]

This looks sensible to me

[jhenstridge]

I'll also note that there are other interfaces using this peer=(name=org.freedesktop.DBus,label=...) construct for messages not to/from the bus daemon. It's possible that they aren't behaving as expected either.

[mardy]

Thanks!

[mardy]

I'll also note that there are other interfaces using this peer=(name=org.freedesktop.DBus,label=...) construct for messages not to/from the bus daemon. It's possible that they aren't behaving as expected either.

I had a quick look, and they are all either from Ubuntu Phone obsolete interfaces, or legitimate (because they are about (un)registering D-Bus names or getting the ID of the D-Bus session.

The only exceptions I've found are in the "desktop" interface:

# gmenu
dbus (send)
     bus=session
     interface=org.gtk.Actions
     member=Changed
     peer=(name=org.freedesktop.DBus, label=unconfined),

and similar ones (though not 100% equivalent) in the unity7 interface. I will propose a PR, then we can discuss on it.

[alexmurray]

LGTM, thanks @jhenstridge.

[tillkamppeter]

@jhenstridge @alexmurray @mardy @mvo5 Thanks a lot for your quick fix, verification, and merge!