[pkg-apparmor] Bug#1153139: transmission: Latest transmission AppArmor policy missing policy for lock file

[Alexandre Rossi]

Control: reassign -1 src:apparmor
Control: affects -1 src:transmission

Hi,

> After updating to 4.1.4, transmission-daemon failed to start with 
> AppArmor in enforce mode due to:
>
> Nov 05 20:20:33 challenger kernel: audit: type=1400 audit(1793928033.400:210): apparmor="DENIED" operation="file_lock" class="file" profile="transmission-daemon" name="/var/lib/transmission-daemon/.config/transmission-daemon/lock" pid=1196139 comm="transmission-da" requested_mask="k" denied_mask="k" fsuid=118 ouid=118
>
> The k mask is missing from the AppArmor profile, with only rw being 
> given to /var/lib/transmission-daemon/.config/**. This lockfile seems to 
> have been introduced in 4.1.4 (though I didn't notice anything in 
> upstream release notes.)

This is:

    Unified launch and delegation between the Qt and GTK clients: If
    either is already running and then you or a browser's mime-type handler
    tries to start the otherto add a new torrent, that
    new torrent will get handed off to the pre-existing session. 
    https://github.com/transmission/transmission/pull/9032

> Adding the appropriate policy to 
> /etc/apparmor.d/local/transmission-daemon resolves the issue:
>
> owner /var/lib/transmission-daemon/.config/transmission-daemon/lock rwk,

This is in src:apparmor

I would suggest the following but did not test (not a apparmor user, yet?):

--- i/profiles/apparmor.d/abstractions/transmission-common
+++ w/profiles/apparmor.d/abstractions/transmission-common
@@ -167,6 +167,7 @@ abi <abi/5.0>,
   owner @{HOME}/.cache/transmission/**  rw,
   owner @{HOME}/.config/transmission/   w,
   owner @{HOME}/.config/transmission/** rw,
+  owner @{HOME}/.config/transmission/lock rwk,

   owner @{HOME}/.config/lxqt/lxqt.conf  r,

diff --git i/profiles/apparmor.d/transmission w/profiles/apparmor.d/transmission
index 1f6d20e..6a1634c 100644
--- i/profiles/apparmor.d/transmission
+++ w/profiles/apparmor.d/transmission
@@ -36,6 +36,7 @@ profile transmission-daemon /usr/bin/transmission-daemon flags=(attach_disconnec
   owner /var/lib/transmission{-daemon,}/.config/ rw,
   owner /var/lib/transmission{-daemon,}/.config/transmission-daemon/ rw,
   owner /var/lib/transmission{-daemon,}/.config/transmission-daemon/** rw,
+  owner /var/lib/transmission{-daemon,}/.config/transmission-daemon/lock rwk,
   owner /var/lib/transmission{-daemon,}/downloads/** rw,
   owner /var/lib/transmission{-daemon,}/info/**      rw,


Thanks, 

Alex