ubuntu-appstore-developers team mailing list archive
-
ubuntu-appstore-developers team
-
Mailing list archive
-
Message #00450
Re: click-desktop, upstart-app-launch-desktop and AppArmor
On Thu, 2013-08-15 at 13:23 -0500, Jamie Strandboge wrote:
> IIRC, the plan all along was to remove the click-desktop hook in favor of the
> upstart-app-launch-desktop. I reviewed upstart-app-launch and it is working well
> ('start application APP_ID=$pkgname_$appname_$version' launches apps under
> confinement (on 3.10 kernels-- patch pending for 3.11). That's great!
Woot!
> One thing that has had me concerned though is that apps are going to be hitting
> the appstore and more than just Unity users should be able to use them. My
> understanding is that flavors and derivatives would either have to create their
> own launcher based on Ted's click-exec or we could be sneaky and start the
> upstart job via the desktop file. That won't work on systems that use an upstart
> user session. I then noticed that both the click-desktop and
> upstart-app-launch-desktop hooks are both on my system, and they both run. The
> application-click upstart job uses click-exec to find the desktop file by using
> 'click pkgdir' and generates its own exec line for use in the click upstart job.
> Meanwhile, the click-desktop hook outputs a desktop file in
> ~/.local/share/applications that uses aa-exec.
>
> Not sure if all this was planned, but if we keep both the click-desktop and
> upstart-app-launch-desktop hooks, then Unity keeps the application lifecycle
> goodness and flavors and derivatives don't need to do anything so long as they
> can handle normal desktop files, and click will work as expected. :)
>
> If we decide to keep both, then we would want to update click-hook to use a
> wrapper around aa-exec to prepare the sandbox environment[1]. Attached is
> aa-exec-click that we could use for this. My thought is that I add aa-exec-click
> to click-apparmor, then click-hook is adjusted to use aa-exec-click instead.
We were trying to avoid having a shell script that everyone went through
to launch applications if possible. I'm not sure if that's a real
requirement, but more of a nice to have, to make it all easier to
understand. So the Exec line that we're creating in the
upstart-app-launch desktop hook does create an Exec line that is
targetted at other desktops. Mine is this for instance:
Exec=aa-exec -p com.ubuntu.calendar_calendar_0.4 -- qmlscene
calendar.qml
I think the big difference there is that we're not setting all the
environment variables the same way. It ends up confined, but we don't
guarantee the sanity of the environment.
I don't think that we need both desktop hooks though. We need to decide
how we want the desktop file exec line to look in the end.
Ted
Attachment:
signature.asc
Description: This is a digitally signed message part
Follow ups
References