Bug#886548: libreoffice-common: Try to ship all AppArmor profiles in enforce mode

[Rene Engelhard <rene@debian.org>]

Hi,

On Sun, Jan 07, 2018 at 03:40:55PM +0100, intrigeri@debian.org wrote:
> The remaining blocker seems to be autopkgtests being broken by
> AppArmor, due to using custom paths:

Bascially anything which needs "custom" paths. Another incarnation of
this was https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=884747

> How about this:
> 
> 1. Add the needs-root restriction to debian/tests/control (and
>    possibly the breaks-testbed restriction too if we cannot reliably
>    revert the following changes after running the tests).

And run the tests as root?

> 2. Wrap the test cases with code that modifies the @{libo_user_dirs}
>    AppArmor profile variable to include the place where the test cases
>    will store their custom data directories, and then reloads the
>    affected AppArmor profile.
> 
> Another option is to do (1) but instead of (2), disable the AppArmor
> profiles that break the test suite. It would obviously be cheaper and
> more reliable, and I'd be happy to give it a try (no big hurry
> though). But it won't exercise the AppArmor policy contrary to the
> solution proposed above. But surely it would be a nice first iteration
> until someone feels like implementing the more advanced solution
> proposed above.
> 
> What do you think?

That would probably work, but still cause #884747 (and whatever else still
unreported).

Regards,

Rene