From: Benjamin Barenblat <bbaren@google.com>
Date: Thu, 30 Nov 2023 18:47:03 +0000 (+0100)
Subject: Support tofu+pgp trust model in GnuPG
X-Git-Tag: archive/raspbian/4%7.6.4_rc1-1+rpi1^2~8
X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=7d19411704a53367e94b67e4a283c5675f90a7f7;p=libreoffice.git

Support tofu+pgp trust model in GnuPG

Bug-Debian: https://bugs.debian.org/955271
Forwarded: no

GnuPG supports a trust-on-first-use layer that sits on top of the
standard PGP trust model. If this is enabled, 'gpg --list-keys' needs
write and lock permissions on the TOFU database to return any useful
data. Allow this access through AppArmor.


Gbp-Pq: Name apparmor-gnupg-tofu.diff
---

diff --git a/sysui/desktop/apparmor/program.soffice.bin b/sysui/desktop/apparmor/program.soffice.bin
index a15d83b07f4..2a60f67c284 100644
--- a/sysui/desktop/apparmor/program.soffice.bin
+++ b/sysui/desktop/apparmor/program.soffice.bin
@@ -2,6 +2,7 @@
 #
 #    Copyright (C) 2016 Canonical Ltd.
 #    Copyright (C) 2018 Software in the Public Interest, Inc.
+#    Copyright (C) 2021 Google LLC
 #
 #    This Source Code Form is subject to the terms of the Mozilla Public
 #    License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -223,6 +224,7 @@ profile libreoffice-soffice INSTDIR-program/soffice.bin flags=(complain) {
 
     owner @{HOME}/.gnupg/* r,
     owner @{HOME}/.gnupg/random_seed rk,
+    owner @{HOME}/.gnupg/tofu.db rwk,
   }
 
   # probably should become a subprofile like gpg above, but then it doesn't