=== alex3f is now known as alex3f|kss [03:36] Bonjour === tkamppeter_ is now known as tkamppeter [06:42] pitti, hi [06:42] hey tkamppeter [06:44] pitti, thank you for your mail. I am trying to make your example a separate program now, but it seems that the added "import sys" breaks the PackageKit stuff. [06:44] uh, how? [06:44] "import sys" should be absolutely harmless [06:45] pitti, this is the program: http://paste.ubuntu.com/1162166/ [06:46] how do you call it and how does it fail? [06:46] pitti, and this is what happens: http://paste.ubuntu.com/1162169/ [06:49] erk, DOS line endings [06:50] pitti, where? [06:50] (no worries, presumably just fallout from the pastebin download) [06:50] tkamppeter: hm, this script works fine here [06:51] with the same command as you have [06:52] tkamppeter: does the key appear in "apt-key list"? [06:52] it seems it already failed at this stage [06:52] pitti, for m,e this script does not work as shown, your original script works, and your original script with only "import sys" added at the beginning shows the same problem. I am on Quantal. [06:53] if "import sys" is the only difference, this sounds like a red herring [06:53] perhaps it sometimes works and sometimes not, depending on your configured GPG server? [06:53] pitti, the key appears. [06:54] tkamppeter: if you run the script again, how far does it get? [06:54] exact same output, or slightly different? [06:55] pitti, now the original script also shows the problem, without "import sys". [06:57] oh [06:57] perhaps it fails if the key is already present? [06:59] pitti, I have already done more than one successful run with the same key. [06:59] pitti, you have tested my script, can you run it again? [07:00] yes, I do; works fine here [07:01] I ran it four times up to after enabling the repo (which is further than it got for you) [07:02] tkamppeter: your pastebin, is that the full output, or only the tail? [07:03] oh, hang on, I have another idea [07:03] pitti, my pastebin is the full output. [07:03] tkamppeter: I think the problem is in the progress() callback when it tries to display progress.props.package_id [07:04] tkamppeter: if you drop this part from progress(), does it work? 'package:', progress.props.package_id, [07:05] pitti, I added "return" as the first line of progress() now (not showing progress info at all) and the problem still persists. [07:06] tkamppeter: do you have "packagekit" installed? [07:06] tkamppeter: I don't, I'm using python3-aptdaemon.pkcompat, which we install by default [07:07] tkamppeter: (we do not really support the real packagekit) [07:07] that might explain the difference, there might be a bug in this part of PackageKit [07:11] pitti, here is what I have installed: http://pastebin.ubuntu.com/1162192/ [07:12] tkamppeter: ah, that explains it; so, we might fix this bug in PK, but it's not time critical; please install python3-aptdaemon.pkcompat (this will remove packagekit) [07:12] this might also explain some failures that you got with codec installs [07:13] we only test our stuff with aptdaemon usually [07:19] pitti, now it works again. thanks. But now a new problem occurs: I have run the script two times in a row, entering the password in both runs, and on the second run (with the package already installed) I get a segfault. It should fail gracefully then. [07:21] uh, a segfault sounds bad -- this is all python [07:21] but yes, this is by no means a finished script -- it does not do any such checks [07:26] pitti, it seems that the library function to handle failure has a bug here, and as failure cannot only happen by duplicate installation this would be a stopper for this method. [07:30] I ran it wice with picsaw, I can reproduce the bug [07:30] pitti, I tried another failure, trying to load a non-existing package, it does not give a segfault, but a traceback, so failures without triggereing apport are not possible with this script. [07:30] well, the latter is no problem, the script can try: / exec GLib.GError: [07:30] at the moment it does not do any error checking [07:31] (process:21062): PackageKit-WARNING **: couldn't parse execption 'GDBus.Error:org.debian.apt.TransactionFailed: error-package-already-installed: Package picsaw is already installed', please report [07:31] pitti, so the segfault is the only thing preventing from using this method. [07:32] tkamppeter: I agree it should be fixed; but the script can check at the beginning if the package is already installed [07:33] you can also skip the "add repo" and "install repo key" steps if the package already resolves [07:34] * pitti adds a few tweaks to the script, hang on [07:34] tkamppeter: ^ give me 5 minutes to add some checks [07:40] pitti: hi! about https://bugzilla.gnome.org/show_bug.cgi?id=434924 , are you confident enough to get this in 3.6? [07:40] Gnome bug 434924 in gobject "Add signal helper" [Enhancement,Assigned] [07:41] fredp: it's well testcase'd and does not affect existing API; but as it's an API addition it formally falls under feature and API freeze [07:41] and it's not really urgent, so I didn't start bothering the release team about it yet [07:42] pitti: Simon did :) it's still early in the freeze, I'll give it my +1, and I'm confident another one will be given. [07:42] fredp: ah, thanks! [07:43] hey desktopers [07:43] hey pitti, fredp [07:43] bonjour seb128, ça va? [07:44] 'lut seb128 [07:46] pitti, ca va, un peu fatigué [07:46] will be glad once the ff madness is over [07:46] heh [07:46] tkamppeter: there: http://people.canonical.com/~pitti/tmp/install-printerdriver [07:46] tkamppeter: this skips key/repo installation if the package is already available, and also skips installation if the package is installed [07:51] pitti, works great, thanks. [08:37] hi guys [08:38] maybe somebody of you can comment on http://benjaminkerensa.com/2012/08/23/canonical-privacy-policy-for-zeitgeist-is-insufficient? [08:38] just so this doesn't turn into a flamefest or complainfest [08:41] dholbach, not really [08:41] dholbach, hey btw [08:41] dholbach, can you ping ev,mpt on #ubuntu-devel? that "send to canonical" is part of the whoopsie work [08:41] dholbach, it's not something desktop is working, ev is dealing with that [08:42] *working on [08:43] seb128, thanks muchly [08:44] dholbach, yw [08:45] there's nothing like a bit of drama in the morning [08:46] dholbach, is that your equivalent of reading people magasins? :p [08:47] dholbach, like closer or whatever are famous (I mostly know the name of the french ones (gala, voici, ...) [08:48] yeah, my grandma loves those - especially the stories about princes and princesses - I guess everybody gets their dose of drama elsewhere :) [08:48] ;-) [09:11] I was wondering: what is keeping back gdm to 3.0 even in quantal? [09:19] xclaesse, ricotz and jbicha didn't get the gsettings version to work properly, and most of the team focus on lightdm and nobody else stepped to work on gdm [09:29] seb128, ok fair enough :) === MacSlow is now known as MacSlow|lunch [10:35] hi [10:35] does aptdaemon now implement the full PackageKit dbus interfaces (session and system)? [10:51] rodrigo_: mostly, yes; we have had the session one for quite a while (sesssioninstaller) [10:51] rodrigo_: and during quantal I did some work on the system one [10:51] for adding keys, repos, and the like (installing packages has worked for a while) [10:53] pitti, perfect, that's what I need :) [11:21] https://bugs.launchpad.net/ubuntu/+source/light-themes/+bug/733233/comments/35 [11:21] Ubuntu bug 733233 in light-themes "Increase shadow area to 45 pixels (but not grip area)" [Undecided,Fix released] [11:22] Any plans to implement this for Quantal now that Unity2d is not around anymore? [11:24] seb128, ^ [11:24] dunno, ask smspillaz or Cimi [11:25] Ok, thanks! === dholbach_ is now known as dholbach === MacSlow|lunch is now known as MacSlow [12:06] pitti, all is working now, the only thing which does not work is listing the newly added files of the package installation. PackageKit has a function for it but it simply does not work. Perhaps I am the first one trying to use it. [12:10] huh, the latest eds libraries don't contain a .gnu_debuglink section [12:10] that's meant to contain the filename for the debug symbols [12:11] i just noticed it because it breaks my breakpad symbols builder job [12:11] cyphermox_ ^^ [12:12] it also prevents gdb from automatically loading the symbols [12:12] tkamppeter: we can still add that to aptdaemon if required [12:15] pitti, so it does not work because it is not implemented in aptdaemon? I need it, as this allows prioritizing the PPDs of the freshly installed package when setting up the printer. Please implement it in aptdaemon. [12:16] tkamppeter: can you please file a bug for it against aptdaemon and assign it to me? [12:16] tkamppeter: with some infos which method you called, etc. [12:18] tkamppeter: the get_files() call is implemented and supposed to work [12:21] pitti, bug 1040619 [12:21] Launchpad bug 1040619 in cups "aptdaemon does not support listing the files of a package" [High,New] https://launchpad.net/bugs/1040619 [12:24] thanks, will look at it ASAP [12:45] mvo: I'd like to do another aptdaemon uplaod now to fix this ^, any reservations? [12:45] tkamppeter: fixed in trunk [12:46] pitti: not from me, I plan to work on a whitelist feature today but that will probably take a couple of hours before its ready [12:46] pitti: there is one branch pending though [12:46] pitti: that would be nice to get a review for [12:46] pitti: lp:~mvo/aptdaemon/support-change-credentials-on-add-repo and the one from steve, but I can look at the later too [12:46] well, it's not urgent from my side, not sure how urgent it is to tkamppeter [12:46] tkamppeter: you can also apply the patch locally for now [12:47] just apply the pkcompat.py part in http://bazaar.launchpad.net/~aptdaemon-developers/aptdaemon/main/revision/853 to your /usr/lib/python3/dist-packages/aptdaemon/pkcompat.py [12:47] tkamppeter: ^ with this you can go ahead immediately without being blocked on an upload or package build, etc. [12:47] mvo: ^ I guess that's even faster :) [13:02] fantastic. the eds binaries from a local build are correct === Guest81255 is now known as jpds === ken_ is now known as Guest96238 [13:23] good morning [13:25] I think I fixed the libsecret build but I need a sponsor http://people.ubuntu.com/~jbicha/libsecret/ [13:36] pitti, manually applying your patch works, the files get listed now. Thank you for the quick fix. [13:36] jbicha, thanks [13:39] jbicha, uploaded, let's see if that works [13:39] seb128: so i wanted to harass you about ubuntu-control-center [13:39] jbicha, you including the orig in the .changes, you shouldn't normally [13:39] wasn't that meant to be happening this cycle? [13:39] included [13:39] desrt, stay on 3.4 [13:39] g-s-d as well [13:39] morning. [13:39] nautilus as well [13:39] desrt, "that" being? [13:40] seb128: the official forking [13:40] (and renaming) [13:40] (and returning of the original name to the unmodified upstream version) [13:40] desrt, ask lars if he had time to work on their version :p [13:40] larsu: hey. seb said that you were going to solve all of my probles. is that true? [13:40] desrt, olli said your team would take over that [13:40] oh. that's true. [13:40] * desrt seems to remember this on his birthday [13:41] ;-) [13:41] uhm. no! [13:41] :P [13:47] seb128: oh, that's how most things need to be built === ayan_ is now known as ayan [13:51] xclaesse: we have a mostly working gdm now but it breaks locales, the keyring doesn't auto-unlock, & there may be a bug with plymouth [13:52] jbicha, the orig tarball need to be uploaded only if launchpad doesn't have it already [13:52] jbicha, by curiosity (I'm happy with lighdm): is there someone working on fixing issues? [13:52] so usually for -0ubuntu1 or -1 only [13:52] oh crap [13:53] bug 1040645 is "pkg-create-dbgsym creates broken symbols for packages using debhelper compat 9" [13:53] Launchpad bug 1040645 in evolution-data-server "eds binaries contain broken .gnu_debuglink section" [Medium,Triaged] https://launchpad.net/bugs/1040645 [13:53] xclaesse: not really in that only a few people are aware of those bugs, maybe I'll push gdm to -proposed so that more people can look at it [13:55] xclaesse, the problem is g-s 3.5.90 won't fully work without a running gdm === cyphermox_ is now known as cyphermox [13:56] ricotz, hm, that's a bigger issue indeed [13:56] ricotz, so g-s package will depend on gdm and replace lighdm ? [13:56] and I guess g-s needs a newer gdm than 3.0? [13:56] and I don't want to break gnomebuntu before our first alpha either [13:56] xclaesse, it needs to depend on it yes [13:57] xclaesse, and since it is a runtime dep some kind of check would be useful too, or even remove g-s session from lightdm [13:58] ricotz, jbicha: btw are you guys behind gnombuntu ? [13:58] ricotz, why does it need gdm? [13:58] seb128, gdm provides the dbus service which is mandatory for the g-s screenshield (lock-screen, ...) [13:58] (why would gnome need systemd... and still...) [13:59] but yeah, that makes sense IMO [13:59] (it runs fine with consolekit) [13:59] ricotz, so it's just for lock screen? [13:59] ricotz, we could probably hack around and add a compat to gnome-screensaver [13:59] lighdm could provide the dbus service... I guess... [13:59] seb128, and some session actions [14:00] yeah, robert_ancell was talking about adding some gdm compat glue to lightdm [14:00] seb128, i dont like the word "hack" [14:00] he started looking at it at GUADEC [14:00] ricotz, neither hacking or hackje [14:00] otoh, if we want gnome-shell we probably want a real gnome env, so getting latest gdm would be good anyway [14:00] hacker [14:00] ? [14:00] seb128, but adding the org.gnome.displaymanager dbus interface to lightdm could work [14:00] xclaesse, most people don't care about their init system or login manager (especially if they use autologin) [14:01] xclaesse, they just want to get to their desktop [14:01] seb128, i just meant "hack" in a lot of work which the team can't cope with [14:01] seb128, true [14:02] I have a lot more confidence in lightdm than gdm (esp. on Ubuntu) so that would be great if robert could get lightdm to work with it [14:22] seb128: LO build finished on all platforms for -proposed, can you dump in quantal main? [14:22] Sweetshark, can do [14:22] seb128: awesome, thanks! [14:39] Sweetshark, copied [14:46] wow, anyone else with a x220/sandybridge get this? https://bugs.launchpad.net/ubuntu/+source/xserver-xorg-video-intel/+bug/1020733 making my system unstable right now...no idea how it happened [14:46] Ubuntu bug 1020733 in xserver-xorg-video-intel "[sandybridge-m-gt2+] GPU lockup IPEHR: 0x78170003" [Undecided,New] [14:46] is the compiz gsettings switch scheduled for today? [14:47] kenvandine: ping [14:49] mhall119, pong [14:49] Guest96238? [14:49] oh... === Guest96238 is now known as kenvandine [14:50] whew [14:50] mhall119, pong [14:51] kenvandine: I'm trying to get a list of "safe" dbus session services that apps can opt into without requiring a security review [14:55] kenvandine: I was hoping you'd know some that would almost always be needed, ones that could be needed and are safe, and ones that should require a review [14:57] not off hand [14:57] sorry [14:57] very distracted atm [14:59] kenvandine: stop looking at cats in boxes, there's work to do [14:59] haha [14:59] * kenvandine needs more of that :) [15:00] kenvandine: do the com.Gwibber.* services let you send tweets without user approval? [15:01] yes [15:01] com.Gwibber.Service [15:02] how about just reading, is there a service that will give you read but not write? [15:23] bonne nuit, les filles et les garçons! [15:27] seb128: for whoever uploads compiz, could you bump the minimum metacity build-depends for the soname transition? [15:27] oh, it's a public holiday on monday? [15:27] i nearly forgot! [15:29] jbicha, what soname transition? [15:29] jbicha, no, I've a week worth of work to land for tonight, I'm landing things in the state they are atm [15:35] metacity switched from gconf to gsettings, Debian bumped the soname and added a breaks/replace against the old library [15:36] Just bump the build-depends to libmetacity-dev (>= 1:2.34.3-3ubuntu1) and it will be fine [15:38] jbicha, crap, I pushed without that, what happens if it build with the old one? [15:38] jbicha, sorry I've like 5 discussions and people wanting things landing talking to me [15:39] seb128: nothing, it will just need to get rebuilt [15:39] jbicha, we didn't have that version, where are those changes come from? [15:39] sorry, compiz is in main or I'd do it for you [15:39] well, your upload will be in binNEW anyway I guess [15:40] if there is a soname change [15:40] we will land that later then and rebuild compiz [15:40] seb128: ok, thanks! [15:40] I need to get that compiz,unity on gsettings out [15:40] there is another round of compiz,unity coming for gles then [15:40] and then features [15:41] the new compiz breaks the old metacity [15:41] but sure [15:42] bye for now [16:03] crap, evolution alarm notifier just told me i was supposed to be pilot yesterday [16:03] whoops [16:03] that would not have been a good day for it [16:05] hehe [16:05] kenvandine, today is a better day? :p [16:05] NO [16:27] bugger, i wish i hadn't restarted my session now. unity-panel-service is crashing constantly [16:28] chrisccoulson, mine too [16:28] using the ubuntu-desktop ppa? [16:28] kenvandine, ah, yeah, that might be it [16:28] larsu, ^^ [16:28] seb128, ^^ [16:29] chrisccoulson, in some g_action_muxer function? [16:30] chrisccoulson, kenvandine: can you try if https://launchpad.net/ubuntu/+source/indicator-appmenu/12.10.0-0ubuntu2 fixes it? [16:31] it was segfaulting for me when nautilus was focussed before, that fixed it [16:31] i'll try in a few [16:35] argh, it's in the messagingmenu plugin [16:36] larsu, ? [16:36] just tried it [16:36] don't have a good stacktrace yet [16:36] larsu, tried what? [16:37] the ppa [16:37] what chris and ken were saying [16:37] larsu, hum, try the indicator-appmenu update I pointed? [16:37] larsu, are you sure it's not the issue I was complaining about and desrt fixed? [16:37] indicator-appmenu isn't built yet [16:38] just finishing [16:38] kenvandine, the debs are on launchpad, wget and dpkg [16:38] amd64 wasn't done a few minutes ago [16:38] now they are there :) [16:41] ok, I'm out for some exercice, I need that ;-) [16:41] be back in ~1h [16:55] kenvandine, any news? [16:55] seb128, et al: nautilus 3.5.90.really.3.4.2 is in quantal-proposed [16:55] ah, just missed seb128 [16:55] he'll be back ;) [16:55] lovely version [16:56] is hicolor-icon-theme supposed to be empty except for directories? [16:56] larsu, just restarted [16:57] mterry: :( [16:57] jbicha, I know. :( [16:57] my crash in the messaging menu was only because I didn't have the right gtk and glib [16:57] so maybe it's the one seb128 was talking about [16:57] larsu, no crash yet [16:58] * larsu should really keep track which terminal has which LD_LIBRARY_PATH [16:58] jbicha, I like the look of the new one [17:00] all: i'm looking for the code that determines which options you have when right clicking on a device like an SD card reader. [17:00] for example, i have the option to eject an SD card -- which doesn't make sense for my reader. [17:01] i tried setting the udisks propery ID_DRIVE_EJECTABLE to 0 but the option to eject the SD card is still available. :( [17:07] ayan: the code with that string is i think in either glib, gtk+, or nautilus; but it's based on the 'removable' flag, i think [17:08] ayan: devices that are not 'removable' get 'Unmount' as the string, iirc. and removable devices get 'Eject' [17:12] dobey: thank you! now what determines if the device gives the option to 'safely remove' it? [17:13] seb128, that looks like it fixed the crash [17:13] thx [17:16] ayan: not sure, but that's an option you basically never want to use [17:16] ayan: 'safely remove' powers down the device, and you'll have to reboot to be able to insert another SD card for example [17:19] dobey: right. this is the case for some SD card readers. [17:19] dobey: so i'm trying to remove this option so that the device doesn't get powered down. [17:22] ayan: 'Eject' while it may seem nonsensical in many cases, is the correct option. it does do slightly more than 'Unmount' but doesn't power down the drive as 'Safely Remove' would [17:23] right -- i agree. but how does one completely remove the 'Safely Remove' option so that people don't power down their card reader? [17:23] 'Eject' does remove the drive from internal reference from the software (you have to pull it out and insert it again to re-mount), while Unmount will let you re-mount without removal [17:24] ayan: i am not sure. the code for that set of options is in one of the 3 places I looked. you'll have to find it, see what it's looking for, and tweak those flags in udev I guess [17:25] or perhaps just get it patched out. i can't really think of any time where that option is a good idea [17:26] well -- it depends on what it does. if safely removing a device powers it down -- then i'm not sure if that is the right thing. if safe removal means syncing/unmounting -- well that might be reasonable. [17:27] perhaps the meaning of safely remove should be dependant on some udev attributes. [17:27] but it doen't make sense to overload the term 'eject'. eject shouldn't be there unless my SD card will leap out of my computer when i select it. [17:48] kenvandine, great! [17:48] mterry, \o/ [17:48] seb128, try it out, let me know if anything is obviously broken (seems OK for me so far) [17:50] mterry, ok, will do that after taking a shower (just back from exercice) [17:51] mterry, thanks for working on that [17:51] k [17:51] np [17:51] * mterry logs out and back in [17:53] chrisccoulson, did that appmenu update fix your issue? [17:53] seb128, yeah, it's working fine now [17:53] thanks [17:53] great [17:53] yw [17:57] seb128: should i get ted to merge that code? [17:59] desrt, well, I backported to fix to quantal so I'm not in an hurry, but it should be in the next tarball [18:00] thanks [18:04] seb128: uh... did you see the latest background panel? [18:04] is this a bug or is it actually supposed to look like that? [18:08] desrt, screenshot? [18:08] it didn't change since precise for me [18:10] oh. i'm on ricotz crack [18:10] you're probably not [18:10] ricotz: what's up with this? :) [18:11] kenvandine, mterry, chrisccoulson, others: unity-compiz-gsettings stack in quantal-proposed [18:11] seb128: http://imgur.com/1F32M [18:11] if you could upgrade and restart your session I would appreciate, first logging might be a bit slow but don't panic [18:11] kenvandine, chrisccoulson: and while we're testing proposed, also install nautilus and run it once for me! [18:11] watch for migration issues (keybindings, unity settings, etc) [18:12] seb128: when you click on it, you get this: http://imgur.com/N5GwH [18:12] desrt, seems like the new upstream design [18:12] * desrt loves minimalism, but seriously? [18:13] desrt, yeah, THEY MEAN IT ;-) [18:14] desrt, I like the "test" in the mouse capplet as well [18:14] you get the happy face stuff to click on full page [18:14] this is actually kinda cute :) [18:15] would be better if he was a little dude on the main page tho [18:15] seb128, yo ... lookin at some lubuntu image build failures today ... [18:15] ndicator-application-gtk2 : Depends: indicator-application (= 0.5.0-0ubuntu1) but it is not going to be installed [18:15] yeah, the main page is a bit boring [18:15] are the gtk2 bits premanently gone ? [18:15] ogra_, yes [18:15] who decided that ? [18:15] ogra_, I announced it in june on -devel [18:16] list [18:16] it will likely break the world for deriivatives [18:16] ogra_, we said we would maintain gtk2 support until precise [18:16] ok [18:16] seb128: I'm trying to come up with a list of common dbus session services that are "safe" for applications to access, where "safe" means they can't do anything terrible to the user or the user's data by accessing them [18:16] ogra_, the xubuntu guys agreed to bring back the ones they need in universe as separate sources [18:16] mhall119: i'd love to know what you're up to and to try to talk you out of it [18:16] seb128, ah, cool [18:16] I already have a list of the services used by Unity, are there any others you can think of that would fall under htat "safe" category? [18:16] thx ! [18:17] desrt, likely giving a list of things possible for software-center appdev [18:17] ya. like partial sandboxing? [18:17] desrt: you can try ;) [18:17] desrt, right, like "if you use a service out of those you will be rejected" [18:17] is this sandboxing or rather review checklist? [18:17] desrt, until we get an efficient dbus sandboxing we can use I guess, at this point the sandbox will do it for you [18:18] yes, it's for sandboxing. Specifically we need a list of "pre-approved" things that your app can access [18:18] desrt: well, both possibly [18:18] mhall119: what of the filesystem? [18:18] dinner, bbiab [18:18] desrt: I already have a list for the filesystem [18:18] mhall119: how do you plan to deal with shared libraries? [18:19] shared library code would run under the same apparmor restrictions as the app [18:19] ya. you're already entering into a world of pain, then [18:19] man, I've been there for weeks already ;) [18:20] i don't think that this is something that we can do mish-mash with a secondary solution like apparmor... [18:20] and we're going to feel a lot of pain for this. we already are. [18:20] I don't really care *how* it gets implemented [18:20] yes. you do. [18:21] whether it's apparmor, or built into the dbus daemon itself [18:21] because the proper way to do this is going to take more time than you probably have [18:21] I don't really have a deadline [18:21] okay. so we need to change the unix security model [18:21] desrt: what is secondary about this? we need to be able to say what an app is allowed to do and reject things outside of that? this is no different than other sandboxing solutions, like Apple's? [18:21] and get all of our upstream library developers to understand that we have done so [18:21] jdstrand: the problem is that libraries will do unexpected things [18:22] so? [18:22] we've seen all kinds of issues where we get apparmor rejecting apps for trying to write files to unexpected places [18:22] seb128: the -proposed Unity is lagging really bad here [18:22] if it is unexpected it should be denied. if it is something the application expects, the profile will allow it [18:22] only to find out that it was actually a mundane (and completely necessary) part of the function of a shared library [18:23] desrt: that is a problem with the abstraction, not apparmor itself [18:23] which abstraction? [18:23] obviously, this whole exercise will help with our abstractions [18:23] seb128: also, I believe we're ready for the compiz rebuild so that metacity isn't uninstallable [18:23] until apparmor grows the ability to consider use of a particular shared library as 'safe' then you have trouble [18:23] and i don't think that's very easy.... [18:23] desrt: presumably for things already in the archives they wouldn't be subject to this, just like how most apps in main/universe aren't subject to apparmor restrictions [18:23] whatever one is allowing the access or not allowing it, but it should [18:24] seb128, the proposed stack seems fine to me [18:25] desrt: yes, there will be a problem if a shared library needs to access a resource the app author doesn't realize it needs to access [18:25] mhall119: the problem is that the shared library can get an upgrade [18:25] but, that in and of itself is a problem, and one that can be fixed with awareness [18:25] mhall119: is that the appauthor's responsibility? [18:26] yup [18:26] IMO, anyway [18:26]