Merge lp://qastaging/~tyhicks/apparmor-easyprof-ubuntu/lp1260103 into lp://qastaging/apparmor-easyprof-ubuntu

I haven't had a chance to test this yet but it the changes are consistent with the paths constructed by https://git.launchpad.net/oxide/commit/?id=9bbf87e80b49e6abcc9419f142655a4ce2fc0638. I'll be sure to test before actually merging into lp:apparmor-easyprof-ubuntu.

Although I haven’t actually tested, that looks mostly good to me, and is consistent with the changeset in oxide.

Note that this change was introduced in the 1.17 branch of oxide, so you don’t want to make the change effective in apparmor-easyprof-ubuntu until oxide 1.17 is released (or the old rule should be kept temporarily until 1.17 is released).

Note that /dev/shm/@{APP_PKGNAME}.oxide is a directory under which oxide will write files. I’m no apparmor expert, but shouldn’t the rule end with a '/' to reflect that?

You're correct on both points. I shouldn't remove the old rules yet and I need to grant access to the directory contents. I'll adjust this merge request later today.

@osomon can you have another look? Thanks!

That looks good to me.

I’ve tried to test the change by rebuilding the package and installing oxide 1.17 from https://launchpad.net/~oxide-builds/+archive/ubuntu/oxide-next-for-stable-phone-overlay/ on a phone, only to realize that APP_PKGNAME is not an environment variable that is being set anywhere.
According to https://developer.ubuntu.com/en/phone/platform/guides/app-confinement/, its value can be inferred like so:

  APP_PKGNAME = APP_ID.split('_')[0]

A small update to mention the exact Oxide version numbers (1.17.5 and 1.18) that should contain the shm changes