Merge branch 'master' into update-android-img

snap/snapcraft.yaml

@@ -16,25 +16,44 @@ grade: devel
 architectures: [amd64]
 
 slots:
-  # Depending on in which environment we're running we either need
-  # to use the system or session DBus so we also need to have one
-  # slot for each.
-  dbus-session:
+  dbus-session-slot:
     interface: dbus
-    bus: system
+    bus: session
     name: org.anbox
-  dbus-system:
+
+plugs:
+  dbus-session-plug:
     interface: dbus
-    bus: system
+    bus: session
     name: org.anbox
 
 apps:
   anbox:
     command: desktop-launch $SNAP/bin/anbox-wrapper.sh
+    slots:
+      - dbus-session-slot
+    plugs:
+      - x11
+      - unity7
+      - network
+      - opengl
+      - wayland
+      - pulseaudio
+      - home
+      - process-control
+      - desktop
+
   container-manager:
     command: bin/container-manager.sh start
     stop-command: bin/container-manager.sh stop
     daemon: simple
+    plugs:
+      - firewall-control
+      - kernel-module-control
+      - mount-observe
+      - network-control
+      - network-bind
+
   collect-bug-info:
     command: bin/collect-bug-info.sh
   shell:
@@ -42,9 +61,36 @@ apps:
   android-settings:
     command: desktop-launch $SNAP/bin/app-android-settings.sh
     desktop: desktop/android-settings.desktop
+    slots:
+      - dbus-session-slot
+    plugs:
+      - dbus-session-plug
+      - x11
+      - unity7
+      - network
+      - opengl
+      - wayland
+      - pulseaudio
+      - home
+      - process-control
+      - desktop
+
   appmgr:
     command: desktop-launch $SNAP/bin/app-appmgr.sh
     desktop: desktop/appmgr.desktop
+    slots:
+      - dbus-session-slot
+    plugs:
+      - dbus-session-plug
+      - x11
+      - unity7
+      - network
+      - opengl
+      - wayland
+      - pulseaudio
+      - home
+      - process-control
+      - desktop
 
 parts:
   android:
@@ -102,7 +148,7 @@ parts:
   lxc:
     source: https://github.com/lxc/lxc
     source-type: git
-    source-tag: lxc-3.0.0
+    source-tag: lxc-3.0.1
     build-packages:
       - libapparmor-dev
       - libcap-dev
@@ -125,6 +171,16 @@ parts:
       - --enable-capabilities
       - --with-rootfs-path=/var/snap/anbox/common/lxc/
       - --libexecdir=/snap/anbox/current/libexec/
+    override-build: |
+      set -ex
+      git config user.email "buildbot@anbox.io"
+      git config user.name "Anbox Buildbot"
+      git remote add anbox https://github.com/anbox/lxc
+      git fetch anbox
+      # apparmor: don't require a transition for Anbox child profiles
+      git cherry-pick 2f81fb7c91560b32e506bb874f8cd63e37985906
+      set +ex
+      snapcraftctl build
     organize:
       snap/anbox/current/libexec: libexec
     prime:
@@ -195,6 +251,9 @@ parts:
       # that is fixed we can avoid using a prefix here.
       - -DCMAKE_INSTALL_PREFIX:PATH=/usr
       - -DANBOX_VERSION=$SNAPCRAFT_PROJECT_VERSION
+      # FIXME: Once we have everything in place for full snap confinement we
+      # can securely enable this.
+      # - -DSNAP_CONFINEMENT=ON
     build-packages:
       - build-essential
       - cmake