From 338e69d20ffa15cd1240eac6b01f5eaa239fd2b1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tomi=20Lepp=C3=A4nen?= <tomi.leppanen@jolla.com>
Date: Tue, 23 Mar 2021 11:35:07 +0200
Subject: [PATCH] [mapplauncherd] Set CAP_SYS_PTRACE to allow reading
 /proc/pid/exe. Fixes JB#53620
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

All other boosters must be changed as well.

Signed-off-by: Tomi Leppänen <tomi.leppanen@jolla.com>
---
 README                 |  4 ++++
 rpm/mapplauncherd.spec | 12 +++++-------
 2 files changed, 9 insertions(+), 7 deletions(-)

diff --git a/README b/README
index b52d32b..040ebfe 100644
--- a/README
+++ b/README
@@ -59,6 +59,10 @@ name of the application. Then the booster process waits for a connection
 from the invoker with the information about which application should be
 launched. 
 
+Before launching application boosters check that the calling process is allowed
+to invoke applications. This requires CAP_SYS_PTRACE. All boosters must have
+that set to function.
+
 Contributors
 ==============================
 
diff --git a/rpm/mapplauncherd.spec b/rpm/mapplauncherd.spec
index 706e4b8..87b7e3b 100644
--- a/rpm/mapplauncherd.spec
+++ b/rpm/mapplauncherd.spec
@@ -8,8 +8,9 @@ Source0:    %{name}-%{version}.tar.bz2
 Source1:    booster-cgroup-mount.service
 Requires:   systemd-user-session-targets
 Requires(post): /sbin/ldconfig
+Requires(post): /usr/sbin/setcap
 Requires(postun): /sbin/ldconfig
-Requires(pre):  shadow-utils
+Requires(pre):  sailfish-setup
 BuildRequires:  pkgconfig(libshadowutils)
 BuildRequires:  pkgconfig(systemd)
 BuildRequires:  pkgconfig(dbus-1)
@@ -25,7 +26,6 @@ functionality to launch applications as single instances.
 
 %package devel
 Summary:    Development files for launchable applications
-Group:      Development/Tools
 Requires:   %{name} = %{version}-%{release}
 Provides:   meegotouch-applauncherd-devel > 3.0.3
 Obsoletes:  meegotouch-applauncherd-devel <= 3.0.3
@@ -36,7 +36,6 @@ using mapplauncherd.
 
 %package cgroup
 Summary:    Service files for booster cgroup mount
-Group:      System/Daemons
 Requires:   %{name} = %{version}-%{release}
 
 %description cgroup
@@ -73,10 +72,9 @@ ln -s ../booster-cgroup-mount.service %{buildroot}%{_unitdir}/multi-user.target.
 
 install -D -m 0755 scripts/booster-cgroup-mount %{buildroot}/usr/lib/startup/booster-cgroup-mount
 
-%pre
-groupadd -rf privileged
-
-%post -p /sbin/ldconfig
+%post
+/sbin/ldconfig
+/usr/sbin/setcap cap_sys_ptrace+pe %{_libexecdir}/mapplauncherd/booster-generic || :
 
 %postun -p /sbin/ldconfig