LibreOffice AppArmor profiles

Hi there,

I've been working on making AppArmor profiles for LibreOffice and have been
wondering about the best way to integrate them upstream.  Originally I was
thinking about having them in AppArmor upstream but it makes more sense to
be in lock step with LibreOffice versions.  That way as bugs get fixed or
LibreOffice is made to require less permissions it shows up at the right
time.

You can see the latest public version here[1*] and that thread starts
here[2].

If they could be integrated somewhere with the build system it would help
solve the other big issue that I've ran into, the changing pathnames from
pre-built debs to different distros doing things differently.   In an ideal
world each different system then could just generate a libreoffice-apparmor
package that would enable the profiles.

If not (or if we want to decide all that later), I would just be happy
knowing where in the LibreOffice code base the profiles make sense to live.

Just to be clear, I don't believe you could turn these on by default right
now.   This just gives organizations who want LibreOffice confined that
option.

Kind regards,
Bryan

Canonical Backline Support Engineer

[1]  https://lists.ubuntu.com/archives/apparmor/2015-April/007713.html
[2]  https://lists.ubuntu.com/archives/apparmor/2015-April/007690.html
* This profile found a few bugs in AppArmor.  I had to do AppArmor restarts
to reload the profiles.