interfaces: allow Chromium StatusNotifierItem object paths in unity7 - #17415
interfaces: allow Chromium StatusNotifierItem object paths in unity7#17415clwsgruk wants to merge 1 commit into
Conversation
github-actions
Bot
added
the
Run only one system
|
This change was directed by me, happy to take and questions or make adjustments! |
github-actions
Bot
removed
the
Run only one system
|
@jnsgruk Thanks for confirming. The change is narrowly scoped to Chromium’s StatusNotifierItem/DbusMenu object paths and includes matching AppArmor snippet coverage, so I don’t have any questions or adjustments to suggest. Validation: schema v1 and canonical identity/repository/PR/source/head match; inspected the current two-file diff and existing conversation |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #17415 +/- ##
==========================================
+ Coverage 78.81% 78.83% +0.01%
==========================================
Files 1405 1403 -2
Lines 197076 196980 -96
Branches 2498 2498
==========================================
- Hits 155334 155282 -52
+ Misses 32379 32339 -40
+ Partials 9363 9359 -4
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
|
Wed Jul 29 10:55:56 UTC 2026 Failures:Preparing:
Executing:
Restoring:
Skipped tests from snapd-testing-skipIf you wish to have any of the below tests run in your PR, in your PR description, add 'unskip:' followed by a copy-and-pasted list of the below tests you wish to run (unskip plus test list must be valid yaml)
|
2 participants
Summary
Electron 43 ships Chromium 150, whose Linux tray implementation changed the exported D-Bus object paths from the long-standing paths to numbered Chromium paths:
/org/chromium/StatusNotifierItem/<numeric-id>/org/chromium/DbusMenu/<numeric-id>This affects confined Electron applications generally. Signal Desktop 8.20 (snap revision 923) is the concrete reproducer reported in snapcrafters/signal-desktop#459.
The observed denial is:
A corresponding
Properties.Getcall is also denied. GNOME's AppIndicator extension consequently cannot initialise its proxy for the item, so the tray icon is not displayed.The numbered object paths were introduced by Chromium commit fe959876. A later Chromium change restored
/StatusNotifierItem, retained the numbered Chromium DbusMenu path, and introduced per-item names of the formorg.freedesktop.StatusNotifierItem-PID-ID; this change therefore also permits binding that exact numeric name shape.Why unity7
The
unity7interface already mediates AppIndicator/StatusNotifierItem and dbusmenu integration, and Signal already plugs it. The host snapd generates the effective AppArmor profile, so changing the application snap orbrowser-supportwould not address the missing desktop-shell integration permission.Security and scope
/org/chromium/StatusNotifierItem/[0-9]*and/org/chromium/DbusMenu/[0-9]*object-path families to the existing app-indicator rules.org.freedesktop.StatusNotifierItem-[0-9]*-[0-9]*bind name used by current Chromium.plasmashell/unconfinedpeer labels unchanged.memory.max/memory.highand systemd-logindInhibitdenials from the report.Tests
Passed locally:
cd interfaces/builtin && go test -check.f Unity7InterfaceSuite—OK: 6 passedgo test ./interfaces/builtin— passed (ok github.com/snapcore/snapd/interfaces/builtin)go vet ./interfaces/builtin— passedgofmt -s -d interfaces/builtin/unity7.go interfaces/builtin/unity7_test.go— no diff/home/jon/.local/share/mise/installs/go/1.24.0/bin/golangci-lint run ./interfaces/builtin—0 issues.apparmor_parser -QTK /tmp/snapd-unity7-chromium-aaagainst a temporary profile containing the changed rules — passedAlso attempted
IGNORE_MISSING=1 ./run-checks --static. It progressed through the repository static checks but the whole-repository golangci typecheck could not complete on this host because theblkidpkg-config development metadata (blkid.pc) is not installed. The changed package passes the targeted golangci-lint command above.Runtime validation
Not run. This host has no graphical desktop session and does not have the Signal Desktop snap installed. GNOME validation with Signal Desktop 8.20 and
tray-icon=true, plus KDE/Plasma coverage, remains pending.AI assistance
This targeted change was prepared with Hermes Agent assistance, with source inspection, test-first regression coverage, and all commands/results above executed locally.