2 files changed, 65 insertions, 0 deletions
diff --git a/scripts/canonical-system.sh b/scripts/canonical-system.sh
index e6f0825..cd85879 100644
--- a/scripts/canonical-system.sh
+++ b/scripts/canonical-system.sh
@@ -13,6 +13,10 @@ sudo apparmor_parser --skip-kernel-load --skip-cache canonical/apparmor/dotfiles
 sudo install -m 644 canonical/apparmor/dotfiles-nix /etc/apparmor.d/dotfiles-nix
 sudo apparmor_parser --replace /etc/apparmor.d/dotfiles-nix
 sudo snap connect thunderbird:gpg-keys
+sudo install -D -m 644 scripts/mattermost_keyring.py /usr/local/lib/dotfiles/mattermost_keyring.py
+sudo install -m 644 canonical/systemd/dotfiles-mattermost-keyring.{service,path} /etc/systemd/system/
+sudo systemctl daemon-reload
+sudo systemctl enable --now dotfiles-mattermost-keyring.path dotfiles-mattermost-keyring.service
 systemctl --user daemon-reload
 systemctl --user enable --now gpg-agent.socket gpg-agent-ssh.socket podman.socket
 echo 'Existing GPG agent processes keep their executable until the next login.'
diff --git a/scripts/mattermost_keyring.py b/scripts/mattermost_keyring.py
new file mode 100644
index 0000000..a54ed6d
--- /dev/null
+++ b/scripts/mattermost_keyring.py
@@ -0,0 +1,61 @@
+"""Permit the Mattermost Snap to use the desktop Secret Service."""
+
+import os
+import re
+import subprocess
+import tempfile
+from pathlib import Path
+
+PROFILE = Path(
+    "/var/lib/snapd/apparmor/profiles/snap.mattermost-desktop.mattermost-desktop"
+)
+MARKER = "# dotfiles: Mattermost Secret Service access"
+RULES = """
+dbus (receive, send)
+    bus=session
+    path=/org/freedesktop/secrets{,/**}
+    interface=org.freedesktop.DBus.*
+    peer=(label=unconfined),
+dbus (receive, send)
+    bus=session
+    path=/org/freedesktop/secrets{,/**}
+    interface=org.freedesktop.Secret.{Collection,Item,Prompt,Service,Session}
+    peer=(label=unconfined),
+"""
+
+
+def patch_profile(text: str) -> str:
+    profiles = re.findall(r'^profile "([^"]+)"', text, re.MULTILINE)
+    if profiles != [PROFILE.name] or not text.rstrip().endswith("}"):
+        raise ValueError("Unexpected Mattermost AppArmor profile format.")
+    if MARKER in text:
+        return text
+    return text.rstrip()[:-1] + MARKER + "\n" + RULES + "}\n"
+
+
+def install_profile(text: str) -> None:
+    with tempfile.TemporaryDirectory(dir=PROFILE.parent) as directory:
+        target = Path(directory) / PROFILE.name
+        target.write_text(text)
+        subprocess.run(
+            ["apparmor_parser", "--skip-kernel-load", "--skip-cache", str(target)],
+            check=True,
+        )
+        target.chmod(PROFILE.stat().st_mode & 0o777)
+        os.replace(target, PROFILE)
+
+
+def main() -> None:
+    if os.geteuid() != 0:
+        raise SystemExit("Run this command as root.")
+    original = PROFILE.read_text()
+    patched = patch_profile(original)
+    if patched != original:
+        install_profile(patched)
+    subprocess.run(
+        ["apparmor_parser", "--replace", "--skip-cache", str(PROFILE)], check=True
+    )
+
+
+if __name__ == "__main__":
+    main()