From d4eddbc4a7b46c9e53fdd47b9feff0c2e75ec8d7 Mon Sep 17 00:00:00 2001 From: sommerfeld Date: Tue, 22 Sep 2026 13:57:08 +0100 Subject: Permit Mattermost Snap tray communication --- docs/canonical-laptop.md | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) (limited to 'docs/canonical-laptop.md') diff --git a/docs/canonical-laptop.md b/docs/canonical-laptop.md index a03db70..7485b6c 100644 --- a/docs/canonical-laptop.md +++ b/docs/canonical-laptop.md @@ -217,15 +217,22 @@ profiles. Global user-namespace restrictions stay enabled. Test `aibox -p` and a rootless container. If AppArmor denies another executable, inspect the exact denial before adding a rule. Do not allow every program under `/nix/store`. -## Mattermost Keyring +## Mattermost Keyring And Tray The Mattermost Snap lacks the `password-manager-service` plug. `canonical-system` installs `dotfiles-mattermost-keyring.service` and its path watcher. They add -Secret Service D-Bus access to the Mattermost profile at boot and when snapd +Secret Service and Chromium tray D-Bus access to the Mattermost profile at boot and when snapd replaces it. The Snap keeps its normal updates and AppArmor enforcement. This permission gives Mattermost access to the user's unlocked keyring; it does not restrict access to Mattermost's own entries. +The tray rules allow GNOME to read the icon, receive updates, and operate its +menu through `/org/chromium/StatusNotifierItem/*` and `/org/chromium/DbusMenu`. +They apply only to the Mattermost profile on the session bus, with unconfined +desktop peers. They do not grant memory-statistics or idle-monitor access. +Run `just canonical-system` to install the rules. To reload them explicitly, run +`sudo systemctl restart dotfiles-mattermost-keyring.service`. + After applying this to a running session, quit Mattermost, including its tray process, and start it again. Check the result: -- cgit v1.3.1