interfaces/camera: Add AppArmor snippet for Halium with minimal privileges

Author: fredldotme

interfaces/builtin/camera.go

@@ -21,6 +21,10 @@ package builtin
 
 import (
 	"strings"
+
+	"github.com/snapcore/snapd/interfaces"
+	"github.com/snapcore/snapd/interfaces/apparmor"
+	"github.com/snapcore/snapd/release"
 )
 
 const cameraSummary = `allows access to all cameras`
@@ -56,6 +60,30 @@ const cameraConnectedPlugAppArmor = `
 /sys/devices/platform/**/usb*/**/video4linux/** r,
 `
 
+const cameraConnectedPlugTouchAppArmor = `
+# Support for Android-based Camera stack on Ubuntu Touch
+/android{,/**} r,
+/{,android/}system/build.prop r,
+/{,android/}vendor/build.prop r,
+/{,android/}odm/build.prop    r,
+
+# libcamera_compat_layer doesn't require proprietary vendor blobs
+/{,android/}system/lib{,64}/** r,
+/{,android/}system/lib{,64}/**.so m,
+
+# Commonly expected Android paths
+/{,dev/}socket/property_service rw,
+/{,dev/}socket/logdw rw,
+/{,dev/}__properties__/** r,
+
+# Allow access to the CameraService on app-only binder
+/dev/{,binderfs/}binder rw,
+`
+
+type cameraInterface struct {
+	commonInterface
+}
+
 // DetectCameraFromPath returns true if the given path corresponds to an
 // AppArmor rule with the prompt prefix from the camera interface.
 //
@@ -73,14 +101,22 @@ var cameraConnectedPlugUDev = []string{
 	`KERNEL=="vchiq"`,
 }
 
+
+func (iface *cameraInterface) AppArmorConnectedPlug(spec *apparmor.Specification, plug *interfaces.ConnectedPlug, slot *interfaces.ConnectedSlot) error {
+	spec.AddSnippet(cameraConnectedPlugAppArmor)
+	if release.OnTouch {
+		spec.AddSnippet(cameraConnectedPlugTouchAppArmor)
+	}
+	return nil
+}
+
 func init() {
 	registerIface(&commonInterface{
 		name:                  "camera",
 		summary:               cameraSummary,
 		implicitOnCore:        true,
 		implicitOnClassic:     true,
 		baseDeclarationSlots:  cameraBaseDeclarationSlots,
-		connectedPlugAppArmor: cameraConnectedPlugAppArmor,
 		connectedPlugUDev:     cameraConnectedPlugUDev,
 	})
 }