Package: thunderbird Version: 1:52.3.0-4~deb8u2 Severity: normal User: [email protected] Usertags: modify-profile
Dear Maintainer, I have discovered AppArmor denies on Debian 7 (jessie) and Debina 8 (stretch), that prevent to load plugin ibraries: On jessie (from icedtea-7-plugin): /usr/lib/jvm/java-7-openjdk-amd64/jre/lib/amd64/IcedTeaPlugin.so On stretch (from icedtea-8-plugin): /usr/lib/jvm/java-8-openjdk-amd64/jre/lib/amd64/IcedTeaPlugin.so On both (from kopete package): /usr/lib/mozilla/plugins/skypebuttons.so For that mozilla/pluins .so, I believe there is buggy assumption in profile, that states [0] ``` # /usr/share/.../extensions/... is already covered by '/usr/** r', # above. ``` It does allows to read, but denies to load libraries, that are quite a few: (On Debian Testing) ``` $ apt-file search /usr/lib/mozilla/plugins browser-plugin-evince: /usr/lib/mozilla/plugins/libevbrowserplugin.so browser-plugin-freshplayer-libpdf: /usr/lib/mozilla/plugins/libfreshwrapper-libpdf-backend.so browser-plugin-freshplayer-libpdf: /usr/lib/mozilla/plugins/libfreshwrapper-libpdf-frontend.so browser-plugin-freshplayer-nacl: /usr/lib/mozilla/plugins/libfreshwrapper-nacl.so browser-plugin-spice: /usr/lib/mozilla/plugins/npSpiceConsole.so browser-plugin-vlc: /usr/lib/mozilla/plugins/libvlcplugin.so djview-plugin: /usr/lib/mozilla/plugins/nsdejavu.so garmin-plugin: /usr/lib/mozilla/plugins/npGarminPlugin.so gnome-shell: /usr/lib/mozilla/plugins/libgnome-shell-browser-plugin.so gxineplugin: /usr/lib/mozilla/plugins/gxineplugin.so kopete: /usr/lib/mozilla/plugins/skypebuttons.so kpartsplugin: /usr/lib/mozilla/plugins/libkpartsplugin.so mozplugger: /usr/lib/mozilla/plugins/mozplugger.so rhythmbox-plugins: /usr/lib/mozilla/plugins/librhythmbox-itms-detection-plugin.so x2goplugin: /usr/lib/mozilla/plugins/libx2goplugin.so xine-plugin: /usr/lib/mozilla/plugins/xineplugin.so ``` Therefore, if mainainer aggrees, I will propose merge into `apparmor-profiles` to update usr.bin.thunderbird profile. For completness, here are mentioned DENIED entries: type=AVC msg=audit(1501048002.887:8568): apparmor="DENIED" operation="file_mmap" profile="thunderbird" name="/usr/lib/mozilla/plugins/skypebuttons.so" pid=3596 comm="thunderbird" requested_mask="m" denied_mask="m" fsuid=1000 ouid=0 type=SYSCALL msg=audit(1501048002.887:8568): arch=c000003e syscall=9 success=no exit=-13 a0=0 a1=2126d8 a2=5 a3=802 items=0 ppid=2647 pid=3596 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=1 comm="thunderbird" exe="/usr/lib/thunderbird/thunderbird" key=(null) type=PROCTITLE msg=audit(1501048002.887:8568): proctitle="/usr/lib/thunderbird/thunderbird" type=AVC msg=audit(1501048002.867:8567): apparmor="DENIED" operation="file_mmap" profile="thunderbird" name="/usr/lib/jvm/java-7-openjdk-amd64/jre/lib/amd64/IcedTeaPlugin.so" pid=3596 comm="thunderbird" requested_mask="m" denied_mask="m" fsuid=1000 ouid=0 type=SYSCALL msg=audit(1501048002.867:8567): arch=c000003e syscall=9 success=no exit=-13 a0=0 a1=299c38 a2=5 a3=802 items=0 ppid=2647 pid=3596 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=1 comm="thunderbird" exe="/usr/lib/thunderbird/thunderbird" key=(null) type=PROCTITLE msg=audit(1501048002.867:8567): proctitle="/usr/lib/thunderbird/thunderbird" type=AVC msg=audit(1506781179.648:160): apparmor="DENIED" operation="file_mmap" profile="thunderbird" name="/usr/lib/jvm/java-8-openjdk-amd64/jre/lib/amd64/IcedTeaPlugin.so" pid=3736 comm="thunderbird" requested_mask="m" denied_mask="m" fsuid=1000 ouid=0 type=SYSCALL msg=audit(1506781179.648:160): arch=c000003e syscall=9 success=no exit=-13 a0=0 a1=296bc8 a2=5 a3=802 items=0 ppid=1913 pid=3736 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=4 comm="thunderbird" exe="/usr/lib/thunderbird/thunderbird" key=(null) type=PROCTITLE msg=audit(1506781179.648:160): proctitle="/usr/lib/thunderbird/thunderbird" [0] https://git.launchpad.net/apparmor-profiles/tree/ubuntu/17.10/usr.bin.thunderbird?id=d1493732c95b528d8622b36ed3b92d1b70748657#n172 -- System Information: Debian Release: 8.9 APT prefers oldstable-updates APT policy: (500, 'oldstable-updates'), (500, 'oldstable') Architecture: amd64 (x86_64) Kernel: Linux 3.16.0-4-amd64 (SMP w/8 CPU cores) Locale: LANG=lt_LT.UTF-8, LC_CTYPE=lt_LT.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash Init: systemd (via /run/systemd/system) Versions of packages thunderbird depends on: ii debianutils 4.4+b1 ii fontconfig 2.11.0-6.3+deb8u1 ii libatk1.0-0 2.14.0-1 ii libc6 2.19-18+deb8u10 ii libcairo2 1.14.0-2.1+deb8u2 ii libdbus-1-3 1.8.22-0+deb8u1 ii libdbus-glib-1-2 0.102-1 ii libevent-2.0-5 2.0.21-stable-2+deb8u1 ii libffi6 3.1-2+deb8u1 ii libfontconfig1 2.11.0-6.3+deb8u1 ii libfreetype6 2.5.2-3+deb8u2 ii libgcc1 1:4.9.2-10 ii libgdk-pixbuf2.0-0 2.31.1-2+deb8u6 ii libglib2.0-0 2.42.1-1+b1 ii libgtk2.0-0 2.24.25-3+deb8u2 ii libhunspell-1.3-0 1.3.3-3 ii libpango-1.0-0 1.36.8-3 ii libpangocairo-1.0-0 1.36.8-3 ii libpangoft2-1.0-0 1.36.8-3 ii libpixman-1-0 0.32.6-3 ii libstartup-notification0 0.12-4 ii libstdc++6 4.9.2-10 ii libx11-6 2:1.6.2-3 ii libx11-xcb1 2:1.6.2-3 ii libxcb-shm0 1.10-3+b1 ii libxcb1 1.10-3+b1 ii libxcomposite1 1:0.4.4-1 ii libxdamage1 1:1.1.4-2+b1 ii libxext6 2:1.3.3-1 ii libxfixes3 1:5.0.1-2+b2 ii libxrender1 1:0.9.8-1+b1 ii libxt6 1:1.1.4-1+b1 ii psmisc 22.21-2 ii x11-utils 7.7+2 ii zlib1g 1:1.2.8.dfsg-2+b1 Versions of packages thunderbird recommends: ii hunspell-en-us [hunspell-dictionary] 20070829-6+deb8u1 ii lightning 1:52.3.0-4~deb8u2 ii myspell-lt [myspell-dictionary] 1.2.1-4 Versions of packages thunderbird suggests: ii apparmor 2.9.0-3 pn fonts-lyx <none> ii libgssapi-krb5-2 1.12.1+dfsg-19+deb8u2 -- no debconf information
