Hi,
On Fri, Dec 01, 2017 at 10:07:02AM +0100, Jack Henschel wrote:
> Hi Guido,
>
> > The apparmor profile has denials. That means that it will prevent TB
> > from accessing files but not lock it. So what the above is not prove
> > that Apparmor is not at fault yet. You would have to disable the profile
> > using aa-disable and see if thunderbird starts then.
>
>
> thanks to your suggestions I did try again with explicitely disabled
> apparmor profile for thunderbird and it worked!
Awesome. Carsten, can we revert the change that calls thunderbird-bin
then please.
>
> I did the following:
>
> $ sudo ln -s /etc/apparmor.d/usr.bin.thunderbird /etc/apparmor.d/disable/
> $ sudo apparmor_parser -R /etc/apparmor.d/usr.bin.thunderbird
>
> (Checked with aa-status that the profile was no longer loaded)
>
> After that, both `thunderbird` and `/usr/lib/thunderbird/thunderbird` started
> (i.e. did not fail to connect to the X Server).
>
> Unfortunately, I have been unable to get any logs from apparmor. I get the
> following error message from `aa-audit` and `aa-complain`:
> $ sudo aa-complain thunderbird
> Setting /usr/bin/thunderbird to complain mode.
> ERROR: /etc/apparmor.d/usr.bin.thunderbird contains no profile
>
> I checked /var/log/kern.log, /var/log/apparmor/ and /var/log/messages for any
> relevant logs, but could not find any.
>
> How can I further debug this apparmor issue?
You can look at /etc/apparmor.d/usr.bin.thunderbird. Comment out the
deny rules by using a '#' one by one. Then do a
apparmor_parser -r /etc/apparmor.d/usr.bin.thunderbird
to load the new profile and see if thunderbird runs.
AFAIK apparmor will be disabled by default for thunderbird with the next
upload. Help on getting the profile into shape and debugging this issues
is _greatly_ appreciated though!
Cheers,
-- Guido
