Hello Matthew, Am 04.02.23 um 17:50 schrieb Matthew Vernon:
Hi,I've just upgraded my very-long-running system to bookworm, and I was stuck for some time because thunderbird wouldn't start, complaining it couldn't read my profile. Syslog revealed the issue to be apparmor: Feb 4 11:20:14 aragorn kernel: [ 169.355039] audit: type=1400 audit(1675509614.798:47): apparmor="DENIED" operation="open" profile="thunderbird" name="/home/matthew/.mozilla-thunderbird/profiles.ini" pid=3565 comm="thunderbird" requested_mask="r" denied_mask="r" fsuid=1024 ouid=1024 I have an old-enough system that thunderbird used to use ~/.mozilla-thunderbird as its profile directory (then it was .icedove and now .thunderbird), and while subsequent upgrades have created the necessary symlinks, this isn't good enough for apparmor. The following apparmor addition does the trick: owner @{HOME}/.mozilla-thunderbird/{,**} rwlk, and I think should be added to the thunderbird apparmor config; because I surely won't be the only person with a long-running Debian install who will otherwise trip over this in bookworm as we default to enabling apparmor.
I'm not very familiar with AppArmor so Intrigeri can probably give some more useful advice how to do best on this.
Looking at the existing profile data template I think this should do the trick.
@intrigeri What do you think?
$ git diff !$ git diff debian/apparmor/usr.bin.thunderbird diff --git a/debian/apparmor/usr.bin.thunderbird b/debian/apparmor/usr.bin.thunderbird index 59e72aedaf1..bfcd6e7aefb 100644 --- a/debian/apparmor/usr.bin.thunderbird +++ b/debian/apparmor/usr.bin.thunderbird @@ -300,7 +300,7 @@ profile thunderbird /usr/lib/thunderbird/thunderbird{,-bin} {# per-user thunderbird configurationowner @{HOME}/.{icedove,thunderbird}/ rw, - owner @{HOME}/.{icedove,thunderbird}/** rw, + owner @{HOME}/.{icedove,thunderbird,mozilla-thunderbird}/** rw, owner @{HOME}/.{icedove,thunderbird}/**/storage.sdb k, owner @{HOME}/.{icedove,thunderbird}/**/*.{db,parentlock,sqlite}* k, owner @{HOME}/.{icedove,thunderbird}/plugins/** rm,
-- Regards Carsten
