Looks like Thunderbird behaves the same: ```type=AVC msg=audit(1538066122.223:896): apparmor="DENIED" operation="mknod" profile="thunderbird" name="/usr/share/fonts/X11/encodings/large/.uuid.TMP-7ayDB6
" pid=9152 comm="thunderbird" requested_mask="c" denied_mask="c" fsuid=1000 ouid=1000 ```
Maybe this bug belongs to libfontconfig instead? Firefox and Thunderbird are multi-process applications, it's hard to catch syscal via GDB with all these child-process-iness.
