On 2/14/2026 2:10 PM, Debian Tester wrote: > On 2/12/2026 11:37 AM, Frederic Peters wrote: > > I wrote: > > > >>I'm available for anything that would help debugging this. > > > > Looking further (in my case) it's related to apparmor, > > > > kernel: audit: type=1400 audit(1770913688.152:456): apparmor="DENIED" > > operation="exec" class="file" profile="/usr/bin/evince" > > name="/usr/bin/bwrap" pid=34166 comm="blocking-2" requested_mask="x" > > denied_mask="x" fsuid=1000 ouid=0 > > > > Switching evince to complain mode (aa-complain > > /etc/apparmor.d/usr.bin.evince) > > allowed it to start. > > > > Shawn, maybe aa-complain /etc/apparmor.d/usr.bin.thunderbird would fix > > it for you? (aa-complain is part of apparmor-utils). > > > > > > Frederic > > > > > > I am not the reporter of this bug (Shawn) but I am seeing the exact same > problem > with Thunderbird on sid after the gdk-pixbuf+glycin transition. The > aa-complain > workaround does fix Thunderbird on sid on my box. Thanks, Frederic! > > FWIW, here are the related apparmor messages I am getting after setting > apparmor > complain mode for Thunderbird, as it relates to glycin loaders: > > test@debian:~$ sudo journalctl -b --no-pager | grep audit | grep thunderbird > | grep glycin > Feb 14 13:38:31 debian kernel: audit: type=1400 audit(1771094311.887:1074): > apparmor="ALLOWED" operation="exec" class="file" profile="thunderbird" > name="/usr/libexec/glycin-loaders/2+/glycin-svg" pid=7225 > comm="gly-hdl-loader" requested_mask="x" denied_mask="x" fsuid=1000 ouid=0 > target="thunderbird//null-/usr/libexec/glycin-loaders/2+/glycin-svg" > Feb 14 13:38:31 debian kernel: audit: type=1400 audit(1771094311.887:1075): > apparmor="ALLOWED" operation="file_mmap" class="file" > profile="thunderbird//null-/usr/libexec/glycin-loaders/2+/glycin-svg" > name="/usr/libexec/glycin-loaders/2+/glycin-svg" pid=7225 comm="glycin-svg" > requested_mask="r" denied_mask="r" fsuid=1000 ouid=0 > Feb 14 13:38:31 debian kernel: audit: type=1400 audit(1771094311.887:1076): > apparmor="ALLOWED" operation="file_mmap" class="file" > profile="thunderbird//null-/usr/libexec/glycin-loaders/2+/glycin-svg" > name="/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2" pid=7225 > comm="glycin-svg" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0 > Feb 14 13:39:02 debian kernel: audit: type=1400 audit(1771094342.068:1271): > apparmor="ALLOWED" operation="signal" class="signal" profile="thunderbird" > pid=7085 comm="gly-global-exec" requested_mask="send" denied_mask="send" > signal=kill > peer="thunderbird//null-/usr/libexec/glycin-loaders/2+/glycin-image-rs" > Feb 14 13:39:07 debian kernel: audit: type=1400 audit(1771094347.180:1272): > apparmor="ALLOWED" operation="signal" class="signal" profile="thunderbird" > pid=7085 comm="gly-global-exec" requested_mask="send" denied_mask="send" > signal=kill peer="thunderbird//null-/usr/libexec/glycin-loaders/2+/glycin-svg" > Feb 14 13:42:05 debian kernel: audit: type=1400 audit(1771094525.777:2390): > apparmor="ALLOWED" operation="signal" class="signal" profile="thunderbird" > pid=8238 comm="gly-global-exec" requested_mask="send" denied_mask="send" > signal=kill > peer="thunderbird//null-/usr/libexec/glycin-loaders/2+/glycin-image-rs" > Feb 14 13:42:06 debian kernel: audit: type=1400 audit(1771094526.261:2391): > apparmor="ALLOWED" operation="signal" class="signal" profile="thunderbird" > pid=8238 comm="gly-global-exec" requested_mask="send" denied_mask="send" > signal=kill peer="thunderbird//null-/usr/libexec/glycin-loaders/2+/glycin-svg" > test@debian:~$ > > Thanks again, > > Chuck, a Debian tester
FYI, after setting thunderbird back to enforce mode and causing Thunderbird to fail to launch, here are the related apparmor messages related to thunderbird (note there is no mention of glycin in these messages but there are mentions of bwrap): Feb 14 14:20:13 debian kernel: audit: type=1400 audit(1771096813.204:2392): apparmor="STATUS" operation="profile_replace" profile="unconfined" name="thunderbird" pid=11854 comm="apparmor_parser" Feb 14 14:20:13 debian kernel: audit: type=1400 audit(1771096813.244:2393): apparmor="STATUS" operation="profile_replace" info="same as current profile, skipping" profile="unconfined" name="thunderbird//browser_java" pid=11854 comm="apparmor_parser" Feb 14 14:20:13 debian kernel: audit: type=1400 audit(1771096813.260:2394): apparmor="STATUS" operation="profile_replace" info="same as current profile, skipping" profile="unconfined" name="thunderbird//browser_openjdk" pid=11854 comm="apparmor_parser" Feb 14 14:20:13 debian kernel: audit: type=1400 audit(1771096813.264:2395): apparmor="STATUS" operation="profile_replace" profile="unconfined" name="thunderbird//gpg" pid=11854 comm="apparmor_parser" Feb 14 14:20:13 debian kernel: audit: type=1400 audit(1771096813.264:2396): apparmor="STATUS" operation="profile_replace" info="same as current profile, skipping" profile="unconfined" name="thunderbird//sanitized_helper" pid=11854 comm="apparmor_parser" Feb 14 14:20:18 debian kernel: audit: type=1400 audit(1771096818.944:2397): apparmor="DENIED" operation="userns_create" class="namespace" profile="thunderbird" pid=11856 comm="thunderbird" requested="userns_create" denied="userns_create" Feb 14 14:20:18 debian kernel: audit: type=1400 audit(1771096818.976:2398): apparmor="DENIED" operation="mknod" class="file" profile="thunderbird" name="/run/user/1000/wayland-proxy-11856" pid=11856 comm="thunderbird" requested_mask="c" denied_mask="c" fsuid=1000 ouid=1000 Feb 14 14:20:19 debian kernel: audit: type=1400 audit(1771096819.060:2399): apparmor="DENIED" operation="exec" class="file" profile="thunderbird" name="/usr/lib/thunderbird/glxtest" pid=11876 comm="thunderbird" requested_mask="x" denied_mask="x" fsuid=1000 ouid=0 Feb 14 14:20:19 debian kernel: audit: type=1400 audit(1771096819.152:2400): apparmor="DENIED" operation="open" class="file" profile="thunderbird" name="/proc/11856/oom_score_adj" pid=11856 comm="thunderbird" requested_mask="w" denied_mask="w" fsuid=1000 ouid=1000 Feb 14 14:20:19 debian kernel: audit: type=1400 audit(1771096819.152:2401): apparmor="DENIED" operation="open" class="file" profile="thunderbird" name="/proc/11856/cgroup" pid=11856 comm="thunderbird" requested_mask="r" denied_mask="r" fsuid=1000 ouid=1000 Feb 14 14:20:19 debian kernel: audit: type=1400 audit(1771096819.208:2402): apparmor="DENIED" operation="open" class="file" profile="thunderbird" name="/sys/devices/virtual/dmi/id/product_name" pid=11856 comm="thunderbird" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0 Feb 14 14:20:19 debian kernel: audit: type=1400 audit(1771096819.208:2403): apparmor="DENIED" operation="open" class="file" profile="thunderbird" name="/sys/devices/virtual/dmi/id/product_sku" pid=11856 comm="thunderbird" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0 Feb 14 14:20:19 debian kernel: audit: type=1400 audit(1771096819.348:2404): apparmor="DENIED" operation="file_inherit" class="net" info="failed af match" error=-13 profile="thunderbird//sanitized_helper" pid=11963 comm="bwrap" family="netlink" sock_type="raw" protocol=0 requested_mask="send receive" denied_mask="send receive" Feb 14 14:20:19 debian kernel: audit: type=1400 audit(1771096819.348:2405): apparmor="DENIED" operation="open" class="file" info="Failed name lookup - disconnected path" error=-13 profile="thunderbird//sanitized_helper" name="apparmor/.null" pid=11963 comm="bwrap" requested_mask="wr" denied_mask="wr" fsuid=1000 ouid=0 Feb 14 14:20:19 debian kernel: audit: type=1400 audit(1771096819.348:2406): apparmor="DENIED" operation="getattr" class="file" info="Failed name lookup - disconnected path" error=-13 profile="thunderbird//sanitized_helper" name="" pid=11963 comm="bwrap" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0 Cheers
