Hi Carsten, Carsten Schoenert (2026-02-14): >> Feb 14 14:20:19 debian kernel: audit: type=1400 audit(1771096819.060:2399): >> apparmor="DENIED" operation="exec" class="file" profile="thunderbird" >> name="/usr/lib/thunderbird/glxtest" pid=11876 comm="thunderbird" >> requested_mask="x" denied_mask="x" fsuid=1000 ouid=0 > > You might need to add something similar to this within the profile. > >> /usr/lib/thunderbird/glxtest ixr, > > glxtest is needed since some versions Thunderbird is able to start.
Yup. I've been trying since November 2024 to upstream Tails' updates, such as this one, to the AppArmor profile: https://gitlab.com/apparmor/apparmor-profiles/-/merge_requests/61 A few weeks ago, I've sent a last call for collaboration there. No reply so far. So, my next step, as announced on that MR a while ago, is to remove the AppArmor profile from the Debian package in sid: without a collaborative effort upstream, there's no good way for me to keep maintaining it for Debian, with an amount of effort that I can justify. Given the profile is so widely open and disabled by default, that's not the end of the world. Not all experiments succeed, it's OK. Thoughts? If this works for you, I'll prepare a MR. Thanks a lot for your patience so far, cheers, -- intrigeri
