Bug#961269: thunderbird: DENIED operation="mkdir" name=/run/user/ /dconf requested_mask="c"

[Vincas Dargis]

xiscu, could you please create `/etc/apparmor.d/local/usr.bin.thunderbird` file 
with this rule:

owner /run/user/[0-9]*/dconf/ w,

After that, restart AppArmor with `sudo systemctl restart apparmor`. Then, try starting Thunderbird 
again, and see if that error is gone?

Bug#961269: thunderbird: DENIED operation="mkdir" name=/run/user/ /dconf requested_mask="c"

[Vincas Dargis]

Control: reassign -1 thunderbird

Reassigning to thunderbird, as it ships it's AppArmor profile itself.

We have this rule there:

owner /run/user/[0-9]*/dconf/user rw,

But it it does not handle the case when parent dir is missing. It does not reproduce in my KDE 
desktop. Maybe you use some minimal desktop where Thunderbird is the first that deals with that 
dconf stuff?


Anyhow, we should update thunderbird profile.

Bug#961269: thunderbird: DENIED operation="mkdir" name=/run/user/ /dconf requested_mask="c"

[xiscu]

Package: apparmor
Version: 2.13.4-1+b1
Severity: minor

Dear Maintainer,
I'm getting apparmor DENIED audit messages on the logs concerning thunderbird:

 audit[24604]: AVC apparmor="DENIED" operation="mkdir" profile="thunderbird" 
name="/run/user/1000/dconf/" pid=24604 comm="thunderbird" requested_mask="c" 
denied_mask="c" fsuid=1000 ouid=1000
 audit: type=1400 audit(1590141596.662:242): apparmor="DENIED" 
operation="mkdir" profile="thunderbird" name="/run/user/1000/dconf/" pid=24604 
comm="thunderbird" requested_mask="c" denied_mask="c" fsuid=1000 ouid=1000

I keep showing the logs with:

> journalctl -l

and then I start thunderbird

Thanks in advance!
xiscu

-- System Information:
Debian Release: bullseye/sid
  APT prefers testing
  APT policy: (900, 'testing'), (10, 'unstable'), (1, 'experimental')
Architecture: amd64 (x86_64)

Kernel: Linux 5.6.0-1-amd64 (SMP w/4 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), 
LANGUAGE=en_US:en (charmap=UTF-8)
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages apparmor depends on:
ii  debconf [debconf-2.0]  1.5.74
ii  libc6  2.30-8
ii  lsb-base   11.1.0
ii  python33.8.2-3

apparmor recommends no packages.

Versions of packages apparmor suggests:
ii  apparmor-profiles-extra  1.27
ii  apparmor-utils   2.13.4-1+b1

-- debconf information:
  apparmor/homedirs: