2

Recently I upgraded Debian, from Stretch (v9x) to Buster (v10.2).

Now in Thunderbird (package v68.3.0) when I click a link in an email, my browser (FireFox, v71.0, downloaded, i.e. not packaged) won't open a clicked hyper link.


I'm seeking advise on how to properly fix AppArmor profiles to reasonably work with this newer FireFox.

In other words, if I say $ aa-complain /usr/lib/thunderbird/thunderbird this makes email links work again, and FireFox now opens properly.** (Now this workaround is also broken 2021/05). But it leaves a security hole in AppArmor that I want to fix, if I can.

(I realize that if I had installed the package version of FireFox, rather than the most recent version downloaded from FireFox, that I probably wouldn't have this issue. But I want to have more recent software at times, as I think the most recent version is more likely to be more fully patched in terms of bugs and it's own security holes.)


Here's what I've learned and tried.

  1. Thunderbird has 3 entry points:

    /usr/bin/thunderbird (a smaller executable)

    /usr/lib/thunderbird/thunderbird (a link to the following) /usr/lib/thunderbird/thunderbird-bin (a large executable)

My Cinnamon Menu opens the one in /usr/bin/thunderbird, but this seems to call /usr/lib/thunderbird/thunderbird-bin.

  1. But thunderbird has only one AppArmor profile:

    /etc/apparmor.d/usr.bin.thunderbird

which contains this line #include <abstractions/ubuntu-browsers>, or in other words including this profile file:

/etc/apparmor.d/abstractions/ubuntu-browsers

which then has these two lines relating to firefox:

/usr/bin/firefox Cxr -> sanitized_helper,
/usr/lib{,64}/firefox*/firefox* Cx -> sanitized_helper,
  1. But I don't yet have a firefox AppArmor profile.

So to ignore the missing FireFox profile, I tried changing these last two lines to this:

/opt/firefox/firefox ux,

or this:

/opt/firefox/firefox Uxr -> sanitized_helper,

but AppArmor is still not happy, as I'm seeing this error:

$ aa-complain /usr/bin/firefox
Setting /usr/bin/thunderbird to complain mode.

ERROR: /etc/apparmor.d/usr.bin.thunderbird doesn't contain a valid profile for /usr/bin/thunderbird (syntax error?)

My questions:

How is the best way to start to find and fix this AppArmor syntax error (if that's what it is) in my profiles?

I tried commenting out (removing) sections of ubuntu-browsers but that didn't seem to help.

I also tried running $ /etc/init.d/apparmor restart which succeeds, but still the above error doesn't go away.

I also tried running apparmor_parser --replace -d usr.bin.thunderbird but I get lost in the output.

3
  • But now my workaround described above is also unfortunately broken! ".. if I say $ aa-complain /usr/lib/thunderbird/thunderbird this makes email links work again, and FireFox now opens properly." Commented Jun 5, 2021 at 23:11
  • ERROR: /etc/apparmor.d/usr.bin.thunderbird doesn't contain a valid profile for /usr/bin/thunderbird (syntax error?) becacuse you should aa-complain /usr/lib/thunderbird/thunderbird, not /usr/bin/thunderbird
    – xuhdev
    Commented Mar 25, 2023 at 7:47
  • To solve the problem of web link in Thunderbird in Debian bookworm, see my answer at unix.stackexchange.com/a/740899/38242
    – xuhdev
    Commented Mar 25, 2023 at 19:05

1 Answer 1

0

There is no syntax error. You complained the wrong executable. You should complain /usr/lib/thunderbird/thunderbird instead of /usr/bin/thunderbird:

sudo aa-complain /usr/lib/thunderbird/thunderbird

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .