Apparmor, open link in Browser, Thunderbird, Debian9



  • Hi all,

    i have a problem with opening links in Vivaldi (1.13.1008.34 (Stable channel) (64-bit)) via Thunderbird (52.4.0 (64-bit)).

    uname -a
    Linux sun 4.13.0-1-amd64 #1 SMP Debian 4.13.13-1 (2017-11-16) x86_64 GNU/Linux.

    Vivaldi is set systemwide as my preferred browser. Thunderbird has it as the preferred action to open http/https links with my standard browser. I`ve tried also with the path to the browser (/opt/vivaldi/vivaldi) in the config of Thunderbird, but it didn't work.

    I've checked with
    tail -f /var/log/messages:
    Dec 6 09:19:09 sun kernel: [17764.341411] audit: type=1400 audit(1512548349.389:549): apparmor="DENIED" operation="exec" profile="thunderbird" name="/opt/vivaldi/vivaldi" pid=10791 comm="thunderbird" requested_mask="x" denied_mask="x" fsuid=1000 ouid=0

    This comes up, when i click on links in Thunderbird to open it with Vivaldi.

    When i change my standard browser i.e. to Chrome or Firefox, it works. It is possible to open links in mails with my standard browser. When i go back to Vivaldi as my standard browser the apparmor message comes up and it is not possible to open links in mails.

    I'v tried also a complete reinstallation of Thunderbird and Vivaldi. Same problem.

    I've found this:
    https://git.launchpad.net/~u-d/apparmor-profiles/commit/?h=thunderbird/links&id=524a9cd0ca1680761094aed1901e3c217579e845

    These patch is inside the profile /etc/apparmor.d/usr.bin.thunderbird. I 've didn't change anything in the profile.

    When i stop apparmor with
    # /etc/init.d/apparmor teardown
    it is possible to open links via Thunderbird with Vivaldi.

    Any ideas?

    regards
    Ytre



  • when i start my system with kernel 4.12 it works. It is possible to open links in Thunderbird mail in Vivaldi

    $uname -a
    Linux sun 4.12.0-2-amd64 #1 SMP Debian 4.12.13-1 (2017-09-19) x86_64 GNU/Linux


  • Moderator

    Works on my Debian 9.2 Stretch {SMP Debian 4.9.51-1 (2017-09-28) x86_64 GNU/Linux} with KDE 5 Plasma.
    My Thunderburd has no apparmor fails.



  • Although the original post is two months old, I'd like to put some information on it.

    1. This is clearly an Apparmor issue. The "error message" that 'ytre' shows in the original post shows this. It also gives you all of the information that you need to solve this issue. But before you do, you need to look at the issue in more detail.
    2. Apparmor is there to protect you from malicious execution of programs on your computer (amongst other security/privacy issues). Before an application program can access or execute a file, its Apparmor profile (assuming it has one. See later) is checked to see if it is allowed.
    3. Firefox and Chromium browsers have Apparmor profiles (use 'sudo aa-status' in a terminal to see which application programs on your computer have active profiles and whether they are in enforce or complain - show error messages but don't stop the application program from doing whatever it is doing - mode). As far as I can find, there is no Apparmor profile for the Vivaldi browser. This means that when you are using the Vivaldi browser, Apparmor is not protecting you. This is an important consideration to think through before resolving your (original) Thunderbird/Apparmor issue.
    4. If you still want to resolve the issue with Thunderbird/Apparmor then:
      a) start your favourite text editor in super user mode (a number of ways to do this - enter 'sudo gedit' in a terminal to start the gedit editor, or run a program from your desktop and enter - in Gnome - 'gksudo gendit' or - in KDE - 'kdesu kate').
      b) within the text editor, open the file '/etc/apparmor.d/local/usr.bin.thunderbird' (obviously without the inverted commas).
      c) enter the line '/opt/vivaldi/vivaldi mixr,' (again, without the inverted commas) and yes the comma at the end of the line is meant and must be entered.
      d) save the file
      e) either reboot (to reload all of Apparmor) or in a terminal enter 'sudo apparmor_parser -r /etc/apparmor.d/usr.bin.thunderbird' to just reload Thunderbirds (but you will have to restart Thunderbird itself, to make it use the amended profile).

    cheers
    Nerderello


 

Looks like your connection to Vivaldi Forum was lost, please wait while we try to reconnect.