[apparmor] [Bug 1727993] [NEW] Thunderbird profile should transition to Evince/Totem profiles when running them to open attachments

[intrigeri]

Public bug reported:

With the current Thunderbird profile Evince & Totem are run under
sanitized_helper, while some distros ship stricter dedicated profiles
for them. This feels wrong.

As written on https://code.launchpad.net/~talkless/apparmor-
profiles/+git/apparmor-profiles/+merge/332870/comments/871711:

IMO we need these rules somewhere on distros that ship the Evince and
Totem profiles:

  /usr/bin/evince Px,
  /usr/bin/totem Px,

I see two ways to do it:

1. Adjust the existing Evince rule in abstractions/ubuntu-
browsers.d/productivity + the existing Totem rule in abstractions
/ubuntu-media-players, and then we include these abstractions in the
Thunderbird profile.

2. Add these rules to the Thunderbird profile.

At first glance it feels like (1) is the cleanest way forward *but* it
has a big drawback: it won't work as intended on distros that don't ship
Evince/Totem profiles, which feels super wrong in abstractions that are
part of the upstream AppArmor tarball. I think that's yet another reason
to sit down, take a deep breath, and rethink how & where we're
maintaining+shipping policy, but IMO we shouldn't block on this here. So
I think (2) is the way to go.

The main drawback of (2) is that any distro that starts shipping the
Thunderbird profile will need to either also ship the Evince and Totem
profiles, or drop these two lines In Debian that's a mere matter of
adding a dependency on apparmor-profiles-extra. Are there other distros
around that already ship the Thunderbird profile *and* would have a
problem with this? I see that Ubuntu does not ship the Thunderbird
profile, but what about openSUSE or Ubuntu future plans?

** Affects: apparmor-profiles
     Importance: Undecided
         Status: New

-- 
You received this bug notification because you are a member of AppArmor
Developers, which is subscribed to AppArmor Profiles.
https://bugs.launchpad.net/bugs/1727993

Title:
  Thunderbird profile should transition to Evince/Totem profiles when
  running them to open attachments

Status in AppArmor Profiles:
  New

Bug description:
  With the current Thunderbird profile Evince & Totem are run under
  sanitized_helper, while some distros ship stricter dedicated profiles
  for them. This feels wrong.

  As written on https://code.launchpad.net/~talkless/apparmor-
  profiles/+git/apparmor-profiles/+merge/332870/comments/871711:

  IMO we need these rules somewhere on distros that ship the Evince and
  Totem profiles:

    /usr/bin/evince Px,
    /usr/bin/totem Px,

  I see two ways to do it:

  1. Adjust the existing Evince rule in abstractions/ubuntu-
  browsers.d/productivity + the existing Totem rule in abstractions
  /ubuntu-media-players, and then we include these abstractions in the
  Thunderbird profile.

  2. Add these rules to the Thunderbird profile.

  At first glance it feels like (1) is the cleanest way forward *but* it
  has a big drawback: it won't work as intended on distros that don't
  ship Evince/Totem profiles, which feels super wrong in abstractions
  that are part of the upstream AppArmor tarball. I think that's yet
  another reason to sit down, take a deep breath, and rethink how &
  where we're maintaining+shipping policy, but IMO we shouldn't block on
  this here. So I think (2) is the way to go.

  The main drawback of (2) is that any distro that starts shipping the
  Thunderbird profile will need to either also ship the Evince and Totem
  profiles, or drop these two lines In Debian that's a mere matter of
  adding a dependency on apparmor-profiles-extra. Are there other
  distros around that already ship the Thunderbird profile *and* would
  have a problem with this? I see that Ubuntu does not ship the
  Thunderbird profile, but what about openSUSE or Ubuntu future plans?

To manage notifications about this bug go to:
https://bugs.launchpad.net/apparmor-profiles/+bug/1727993/+subscriptions