Hello Dirk,
On Sun, Dec 31, 2017 at 11:28:12PM +0100, Dirk Heinrichs wrote:
> Am 31.12.2017 um 12:05 schrieb Carsten Schoenert:
>
> > You don't provide any information about the state of your machine before
> > you startetd the update nor after the update. You also don't have
> > appended any logging information, so how can I unpuzzle that and see
> > what was going maybe wrong?
>
> What kind of logging information? It's a desktop program. There is no log.
yes, Thunderbird is a desktop application, but also Thunderbird is doing
some output while it is starting and also while running. It's just not
going any visible STOUT if started by the desktop entry.
But this kind of log I didn't mean here.
For me interesting is the log information from the update process by
apt/dpkg.
> > Did you update from 1:52.5.0-1~deb9u1?
>
> Yes.
This version has disabled the apparmor profile and 1:52.5.2-2~ is
respecting this. This was one of the bug reports was about which is
fixed by this new version.
So you normally you didn't have see such a problem related to AppArmor.
On the other side if people have enabled the AppArmor profile after the
installation or update to 1:52.5.0-1~ an update to 1:52.5.2-2~ isn't
disabling that running profile!
> > Did you had enabled AppArmor in the old version and was running before you
> > started the update?
>
> How does one enable AppArmor _IN_ TB? At least the package was
> installed, but there was no process running.
What make you sure there was no AppArmor profile running and active
before the update of the thunderbird package? And this would be the
question in the end. But you can't clarify this now and I must guess the
AppArmor profile was active before the update.
> > What messages was coming along the update?
>
> Really? The usual messages from apt-get update telling me that TB
> related packages have been updated.
Yes, there is a reason why apt/dpkg are bringing logging messages, and
yes, we can mostly see based on this output if something was going wrong
here. Not always but exactly here we would see if the AppArmor profile
are not been enabled for Thunderbird.
> > Please take a look into /var/log/apt/history.log and
> > /var/log/apt/term.log.
> What should I find there, except:
>
> (term.log)
> Vorbereitung zum Entpacken von
> .../08-thunderbird_1%3a52.5.2-2~deb9u1_amd64.deb ...
> Entpacken von thunderbird (1:52.5.2-2~deb9u1) über (1:52.5.0-1~deb9u1) ...
> ...
> thunderbird (1:52.5.2-2~deb9u1) wird eingerichtet ...
> Neue Version der Konfigurationsdatei /etc/apparmor.d/usr.bin.thunderbird
> wird installiert ...
your snippets are a bit short to see if there was no active AppArmor
profile for Thunderbird, if so you would have seen this one extra line
from AppArmor.
> Entpacken von calendar-google-provider (1:52.5.2-1) über (1:52.4.0-1) ...
> Trigger für mime-support (3.60) werden verarbeitet ...
> Trigger für desktop-file-utils (0.23-2) werden verarbeitet ...
> thunderbird (1:52.5.2-1) wird eingerichtet ...
> Neue Version der Konfigurationsdatei /etc/apparmor.d/usr.bin.thunderbird wird
> installiert ...
> Neue Version der Konfigurationsdatei /etc/thunderbird/pref/thunderbird.js
> wird installiert ...
> Skipping profile in /etc/apparmor.d/disable: usr.bin.thunderbird <-----
> lightning (1:52.5.2-1) wird eingerichtet ...
> thunderbird-l10n-de (1:52.5.2-1) wird eingerichtet ...
...
> > Do you use a "normal" profile path /home/$USER/.{icedove,thunderbird}?
>
> Yes.
>
> So, from the beginning:
>
> 1) I had TB 52.5.0-1~deb9u1 installed, and it was working for all users
> 2) I got an update to 52.5.2-2~deb9u1, restarted TB but instead got the
> message "Your Thunderbird profile cannot be loaded. It may be
> missing or inaccessible.", same for other users on the same
> machine.
That lets assume me that AppArmor was running and the profile for
Thunderbird was active. Please see report #882487 about this error
message.
> 3) Downgraded back to 52.5.0-1~deb9u1, rebooted and TB was working fine
> again (wasn't working before the reboot).
By this you have disabled the AppArmor profile as this version is doing
this by the "hard" way. But only be setting up the symlink in
/etc/apparmor.d/disable without triggering AppArmor to reload the active
profiles. Please not the NEWS entry for 1:52.5.0-1~
> 4) Repeated step 2), same result, so downgraded and rebooted again.
> 5) Remembered that I saw the message about the new version of the
> apparmor file while upgrading, so I
> 6) Uninstalled apparmor, retried the upgrade, message about inaccessible
> profile was gone and new version was working fine.
with a removed apparmor package obviously no AppArmor issues will be
visible anymore, so this "solves" the vissible problems for you but not
the problems the current AA profile for Thunderbird has.
If you don't need or want AppArmor this is fine if you just remove this
package.
The root of the problems you have seen are simply a not fine granulared
AA profile. If interessted you can take a look at the syslog an search
for blocked access while Thunderbird is running with a active AA
profile.
$ sudo journalctl -kaf --no-hostname | grep -w 'apparmor="DENIED"'
Some research on the AppArmor wiki site will also show some additional
information.
https://wiki.debian.org/AppArmor
> So I guess something with "Neue Version der Konfigurationsdatei
> /etc/apparmor.d/usr.bin.thunderbird" is wrong.
Yes and no. There are of course some corner cases left ther this profile
isn't working as expected. But without some user feedback and fixes for
the profile this won't change much. And of course there are just a few
people out were which can provide some real issue fixes. And this was
the reason for disable the AA profile with version 1:52.5.0-1~
I guess this bug report is no clear and can be closed, at least in my
eyes.
Regards
Carsten
