Thanks for your tips. Indeed AppArmor is now standard enabled in Debian 10 (buster).
I could check some things in AppArmor and there is something missing / fail. In /etc/apparmor there is only 1,6K Mär 30 14:23 parser.conf Where can i find the configuration files? Checking the status i get # aa-status apparmor module is loaded. 34 profiles are loaded. 32 profiles are in enforce mode. /usr/bin/evince /usr/bin/evince-previewer /usr/bin/evince-previewer//sanitized_helper /usr/bin/evince-thumbnailer /usr/bin/evince//sanitized_helper /usr/bin/man /usr/lib/cups/backend/cups-pdf /usr/lib/telepathy/mission-control-5 /usr/lib/telepathy/telepathy-* /usr/lib/telepathy/telepathy-*//pxgsettings /usr/lib/telepathy/telepathy-*//sanitized_helper /usr/lib/telepathy/telepathy-ofono /usr/lib/x86_64-linux-gnu/lightdm/lightdm-guest-session /usr/lib/x86_64-linux-gnu/lightdm/lightdm-guest-session//chromium /usr/sbin/cups-browsed /usr/sbin/cupsd /usr/sbin/cupsd//third_party /usr/sbin/haveged /usr/sbin/mysqld-akonadi /usr/sbin/mysqld-akonadi///usr/sbin/mysqld libreoffice-senddoc libreoffice-soffice//gpg libreoffice-xpdfimport man_filter man_groff nvidia_modprobe nvidia_modprobe//kmod thunderbird thunderbird//browser_java thunderbird//browser_openjdk thunderbird//gpg thunderbird//sanitized_helper 2 profiles are in complain mode. libreoffice-oopslash libreoffice-soffice 3 processes have profiles defined. 3 processes are in enforce mode. /usr/sbin/cups-browsed (667) /usr/sbin/cupsd (609) /usr/sbin/haveged (561) 0 processes are in complain mode. 0 processes are unconfined but have a profile defined. # aa-complain thunderbird Setting /usr/bin/thunderbird to complain mode. ERROR: /etc/apparmor.d/usr.bin.thunderbird doesn't contain a valid profile for /usr/bin/thunderbird (syntax error?) How can Thunderbird be deactivated in AppArmor?
