Hi.
I got this in apparmor audit log for default libreoffice profile that
comes with bookworm:
[27118.174724] audit: type=1400 audit(1738906497.646:1570):
apparmor="ALLOWED" operation="open" profile="libreoffice-soffice"
name="/home/sam/.thunderbird/profiles.ini" pid=45330
comm="soffice.bin" requested_mask="r" denied_mask="r" fsuid=1000
ouid=1000
[27118.177129] audit: type=1400 audit(1738906497.646:1571):
apparmor="ALLOWED" operation="open" profile="libreoffice-soffice"
name="/home/sam/.thunderbird/vk9x5555.default/cert9.db" pid=45330
comm="soffice.bin" requested_mask="wrc" denied_mask="wrc" fsuid=1000
ouid=1000
[27118.177134] audit: type=1400 audit(1738906497.646:1572):
apparmor="ALLOWED" operation="file_lock"
profile="libreoffice-soffice"
name="/home/sam/.thunderbird/vk9x5555.default/cert9.db" pid=45330
comm="soffice.bin" requested_mask="k" denied_mask="k" fsuid=1000
ouid=1000
[27118.177316] audit: type=1400 audit(1738906497.646:1573):
apparmor="ALLOWED" operation="open" profile="libreoffice-soffice"
name="/home/sam/.thunderbird/vk9x5555.default/key4.db" pid=45330
comm="soffice.bin" requested_mask="wrc" denied_mask="wrc" fsuid=1000
ouid=1000
[27118.177373] audit: type=1400 audit(1738906497.646:1574):
apparmor="ALLOWED" operation="file_lock"
profile="libreoffice-soffice"
name="/home/sam/.thunderbird/vk9x5555.default/key4.db" pid=45330
comm="soffice.bin" requested_mask="k" denied_mask="k" fsuid=1000
ouid=1000
Can't see a reason libreoffice would be reaching in there. Seems very
strange, but noticed some rules in the profile for cert9.db in firefox
data, so maybe it's legit??
Thanks,
Sam.
