Am 07.02.25 um 07:22 schrieb Sam Pinkus:
Hi.
I got this in apparmor audit log for default libreoffice profile that comes
with bookworm:
[27118.174724] audit: type=1400 audit(1738906497.646:1570): apparmor="ALLOWED" operation="open"
profile="libreoffice-soffice" name="/home/sam/.thunderbird/profiles.ini" pid=45330 comm="soffice.bin"
requested_mask="r" denied_mask="r" fsuid=1000 ouid=1000
[27118.177129] audit: type=1400 audit(1738906497.646:1571): apparmor="ALLOWED" operation="open"
profile="libreoffice-soffice" name="/home/sam/.thunderbird/vk9x5555.default/cert9.db" pid=45330 comm="soffice.bin"
requested_mask="wrc" denied_mask="wrc" fsuid=1000 ouid=1000
[27118.177134] audit: type=1400 audit(1738906497.646:1572): apparmor="ALLOWED" operation="file_lock"
profile="libreoffice-soffice" name="/home/sam/.thunderbird/vk9x5555.default/cert9.db" pid=45330 comm="soffice.bin"
requested_mask="k" denied_mask="k" fsuid=1000 ouid=1000
[27118.177316] audit: type=1400 audit(1738906497.646:1573): apparmor="ALLOWED" operation="open"
profile="libreoffice-soffice" name="/home/sam/.thunderbird/vk9x5555.default/key4.db" pid=45330 comm="soffice.bin"
requested_mask="wrc" denied_mask="wrc" fsuid=1000 ouid=1000
[27118.177373] audit: type=1400 audit(1738906497.646:1574): apparmor="ALLOWED" operation="file_lock"
profile="libreoffice-soffice" name="/home/sam/.thunderbird/vk9x5555.default/key4.db" pid=45330 comm="soffice.bin"
requested_mask="k" denied_mask="k" fsuid=1000 ouid=1000
Can't see a reason libreoffice would be reaching in there. Seems very strange,
but noticed some rules in the profile for cert9.db in firefox data, so maybe
it's legit??
It is.
(Looking up certificates for signing. Usually firefox, but..)
Regards,
Rene
