Re: Let's enable AppArmor by default (why not?)

[intrigeri <intrigeri@debian.org>]

Hi,

Ben Caradoc-Davies:
> On 18/11/17 14:34, Ben Caradoc-Davies wrote:
>> On 18/11/17 04:27, intrigeri wrote:
>>> Thanks in advance, and sorry for any inconvenience it may cause (e.g.
>>> the AppArmor policy for Thunderbird has various issues in sid; all of
>>> those I'm aware of are fixed in experimental already).
>> Where "various issues" means no thunderbird external helpers work under xfce.
>> Not a single one, as far as I can tell. And there goes another one: what happened
>> to my .signature? I have filed as many bugs as I can given the time available.
>> I will file one more for the missing .signature, and then I am disabling apparmor.

Thanks.

The last 9 days have taught us that it's too hard to confine
Thunderbird with AppArmor meaningfully without breaking at least some
common use cases. We've fixed a bunch of bugs but some use cases
really can't be fixed without making the AppArmor policy essentially
useless. Not a big surprise, it was probably worth trying, but let's
be realistic and move on: Thunderbird will ship its AppArmor profile
disabled by default soon (#882672); users may choose to opt-in.

Cheers,
-- 
intrigeri