Bug#899380: libreoffice-common: AppArmor profile prohibits encrypting documents with GPG

[Rene Engelhard <rene@debian.org>]

On Wed, May 23, 2018 at 10:22:24AM -0400, John Scott wrote:
> With Java 10 installed, I also get this:
> 
> apparmor="ALLOWED" operation="exec" profile="libreoffice-soffice" name="/usr/lib/jvm/java-10-openjdk-amd64/bin/java" pid=2320 comm="osl_executeProc" requested_mask="x" denied_mask="x" fsuid=1000 ouid=0 target="libreoffice-soffice//null-/usr/lib/jvm/java-10-openjdk-amd64/bin/java"
> 
> I don't know much about AppArmor, but I noticed the
> profile has this line in it:
> 
> /usr/lib{,32,64}/jvm/**/jre/bin/java	mix,
> 
> which only differs from the path LibreOffice was
> accessing by there being no jre/ in the latter, if
> that could explain the cause.

Looks like Java 8 has jre/java and 9 and 10 only bin/java, so I did

$ git diff HEAD^^ HEAD sysui/desktop/apparmor/program.soffice.bin
diff --git a/sysui/desktop/apparmor/program.soffice.bin b/sysui/desktop/apparmor/program.soffice.bin
index 8ce7cbc171c1..2fc7fd6b5735 100644
--- a/sysui/desktop/apparmor/program.soffice.bin
+++ b/sysui/desktop/apparmor/program.soffice.bin
@@ -143,6 +143,7 @@ profile libreoffice-soffice INSTDIR-program/soffice.bin {
   /usr/lib{,32,64}/jvm/                         r,
   /usr/lib{,32,64}/jvm/**                       r,
   /usr/lib{,32,64}/jvm/**/jre/bin/java          mix,
+  /usr/lib{,32,64}/jvm/**/bin/java              mix,
   INSTDIR-**                        rw,
   INSTDIR-**.so                     m,
   INSTDIR-program/soffice.bin       mix,

upstream. Thanks for the pointer.

Regards,

Rene