Bug#899380: libreoffice-common: AppArmor profile prohibits encrypting documents with GPG
On Wed, May 23, 2018 at 10:22:24AM -0400, John Scott wrote:
> With Java 10 installed, I also get this:
>
> apparmor="ALLOWED" operation="exec" profile="libreoffice-soffice" name="/usr/lib/jvm/java-10-openjdk-amd64/bin/java" pid=2320 comm="osl_executeProc" requested_mask="x" denied_mask="x" fsuid=1000 ouid=0 target="libreoffice-soffice//null-/usr/lib/jvm/java-10-openjdk-amd64/bin/java"
>
> I don't know much about AppArmor, but I noticed the
> profile has this line in it:
>
> /usr/lib{,32,64}/jvm/**/jre/bin/java mix,
>
> which only differs from the path LibreOffice was
> accessing by there being no jre/ in the latter, if
> that could explain the cause.
Looks like Java 8 has jre/java and 9 and 10 only bin/java, so I did
$ git diff HEAD^^ HEAD sysui/desktop/apparmor/program.soffice.bin
diff --git a/sysui/desktop/apparmor/program.soffice.bin b/sysui/desktop/apparmor/program.soffice.bin
index 8ce7cbc171c1..2fc7fd6b5735 100644
--- a/sysui/desktop/apparmor/program.soffice.bin
+++ b/sysui/desktop/apparmor/program.soffice.bin
@@ -143,6 +143,7 @@ profile libreoffice-soffice INSTDIR-program/soffice.bin {
/usr/lib{,32,64}/jvm/ r,
/usr/lib{,32,64}/jvm/** r,
/usr/lib{,32,64}/jvm/**/jre/bin/java mix,
+ /usr/lib{,32,64}/jvm/**/bin/java mix,
INSTDIR-** rw,
INSTDIR-**.so m,
INSTDIR-program/soffice.bin mix,
upstream. Thanks for the pointer.
Regards,
Rene
Reply to: