Question about apparmor and thunderbird

[Sam Pinkus <sgpinkus@gmail.com>]

    Hi.
    
    I got this in apparmor audit log for default libreoffice profile
    that comes with bookworm:
    
> [27118.174724] audit: type=1400
>       audit(1738906497.646:1570): apparmor="ALLOWED" operation="open"
>       profile=""
>       name="/home/sam/.thunderbird/profiles.ini" pid=45330
>       comm="soffice.bin" requested_mask="r" denied_mask="r" fsuid=1000
>       ouid=1000
>       [27118.177129] audit: type=1400 audit(1738906497.646:1571):
>       apparmor="ALLOWED" operation="open" profile=""
>       name="/home/sam/.thunderbird/vk9x5555.default/cert9.db" pid=45330
>       comm="soffice.bin" requested_mask="wrc" denied_mask="wrc"
>       fsuid=1000 ouid=1000
>       [27118.177134] audit: type=1400 audit(1738906497.646:1572):
>       apparmor="ALLOWED" operation="file_lock"
>       profile=""
>       name="/home/sam/.thunderbird/vk9x5555.default/cert9.db" pid=45330
>       comm="soffice.bin" requested_mask="k" denied_mask="k" fsuid=1000
>       ouid=1000
>       [27118.177316] audit: type=1400 audit(1738906497.646:1573):
>       apparmor="ALLOWED" operation="open" profile=""
>       name="/home/sam/.thunderbird/vk9x5555.default/key4.db" pid=45330
>       comm="soffice.bin" requested_mask="wrc" denied_mask="wrc"
>       fsuid=1000 ouid=1000
>       [27118.177373] audit: type=1400 audit(1738906497.646:1574):
>       apparmor="ALLOWED" operation="file_lock"
>       profile=""
>       name="/home/sam/.thunderbird/vk9x5555.default/key4.db" pid=45330
>       comm="soffice.bin" requested_mask="k" denied_mask="k" fsuid=1000
>       ouid=1000
>     
    Can't see a reason libreoffice would be reaching in there. Seems
    very strange, but noticed some rules in the profile for cert9.db in
    firefox data, so maybe it's legit??
    
    Thanks,
    
    Sam.