AppArmor preventing Icedove from updating to Thunderbird.

Qubes-Whonix
#1

With the latest Icedove update they are going back to the Thunderbrand brand which involves copying of the Icedove profile upon first start of the updated Icedove/Thunderbird.
However apparmour seems to blocks this. There are 5 denied messages in the tray.

Being the newbie I am how ot make it update and be able to actually start thunderbird :slight_smile:

The update is from yesterday I believe, slightly surprised no one else has reported this. Is it that obvious to fix? :slight_smile:

#2

Hi,

Already reported->

http://forums.kkkkkkkkkk63ava6.onion/t/thunderbird-enigmail-denied-executing-split-gpg/3796

Disabling AppArmor profile for Thunderbird/Icedove is not an option in the meantime?

1 Like
#3

No idea how to do that either :slight_smile:

#4

The profile unloading section here should help. There is a wikipage for everything around here, even if it is a work in progress :slight_smile:

Info around Qubes AppArmor. FYI.

Note if you set kernel settings back to “nopat” in the whonix-ws TemplateVM (black one), the AppVM will inherit the kernel settings i.e. upon restart → no apparmor running. Not elegant, but will definitely work.

1 Like
#5

Thank you! For anyone else newbie like me, all you have to do dis
"sudo aa-disable /etc/apparmor.d/usr.bin.thunderbird" Thunderbird starts after that.

Torjunkie, what are the potential risks of running it without the profile?

#6

Hi,

I think this summary from the security guide gives you a fair idea of the protections around AppArmor and what you lose when you disable it:

http://kkkkkkkkkk63ava6.onion/wiki/Security_Guide#AppArmor

Cheers