Bug#883245: thunderbird: Fail to open URI in configured web browser "Permission denied"

C. Mourad Jaber

未讀,

2017年12月1日清晨5:00:032017/12/1

收件者：

Package: thunderbird
Version: 1:52.4.0-2~exp1
Severity: important
Tags: upstream

Dear Maintainer,

I'm clicking on a link into a mail in the experimental version of
thunderbird...

Nothing happened but in the console I get :
** (thunderbird:4592): WARNING **: Could not launch default application for
URI: Failed to execute child process ?/usr/lib/firefox/firefox? (Permission
denied)

All parameters in network.protocol-handler.* are defined to default value...

I tried to change this values but nothing change...

I tried also to change default browser, to use sensible-browser, direct path to
browser in place of "x-www-browser" but no changes...

Regards

C. Mourad Jaber

-- System Information:
Debian Release: buster/sid
APT prefers testing
APT policy: (990, 'testing'), (500, 'unstable'), (500, 'stable'), (1, 'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 4.13.0-1-amd64 (SMP w/4 CPU cores)
Locale: LANG=fr_FR.UTF-8, LC_CTYPE=fr_FR.UTF-8 (charmap=UTF-8), LANGUAGE=fr (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages thunderbird depends on:
ii debianutils 4.8.3
ii fontconfig 2.12.6-0.1
ii libatk1.0-0 2.26.0-2
ii libc6 2.25-2
ii libcairo-gobject2 1.15.8-2
ii libcairo2 1.15.8-2
ii libdbus-1-3 1.12.2-1
ii libdbus-glib-1-2 0.108-3
ii libevent-2.1-6 2.1.8-stable-4
ii libffi6 3.2.1-6
ii libfontconfig1 2.12.6-0.1
ii libfreetype6 2.8.1-0.1
ii libgcc1 1:7.2.0-16
ii libgdk-pixbuf2.0-0 2.36.11-1
ii libglib2.0-0 2.54.1-1
ii libgtk-3-0 3.22.24-3
ii libhunspell-1.6-0 1.6.2-1
ii libpango-1.0-0 1.40.13-2
ii libpangocairo-1.0-0 1.40.13-2
ii libpangoft2-1.0-0 1.40.13-2
ii libpixman-1-0 0.34.0-1
ii libstartup-notification0 0.12-4+b2
ii libstdc++6 7.2.0-16
ii libvpx4 1.6.1-3
ii libx11-6 2:1.6.4-3
ii libx11-xcb1 2:1.6.4-3
ii libxcb-shm0 1.12-1
ii libxcb1 1.12-1
ii libxcomposite1 1:0.4.4-2
ii libxdamage1 1:1.1.4-3
ii libxext6 2:1.3.3-1+b2
ii libxfixes3 1:5.0.3-1
ii libxrender1 1:0.9.10-1
ii libxt6 1:1.1.5-1
ii psmisc 23.1-1
ii x11-utils 7.7+3+b1
ii zlib1g 1:1.2.8.dfsg-5

Versions of packages thunderbird recommends:
ii hunspell-en-us [hunspell-dictionary] 1:2017.08.24
ii hunspell-it [hunspell-dictionary] 1:5.4.3-1
ii lightning 1:52.4.0-2~exp1
ii myspell-fr [myspell-dictionary] 1.4-27

Versions of packages thunderbird suggests:
ii apparmor 2.11.1-3
ii fonts-lyx 2.2.3-2
ii libgssapi-krb5-2 1.15.2-2

-- no debconf information

Juhani Numminen

未讀,

2017年12月4日上午11:10:032017/12/4

收件者：

Control: found -1 thunderbird/1:52.4.0-1

On Fri, 01 Dec 2017 10:46:12 +0100 C. Mourad Jaber
<newb...@nativobject.net> wrote:

> Dear Maintainer,
>
> I'm clicking on a link into a mail in the experimental version of
> thunderbird...
>
> Nothing happened but in the console I get :
> ** (thunderbird:4592): WARNING **: Could not launch default application for
> URI: Failed to execute child process ?/usr/lib/firefox/firefox? (Permission
> denied)
>
> All parameters in network.protocol-handler.* are defined to default value...
>
> I tried to change this values but nothing change...
>
> I tried also to change default browser, to use sensible-browser, direct path to
> browser in place of "x-www-browser" but no changes...

I'm experiencing the same with the version that's currently in testing.
However, I found a workaround: either install thunderbird/1:52.5.0-1
from unstable, or disable the apparmor profile yourself:

sudo ln -s /etc/apparmor.d/usr.bin.thunderbird /etc/apparmor.d/disable/
sudo apparmor_parser -R /etc/apparmor.d/usr.bin.thunderbird

Related bug is #882672.

Mourad, could you please report if either of those workarounds work for you?

Best regards,
Juhani Numminen

C. Mourad Jaber

未讀,

2017年12月5日上午11:40:032017/12/5

收件者：

Package: thunderbird
Followup-For: Bug #883245

Dear Maintainer,

The lastest version in unstable (1:52.5.0-1) seems to have solved this issue...

Thanks for your work

Regards

Mourad

ii lightning 1:52.5.0-1

Vincas Dargis

未讀,

2017年12月5日中午12:50:032017/12/5

收件者：

Although updated AppArmor profile fixes this (and similar) issue, please note that current Thunderbird profile state is
pretty poor security-wise. Decision was made to make it much more permissive in order not to break usability as
Thunderbird profile was enabled by default. Some work in seeded to make it more useful (secure _and_ usable).

Nevertheless, _please_ keep this profile enabled, report more bugs, and be patient and wait for more secure profile
version. Thanks! :-)

Maryse Argouin & Jean Lafontaine

未讀,

2018年2月9日下午5:10:022018/2/9

收件者：

Hi the bug was resolved but is now back with Thunderbird 52.6.0

Thanks!

Jean

Carsten Schoenert

未讀,

2018年2月10日凌晨1:10:032018/2/10

收件者：

Hello,

On Fri, Feb 09, 2018 at 05:02:43PM -0500, Maryse Argouin & Jean Lafontaine wrote:
> Hi the bug was resolved but is now back with Thunderbird 52.6.0

we didn't have closed this report so "officially" this report wasn't ever
marked as resolved.

Don't get me wrong, 'just' saying it's now no working correctly any
longer isn't helping much. Please append some logging where the people
who are working on the apparmor profile can see whats going on under the
hood.

https://wiki.debian.org/AppArmor/Reportbug

Regards
Carsten

Carsten Schoenert

未讀,

2018年2月11日凌晨2:30:022018/2/11

收件者：

[argh, now with the correct bugnumber in CC]

Hello Maryse & Jean,

Am 10.02.2018 um 12:16 schrieb Maryse Argouin & Jean Lafontaine:
> Hello,
>
> I got it, no problem i'm not used to error reporting vocabulary and
> "étiquette"
>
> Here is the error log from Thunderbird error console:

such errors are a bit "normal" and not related to the apparmor profile
issues. Please note Thunderbird don't know anything from a running
apparmor fencing and thus can't do any relation to it.

> Let me know if i can provide or verifiy anything else
Yes, messages from the error console of Thunderbird aren't sufficient
here, the relevant information for debugging the apparmor behavior can
be found by the dmesg or journalctl command like described in the linked
URL I've written in my previous email.

PS: Please use always 'Reply-All' without the CC recipients will be cut
of in your answer. By this your feedback isn't reaching the BTS.

--
Regards
Carsten Schoenert

Maryse Argouin & Jean Lafontaine

未讀,

2018年2月11日下午5:50:032018/2/11

收件者：

I dont know if it's helping but here is what is happening when i click
on a link in Thunderbird 52.6.0 using SolydX EE OS

Output of: sudo journalctl -kaf --no-hostname | grep -w 'apparmor="DENIED"'

fév 11 17:31:49 kernel: audit: type=1400 audit(1518388309.673:180):
apparmor="DENIED" operation="exec" profile="thunderbird"
name="/opt/firefox/firefox" pid=26794 comm="thunderbird"
requested_mask="x" denied_mask="x" fsuid=1000 ouid=0

Jean

intrigeri

未讀,

2018年3月29日下午1:30:032018/3/29

收件者：

Control: tag -1 + moreinfo

Hi,

Maryse Argouin & Jean Lafontaine:

> I dont know if it's helping but here is what is happening when i click
> on a link in Thunderbird 52.6.0 using SolydX EE OS

For the record, SolydX seems to be a Debian derivative. I'm not sure
if/why they ask their users to report bugs directly to Debian without
first checking that Debian is affected, but well… let's try to find
out whether this is relevant to Debian users and/or upstream:

> Output of: sudo journalctl -kaf --no-hostname | grep -w 'apparmor="DENIED"'

> fév 11 17:31:49 kernel: audit: type=1400 audit(1518388309.673:180):
> apparmor="DENIED" operation="exec" profile="thunderbird"
> name="/opt/firefox/firefox" pid=26794 comm="thunderbird"
> requested_mask="x" denied_mask="x" fsuid=1000 ouid=0

Where does /opt/firefox/firefox come from? In other words, how did you
install this copy of Firefox?

Cheers,
--
intrigeri

Kemelmajer, Jovita

未讀,

2018年5月9日上午10:00:032018/5/9

收件者：

I am Major Dennis Hornbeck. I am in the Engineering military unit here in Afghanistan, I Have a Proposal for you Please do get back for details.

Note: You have to reply to my private email. m.hor...@aol.com

Jonathan Arodi

未讀,

2018年6月30日上午8:30:032018/6/30

收件者：

intrigeri

未讀,

2018年7月31日晚上10:20:032018/7/31

收件者：

Hi,

intrigeri:

> Where does /opt/firefox/firefox come from? In other words, how did you
> install this copy of Firefox?

Ping?

Cheers,
--
intrigeri

Susan Helms.

未讀,

2018年8月10日清晨7:30:032018/8/10

收件者：

בוקר טוב/ Good Morning

מה שלומך היום? בבקשה אתה מדבר אנגלית? שלחתי לך הודעה אין תגובה.

ברכות מכובדות

סוזן

NB, Please do you speak English? I sent you message no response.

David Campbell

未讀,

2018年11月22日下午1:10:032018/11/22

收件者：

#1 Post by caffinate » Thu Nov 22, 2018 12:00 pm

MK Linux 17.1 Thunderbird Version 52.9.1 64 Bit

One persistent problem I'm having is the inability of Thunderbird to open http, https URLs in emails with the Vivaldi. I also had the same problem with Chromium.

When I run Thunderbird in Safe Mode in a console and try to open a url in Thunderbird email I get this message:

** (thunderbird:961): WARNING **: Could not launch default application for URI: Failed to execute child process "/usr/bin/vivaldi-stable" (Permission denied)

EDIT: When I try to open links from Evolution Email Client - works fine.

EDIT2: Problem Appears to Be Solved:

Narrowed this down to some kind of permissions problem with thunderbird:\

Found this: https://bugs.debian.org/cgi-bin/bugrepo ... bug=883245

.....

I'm experiencing the same with the version that's currently in testing.

However, I found a workaround: either install thunderbird/1:52.5.0-1

from unstable, or disable the apparmor profile yourself:

sudo ln -s /etc/apparmor.d/usr.bin.thunderbird /etc/apparmor.d/disable/
sudo apparmor_parser -R /etc/apparmor.d/usr.bin.thunderbird

Now Thunderbird URL links open correctly in Vivaldi

Related bug is #882672.

David Campbell

未讀,

2018年11月23日上午8:20:032018/11/23

收件者：

Carsten,

Thanks for your thoughtful response! Sorry if in my debugging I rang the Thunderbird alarm bell. Only later did I realize this was an AppArmor profile issue.

Thanks again,

Best regards,

David Campbell

On Fri, Nov 23, 2018, at 1:12 AM, Carsten Schoenert wrote:

Control: clone 883245 -1

Control: retitle -1 apparmor: no permission to /usr/bin/vivaldi-stable

Hello David,

your reported issue is obviously related to AppArmor. Even if the bug

report is also related to AppArmor it would have been better if you had

created a new issue as your problem is different ftom the reported issue

in 883245.

I've cloned the this old issue into anew one so the AppArmor people

don't have to hassle to figure out which problems are all reported to

this report.

Am 22.11.18 um 19:02 schrieb David Campbell:

* Edit <https://forum.mxlinux.org/posting.php?mode=edit&f=104&p=467920>

* Report this post <https://forum.mxlinux.org/app.php/post/467920/report>

* Quote <https://forum.mxlinux.org/posting.php?mode=quote&f=104&p=467920>

#1 <https://forum.mxlinux.org/viewtopic.php?p=467920#p467920> Post

<https://forum.mxlinux.org/viewtopic.php?p=467920#p467920> by *caffinate

<https://forum.mxlinux.org/memberlist.php?mode=viewprofile&u=19985>* » Thu

Nov 22, 2018 12:00 pm

MK Linux 17.1 Thunderbird Version 52.9.1 64 Bit

One persistent problem I'm having is the inability of Thunderbird to

open http, https URLs in emails with the Vivaldi. I also had the same

problem with Chromium.

When I run Thunderbird in Safe Mode in a console and try to open a url

in Thunderbird email I get this message:

*** (thunderbird:961): WARNING **: Could not launch default application for URI: Failed to execute child process "/usr/bin/vivaldi-stable" (Permission denied)*

EDIT: When I try to open links from Evolution Email Client - works fine.

*EDIT2: Problem Appears to Be Solved:*

Narrowed this down to some kind of permissions problem with thunderbird:\

Found this: https://bugs.debian.org/cgi-bin/bugrepo ... bug=883245

<https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=883245>

Well, it's mostly clear that thunderbird isn't allowed to run this

binary as this is already visible on the CLI as you have posted above.

.....

I'm experiencing the same with the version that's currently in testing.

However, I found a workaround: either install thunderbird/1:52.5.0-1

from unstable, or disable the apparmor profile yourself:

*sudo ln -s /etc/apparmor.d/usr.bin.thunderbird /etc/apparmor.d/disable/

sudo apparmor_parser -R /etc/apparmor.d/usr.bin.thunderbird*

*Now Thunderbird URL links open correctly in Vivaldi*

Yes and no.

It's a problem related to the AppArmor profile from Thunderbird and

disabling the AppArmor profile make for sure going away the problem, but

ist's not solved. It's probably just one line you need to add to the

AppAprmor profile. That's a thing intrigeri or Vincas can answer for

sure. (CCed)

@intrigeri

You will need to add the correct BTS tagging for apparmore please.

--

Regards

Carsten Schoenert

dac

Jesus Eguiluz

未讀,

2019年1月8日上午10:50:022019/1/8

收件者：

With thunderbird 60.3.1 have the same problem... so disabling the
apparmor profile solves the problem.

I been 6 months to try solve the problem diving in thunderbird forums,
but the problem is an apparmor profile.

Sl2

Jesus Eguiluz

Jesus Eguiluz

未讀,

2020年7月1日凌晨12:30:032020/7/1

收件者：

Hi,

Me again, this time the result is the same I can't open links from
thunderbird, but the error is diferent, Here are the log.

-- Logs begin at Wed 2020-04-22 18:47:35 -04. --
jun 30 23:50:00 gsus-solydx audit[59906]: AVC apparmor="DENIED"
operation="file_mmap" profile="thunderbird//sanitized_helper"
name="/home/gsus/.nv/.glIPX6D1" pid=59906 comm="firefox-esr"
requested_mask="m" denied_mask="m" fsuid=1000 ouid=1000
jun 30 23:50:00 gsus-solydx kernel: audit: type=1400
audit(1593575400.077:205): apparmor="DENIED" operation="file_mmap"
profile="thunderbird//sanitized_helper" name="/tmp/.glqmbpH1" pid=59906
comm="firefox-esr" requested_mask="m" denied_mask="m" fsuid=1000 ouid=1000
jun 30 23:50:00 gsus-solydx kernel: audit: type=1400
audit(1593575400.077:206): apparmor="DENIED" operation="file_mmap"
profile="thunderbird//sanitized_helper" name="/tmp/.glqmbpH1" pid=59906
comm="firefox-esr" requested_mask="m" denied_mask="m" fsuid=1000 ouid=1000
jun 30 23:50:00 gsus-solydx kernel: audit: type=1400
audit(1593575400.077:207): apparmor="DENIED" operation="file_mmap"
profile="thunderbird//sanitized_helper" name="/home/gsus/.nv/.glIPX6D1"
pid=59906 comm="firefox-esr" requested_mask="m" denied_mask="m"
fsuid=1000 ouid=1000
jun 30 23:50:00 gsus-solydx kernel: audit: type=1400
audit(1593575400.077:208): apparmor="DENIED" operation="file_mmap"
profile="thunderbird//sanitized_helper" name="/home/gsus/.nv/.glIPX6D1"
pid=59906 comm="firefox-esr" requested_mask="m" denied_mask="m"
fsuid=1000 ouid=1000
jun 30 23:50:01 gsus-solydx audit[59903]: AVC apparmor="DENIED"
operation="capable" profile="thunderbird//sanitized_helper" pid=59903
comm=495043204C61756E6368202331 capability=21 capname="sys_admin"
jun 30 23:50:01 gsus-solydx kernel: audit: type=1400
audit(1593575401.367:209): apparmor="DENIED" operation="capable"
profile="thunderbird//sanitized_helper" pid=59903
comm=495043204C61756E6368202331 capability=21 capname="sys_admin"

Regards

Jesus Eguiluz

Jesus Eguiluz

未讀,

2020年9月15日下午2:10:042020/9/15

收件者：

Hi, I have more info.

The same problem, I can't open links from thunderbird.

I used to be workaround it by put the
/etc/apparmor.d/usr.bin.thunderbird in complain mode. But this not work
anymore.

Now I have to disable de /etc/apparmor.d/usr.bin.thunderbird profile
with sudo aa-disable /etc/apparmor.d/usr.bin.thunderbird

sep 15 14:36:55 gsus-v110-14ast audit[9930]: AVC apparmor="DENIED"
operation="file_mmap" profile="thunderbird//sanitized_helper"
name="/opt/waterfox/waterfox" pid=9930 comm="waterfox"
requested_mask="m" denied_mask="m" fsuid=1000 ouid=0
sep 15 14:36:55 gsus-v110-14ast kernel: audit: type=1400
audit(1600191415.454:368): apparmor="DENIED" operation="file_mmap"
profile="thunderbird//sanitized_helper" name="/opt/waterfox/waterfox"
pid=9930 comm="waterfox" requested_mask="m" denied_mask="m" fsuid=1000
ouid=0
sep 15 14:36:55 gsus-v110-14ast audit[9932]: AVC apparmor="DENIED"
operation="file_mmap" profile="thunderbird//sanitized_helper"
name="/opt/waterfox/waterfox" pid=9932 comm="waterfox"
requested_mask="m" denied_mask="m" fsuid=1000 ouid=0
sep 15 14:36:55 gsus-v110-14ast kernel: audit: type=1400
audit(1600191415.556:369): apparmor="DENIED" operation="file_mmap"
profile="thunderbird//sanitized_helper" name="/opt/waterfox/waterfox"
pid=9932 comm="waterfox" requested_mask="m" denied_mask="m" fsuid=1000
ouid=0
sep 15 14:36:55 gsus-v110-14ast audit[9934]: AVC apparmor="DENIED"
operation="file_mmap" profile="thunderbird//sanitized_helper"
name="/opt/waterfox/waterfox" pid=9934 comm="waterfox"
requested_mask="m" denied_mask="m" fsuid=1000 ouid=0
sep 15 14:36:55 gsus-v110-14ast kernel: audit: type=1400
audit(1600191415.684:370): apparmor="DENIED" operation="file_mmap"
profile="thunderbird//sanitized_helper" name="/opt/waterfox/waterfox"
pid=9934 comm="waterfox" requested_mask="m" denied_mask="m" fsuid=1000
ouid=0
sep 15 14:36:55 gsus-v110-14ast audit[9937]: AVC apparmor="DENIED"
operation="file_mmap" profile="thunderbird//sanitized_helper"
name="/opt/waterfox/waterfox" pid=9937 comm="waterfox"
requested_mask="m" denied_mask="m" fsuid=1000 ouid=0
sep 15 14:36:55 gsus-v110-14ast kernel: audit: type=1400
audit(1600191415.846:371): apparmor="DENIED" operation="file_mmap"
profile="thunderbird//sanitized_helper" name="/opt/waterfox/waterfox"
pid=9937 comm="waterfox" requested_mask="m" denied_mask="m" fsuid=1000
ouid=0
sep 15 14:36:56 gsus-v110-14ast audit[9939]: AVC apparmor="DENIED"
operation="file_mmap" profile="thunderbird//sanitized_helper"
name="/opt/waterfox/waterfox" pid=9939 comm="waterfox"
requested_mask="m" denied_mask="m" fsuid=1000 ouid=0
sep 15 14:36:56 gsus-v110-14ast kernel: audit: type=1400
audit(1600191416.234:372): apparmor="DENIED" operation="file_mmap"
profile="thunderbird//sanitized_helper" name="/opt/waterfox/waterfox"
pid=9939 comm="waterfox" requested_mask="m" denied_mask="m" fsuid=1000
ouid=0

Sl2

Jesus Eguiluz
Ingeniero Electrónico.
Investigación y Desarrollo
Andes Electrónica Ltda.
+56 2 2347-8780
www.andeselec.com

Carsten Schoenert

未讀,

2020年9月15日下午3:00:042020/9/15

收件者：

Hello Jesus,

Am 15.09.20 um 19:50 schrieb Jesus Eguiluz:

> Hi, I have more info.
>
> The same problem, I can't open links from thunderbird.
>
> I used to be workaround it by put the
> /etc/apparmor.d/usr.bin.thunderbird in complain mode. But this not work
> anymore.
>
> Now I have to disable de /etc/apparmor.d/usr.bin.thunderbird profile
> with sudo aa-disable /etc/apparmor.d/usr.bin.thunderbird
>
>
> sep 15 14:36:55 gsus-v110-14ast audit[9930]: AVC apparmor="DENIED"
> operation="file_mmap" profile="thunderbird//sanitized_helper"
> name="/opt/waterfox/waterfox" pid=9930 comm="waterfox"
> requested_mask="m" denied_mask="m" fsuid=1000 ouid=0
> sep 15 14:36:55 gsus-v110-14ast kernel: audit: type=1400
> audit(1600191415.454:368): apparmor="DENIED" operation="file_mmap"
> profile="thunderbird//sanitized_helper" name="/opt/waterfox/waterfox"
> pid=9930 comm="waterfox" requested_mask="m" denied_mask="m" fsuid=1000
> ouid=0

you try to run /opt/waterfox/waterfox which isn't allowed by the shipped
apparmor profile.

Please open a issue on

https://gitlab.com/apparmor/apparmor-profiles/-/issues

and ask the apparmor profile maintainer how to get your issue solved.

Please note also the file /usr/share/doc/thunderbird/README.apparmor
which has some small additional information about Thunderbird and Apparmor.

---
Regards
Carsten Schoenert