#1073177 apparmot profile: Failed to spawn child process “/usr/lib/thunderbird/glxtest” (Permission denied)

Package:
thunderbird
Source:
thunderbird
Description:
mail/news client with RSS, chat and integrated spam filter support
Submitter:
Michael Tokarev
Date:
2024-06-19 12:06:02 UTC
Severity:
normal
#1073177#5
Date:
2024-06-14 04:38:26 UTC
From:
To:
When starting thunderbird, it displays this error messages:

 [GFX1-]: FireTestProcess failed: Failed to spawn child process
    “/usr/lib/thunderbird/glxtest” (Permission denied)
 [GFX1-]: No GPUs detected via PCI

This is because thunderbird apparmor profile does not let it
to execute /usr/lib/thunderbird/glxtest. Adding that one to
/etc/apparmor.d/usr.bin.thunderbird fixes the issue.

I've no idea why thunderbird wants to run glxtest, but this is
a different question entirely.

/mjt

#1073177#10
Date:
2024-06-14 05:23:48 UTC
From:
To:
14.06.2024 08:19, Carsten Schoenert wrote:

Hi!

Ah, sure.  I'm not an expert in apparmor, I just cloned a nearby line:

   /usr/lib/thunderbird/glxtest ixr,

That's why I haven't included it initially, - I've no idea if this
is correct.

I observed no visible difference before and after adding permission
to execute glxtest.  But since glxtest is shipped in the package,
I guess it might at least be a good idea to let thunderbird to run
that binary :)

Thanks,

/mjt

#1073177#15
Date:
2024-06-14 05:19:37 UTC
From:
To:
Hello Michael,

Am 14.06.24 um 06:38 schrieb Michael Tokarev:

would you mind to provide the data / the line you added there?

Well, this is now somehow needed as Thunderbird is checking by this
which hardware is available for using potentially video acceleration in
media content that can be included in emails.
Not that we need this, it's probably mostly because the source is still
based on the Firefox system.

@Intrigeri
I guess this issue isn't fixed in the upstream tree of apparmor and
should get included there?

#1073177#20
Date:
2024-06-19 12:02:28 UTC
From:
To:
Hi Michael,

Michael Tokarev (2024-06-14):

Could you please replace that line with this one:

  /usr/lib/thunderbird/glxtest ix,

… and tell us whether it works as well?

Then I'll submit the fix upstream and will copy the updated profile to
Vcs-Git.

Thanks in advance,
Cheers,