#1099688 apparmor DENIED for ~/.pki/nssdb/ and Firefox NSS

Package:
papers
Source:
papers
Description:
PDF document viewer for GNOME
Submitter:
Jose Ramon Alvarez-Sanchez
Date:
2025-11-07 04:53:01 UTC
Severity:
normal
#1099688#5
Date:
2025-03-06 19:13:37 UTC
From:
To:
With a PDF file open in papers, using the 3-dots menu option "Sign Digitally...",
an error window opens:
"Certificate Required: A certificate is required to sign this document"
with only a close button.

Repeated error messages appear in the logs:


kernel: audit: type=1400 audit(1741284589.250:40181): apparmor="DENIED" operation="open" class="file" profile="/usr/bin/papers" name="/home/user/.mozilla/firefox/1vozuxfg.default-esr/pkcs11.txt" pid=13594 comm="papers" requested_mask="r" denied_mask="r" fsuid>

kernel: audit: type=1400 audit(1741284589.250:40182): apparmor="DENIED" operation="open" class="file" profile="/usr/bin/papers" name="/home/user/.mozilla/firefox/1vozuxfg.default-esr/cert9.db" pid=13594 comm="papers" requested_mask="r" denied_mask="r" fsuid=1>

kernel: audit: type=1400 audit(1741284589.254:40183): apparmor="DENIED" operation="file_lock" class="file" profile="/usr/bin/papers" name="/home/user/.pki/nssdb/cert9.db" pid=13594 comm="papers" requested_mask="k" denied_mask="k" fsuid=1000 ouid=1000

[...previous line repeated 8 times...]

org.gnome.Papers.desktop[13594]: NSS_Init failed: security library: bad database.

There was a valid certificate stored in the connected smart card device and it was correctly detected by Firefox and LibreOffice.
There was also a valid software certificate registered and recognized by Firefox and LibreOffice in $HOME/.pki/nssdb/
The NSS database was verified by command: "certutil -d sql:$HOME/.pki/nssdb -L".

This error might be related to bug #1098717, about the apparmor configuration of papers package.


AVISO LEGAL. Este mensaje puede contener información reservada y confidencial. Si usted no es el destinatario no está autorizado a copiar, reproducir o distribuir este mensaje ni su contenido. Si ha recibido este mensaje por error, le rogamos que lo notifique al remitente.
Le informamos de que sus datos personales, que puedan constar en este mensaje, serán tratados en calidad de responsable de tratamiento por la UNIVERSIDAD NACIONAL DE EDUCACIÓN A DISTANCIA (UNED) c/ Bravo Murillo, 38, 28015-MADRID-, con la finalidad de mantener el contacto con usted. La base jurídica que legitima este tratamiento, será su consentimiento, el interés legítimo o la necesidad para gestionar una relación contractual o similar. En cualquier momento podrá ejercer sus derechos de acceso, rectificación, supresión, oposición, limitación al tratamiento o portabilidad de los datos, ante la UNED, Oficina de Protección de datos<https://www.uned.es/dpj>, o a través de la Sede electrónica<https://sede.uned.es/> de la Universidad.
Para más información visite nuestra Política de Privacidad<https://descargas.uned.es/publico/pdf/Politica_privacidad_UNED.pdf>.
#1099688#10
Date:
2025-11-06 05:58:02 UTC
From:
To:
Hi everyone,

I encountered the same issue when using GNOME Papers' "Sign Digitally" feature.
The signing process fails due to AppArmor restrictions that prevent
access to certain required directories.

I reported this issue on Ubuntu Launchpad (bug #2106133) and confirmed
that adjusting the AppArmor profile resolves the problem:
https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/2106133

AppArmor currently blocks GNOME Papers from accessing:
~/.pki/nssdb
/sys/devices/
and
/run/pcscd/pcscd.comm

After adding the following lines to the file
`/etc/apparmor.d/usr.bin.papers` and reloading AppArmor, digital
signing works correctly:

owner @{HOME}/.pki/** lrk,
/sys/devices/** r,
/run/pcscd/pcscd.comm rw,

This indicates that the issue lies in the AppArmor profile rather than
in the Papers application itself.

Dear maintainers, please consider reassigning this bug to the
'apparmor' package.

Best regards,
Cristiano Fraga G. Nunes
#1099688#15
Date:
2025-11-06 09:22:51 UTC
From:
To:
The AppArmor profile is part of the papers package, though, so
reassigning to a package that doesn't contain the AppArmor profile
doesn't really make sense.

If you change these lines to

audit owner @{HOME}/.pki/** lrk,
audit /sys/devices/** r,
audit /run/pcscd/pcscd.comm rw,

and reboot (or reload AppArmor), then try to sign something, what
accesses get logged to the audit log?

I agree with commenters on the Ubuntu bug that "/sys/devices/** r,"
seems like overly broad access, but probably it can be narrowed down
somewhat.

Ideally the apparmor package would have an abstraction for "access to
smart cards" or similar, which papers' profile could "include" instead
of having to know all the details of how smart cards are accessed.

     smcv
#1099688#20
Date:
2025-11-07 03:53:07 UTC
From:
To:
Dear Simon McVittie,
Thank you for your feedback and for taking the time to analyze the issue.

You are right, I was mistaken. This bug indeed belongs to the "papers"
package, since the AppArmor profile file is included directly in
that package at:
https://salsa.debian.org/gnome-team/papers/-/blob/debian/latest/debian/apparmor-profile

Without those lines, running `sudo dmesg` shows the errors below
and GNOME Papers fails to sign the document.

---------------------------------------
audit: type=1400 audit(1762484197.772:138): apparmor="DENIED"
operation="open" class="file" profile="/usr/bin/papers"
name="/sys/devices/pci0000:00/0000:00:01.0/0000:01:00.0/0000:02:00.0/0000:03:00.0/uevent"
pid=11258 comm="papers" requested_mask="r" denied_mask="r" fsuid=1000
ouid=0
audit: type=1400 audit(1762484197.772:139): apparmor="DENIED"
operation="open" class="file" profile="/usr/bin/papers"
name="/sys/devices/pci0000:00/0000:00:01.0/0000:01:00.0/0000:02:00.0/0000:03:00.0/uevent"
pid=11258 comm="papers" requested_mask="r" denied_mask="r" fsuid=1000
ouid=0
audit: type=1400 audit(1762484197.772:140): apparmor="DENIED"
operation="open" class="file" profile="/usr/bin/papers"
name="/sys/devices/pci0000:00/0000:00:02.0/uevent" pid=11258
comm="papers" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
audit: type=1400 audit(1762484197.772:141): apparmor="DENIED"
operation="open" class="file" profile="/usr/bin/papers"
name="/sys/devices/pci0000:00/0000:00:02.0/uevent" pid=11258
comm="papers" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
audit: type=1400 audit(1762484197.772:142): apparmor="DENIED"
operation="open" class="file" profile="/usr/bin/papers"
name="/sys/devices/pci0000:00/0000:00:01.0/0000:01:00.0/0000:02:00.0/0000:03:00.0/uevent"
pid=11258 comm="papers" requested_mask="r" denied_mask="r" fsuid=1000
ouid=0
audit: type=1400 audit(1762484197.772:143): apparmor="DENIED"
operation="open" class="file" profile="/usr/bin/papers"
name="/sys/devices/pci0000:00/0000:00:01.0/0000:01:00.0/0000:02:00.0/0000:03:00.0/uevent"
pid=11258 comm="papers" requested_mask="r" denied_mask="r" fsuid=1000
ouid=0
audit: type=1400 audit(1762484197.772:144): apparmor="DENIED"
operation="open" class="file" profile="/usr/bin/papers"
name="/sys/devices/pci0000:00/0000:00:02.0/uevent" pid=11258
comm="papers" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
audit: type=1400 audit(1762484197.772:145): apparmor="DENIED"
operation="open" class="file" profile="/usr/bin/papers"
name="/sys/devices/pci0000:00/0000:00:02.0/uevent" pid=11258
comm="papers" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
audit: type=1400 audit(1762484197.776:146): apparmor="DENIED"
operation="open" class="file" profile="/usr/bin/papers"
name="/sys/devices/pci0000:00/0000:00:01.0/0000:01:00.0/0000:02:00.0/0000:03:00.0/vendor"
pid=11258 comm="papers" requested_mask="r" denied_mask="r" fsuid=1000
ouid=0
audit: type=1400 audit(1762484197.776:147): apparmor="DENIED"
operation="open" class="file" profile="/usr/bin/papers"
name="/sys/devices/pci0000:00/0000:00:01.0/0000:01:00.0/0000:02:00.0/0000:03:00.0/device"
pid=11258 comm="papers" requested_mask="r" denied_mask="r" fsuid=1000
ouid=0
audit: type=1400 audit(1762484221.112:221): apparmor="DENIED"
operation="file_lock" class="file" profile="/usr/bin/papers"
name="/home/user/.pki/nssdb/cert9.db" pid=11258 comm="papers"
requested_mask="k" denied_mask="k" fsuid=1000 ouid=1000
[...previous line repeated 8 times...]
---------------------------------------

With those corrected lines added, and after restarting AppArmor
using sudo `systemctl restart apparmor`, GNOME Papers signs the
document normally and no further error messages appear.

I agree as well, but it is difficult to determine how this rule could
be narrowed, because other systems may have different devices with
different paths. A more restrictive rule might end up being too
specific to my setup. Therefore, I cannot say which exact paths should
be restricted. According to the log I sent, GNOME Papers attempts to
access two different paths under:
"/sys/devices/pci0000:00"

In addition, as described in Message #5 by Jose Ramon Alvarez-Sanchez,
his setup also requires access to "/home/user/.mozilla/firefox/",
which does not appear in my case, so his environment is slightly
different from mine as well.

It would indeed be a good solution, but I don’t have the knowledge
at the moment to work on something like that. The workaround I
provided addresses my specific case and is sufficient for my setup,
but creating a proper abstraction in the AppArmor package would
certainly be the ideal long-term approach.

I also ended up creating bug #1120163, reporting the same issue,
although I am not entirely sure whether it should be considered a
duplicate of this one, despite the similarities. In that report,
I used `reportbug --template papers`, which includes some additional
information specific to my setup. If possible, please check whether
that bug should be closed or kept separate.



If you need any additional information or testing from my side,
feel free to let me know.

Thank you again for your time and assistance.

Best regards,
Cristiano Fraga G. Nunes
#1099688#25
Date:
2025-11-07 04:51:55 UTC
From:
To:
Dear Simon McVittie,
I performed new tests regarding the AppArmor profile for GNOME Papers.

I further restricted the profile and added only the
following line inside inside the `/usr/bin/papers { }` part
in `/etc/apparmor.d/usr.bin.papers`:


    owner @{HOME}/.pki/nssdb/* rk,


With only this single rule, digital signing continues to work normally.
However, the kernel still reports AppArmor denials in `sudo dmesg`.
Even so, the signing feature works correctly.

This suggests that this single permission is sufficient for
GNOME Papers to perform digital signing, despite the remaining
audit log entries.

I am sharing these results in case they help refine the
AppArmor profile or narrow the required paths.

The kernel audit messages are included as an attachment below.

Best regards,
Cristiano Fraga G. Nunes

---------------------------------------
Attachment: `sudo dmesg`:
---------------------------------------
[ 8329.545597] audit: type=1400 audit(1762490114.460:1903):
apparmor="DENIED" operation="open" class="file"
profile="/usr/bin/papers"
name="/sys/devices/pci0000:00/0000:00:01.0/0000:01:00.0/0000:02:00.0/0000:03:00.0/uevent"
pid=21129 comm="papers" requested_mask="r" denied_mask="r" fsuid=1000
ouid=0
[ 8329.545606] audit: type=1400 audit(1762490114.460:1904):
apparmor="DENIED" operation="open" class="file"
profile="/usr/bin/papers"
name="/sys/devices/pci0000:00/0000:00:01.0/0000:01:00.0/0000:02:00.0/0000:03:00.0/uevent"
pid=21129 comm="papers" requested_mask="r" denied_mask="r" fsuid=1000
ouid=0
[ 8329.545639] audit: type=1400 audit(1762490114.460:1905):
apparmor="DENIED" operation="open" class="file"
profile="/usr/bin/papers"
name="/sys/devices/pci0000:00/0000:00:02.0/uevent" pid=21129
comm="papers" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
[ 8329.545702] audit: type=1400 audit(1762490114.460:1906):
apparmor="DENIED" operation="open" class="file"
profile="/usr/bin/papers"
name="/sys/devices/pci0000:00/0000:00:02.0/uevent" pid=21129
comm="papers" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
[ 8329.546053] audit: type=1400 audit(1762490114.460:1907):
apparmor="DENIED" operation="open" class="file"
profile="/usr/bin/papers"
name="/sys/devices/pci0000:00/0000:00:01.0/0000:01:00.0/0000:02:00.0/0000:03:00.0/uevent"
pid=21129 comm="papers" requested_mask="r" denied_mask="r" fsuid=1000
ouid=0
[ 8329.546092] audit: type=1400 audit(1762490114.460:1908):
apparmor="DENIED" operation="open" class="file"
profile="/usr/bin/papers"
name="/sys/devices/pci0000:00/0000:00:01.0/0000:01:00.0/0000:02:00.0/0000:03:00.0/uevent"
pid=21129 comm="papers" requested_mask="r" denied_mask="r" fsuid=1000
ouid=0
[ 8329.546120] audit: type=1400 audit(1762490114.460:1909):
apparmor="DENIED" operation="open" class="file"
profile="/usr/bin/papers"
name="/sys/devices/pci0000:00/0000:00:02.0/uevent" pid=21129
comm="papers" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
[ 8329.546150] audit: type=1400 audit(1762490114.460:1910):
apparmor="DENIED" operation="open" class="file"
profile="/usr/bin/papers"
name="/sys/devices/pci0000:00/0000:00:02.0/uevent" pid=21129
comm="papers" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
[ 8329.547937] audit: type=1400 audit(1762490114.460:1911):
apparmor="DENIED" operation="open" class="file"
profile="/usr/bin/papers"
name="/sys/devices/pci0000:00/0000:00:01.0/0000:01:00.0/0000:02:00.0/0000:03:00.0/vendor"
pid=21129 comm="papers" requested_mask="r" denied_mask="r" fsuid=1000
ouid=0
[ 8329.547944] audit: type=1400 audit(1762490114.460:1912):
apparmor="DENIED" operation="open" class="file"
profile="/usr/bin/papers"
name="/sys/devices/pci0000:00/0000:00:01.0/0000:01:00.0/0000:02:00.0/0000:03:00.0/device"
pid=21129 comm="papers" requested_mask="r" denied_mask="r" fsuid=1000
ouid=0
[ 8343.497445] kauditd_printk_skb: 73 callbacks suppressed
[ 8343.497448] audit: type=1400 audit(1762490128.412:1986):
apparmor="DENIED" operation="open" class="file"
profile="/usr/bin/papers"
name="/sys/devices/pci0000:00/0000:00:01.0/0000:01:00.0/0000:02:00.0/0000:03:00.0/uevent"
pid=21530 comm="papers" requested_mask="r" denied_mask="r" fsuid=1000
ouid=0
[ 8343.497490] audit: type=1400 audit(1762490128.412:1987):
apparmor="DENIED" operation="open" class="file"
profile="/usr/bin/papers"
name="/sys/devices/pci0000:00/0000:00:01.0/0000:01:00.0/0000:02:00.0/0000:03:00.0/uevent"
pid=21530 comm="papers" requested_mask="r" denied_mask="r" fsuid=1000
ouid=0
[ 8343.497527] audit: type=1400 audit(1762490128.412:1988):
apparmor="DENIED" operation="open" class="file"
profile="/usr/bin/papers"
name="/sys/devices/pci0000:00/0000:00:02.0/uevent" pid=21530
comm="papers" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
[ 8343.497562] audit: type=1400 audit(1762490128.412:1989):
apparmor="DENIED" operation="open" class="file"
profile="/usr/bin/papers"
name="/sys/devices/pci0000:00/0000:00:02.0/uevent" pid=21530
comm="papers" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
[ 8343.497863] audit: type=1400 audit(1762490128.412:1990):
apparmor="DENIED" operation="open" class="file"
profile="/usr/bin/papers"
name="/sys/devices/pci0000:00/0000:00:01.0/0000:01:00.0/0000:02:00.0/0000:03:00.0/uevent"
pid=21530 comm="papers" requested_mask="r" denied_mask="r" fsuid=1000
ouid=0
[ 8343.497905] audit: type=1400 audit(1762490128.412:1991):
apparmor="DENIED" operation="open" class="file"
profile="/usr/bin/papers"
name="/sys/devices/pci0000:00/0000:00:01.0/0000:01:00.0/0000:02:00.0/0000:03:00.0/uevent"
pid=21530 comm="papers" requested_mask="r" denied_mask="r" fsuid=1000
ouid=0
[ 8343.497939] audit: type=1400 audit(1762490128.412:1992):
apparmor="DENIED" operation="open" class="file"
profile="/usr/bin/papers"
name="/sys/devices/pci0000:00/0000:00:02.0/uevent" pid=21530
comm="papers" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
[ 8343.497973] audit: type=1400 audit(1762490128.412:1993):
apparmor="DENIED" operation="open" class="file"
profile="/usr/bin/papers"
name="/sys/devices/pci0000:00/0000:00:02.0/uevent" pid=21530
comm="papers" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
[ 8343.501907] audit: type=1400 audit(1762490128.416:1994):
apparmor="DENIED" operation="open" class="file"
profile="/usr/bin/papers"
name="/sys/devices/pci0000:00/0000:00:01.0/0000:01:00.0/0000:02:00.0/0000:03:00.0/vendor"
pid=21530 comm="papers" requested_mask="r" denied_mask="r" fsuid=1000
ouid=0
[ 8343.501918] audit: type=1400 audit(1762490128.416:1995):
apparmor="DENIED" operation="open" class="file"
profile="/usr/bin/papers"
name="/sys/devices/pci0000:00/0000:00:01.0/0000:01:00.0/0000:02:00.0/0000:03:00.0/device"
pid=21530 comm="papers" requested_mask="r" denied_mask="r" fsuid=1000
ouid=0
---------------------------------------