Dear Maintainer,

While testing the “Sign Digitally” feature in GNOME Papers, I found that
the signing process fails due to AppArmor blocking access to several
paths required by NSS and by smartcard middleware.

I reproduced the same issue on Ubuntu as well and documented it here:
https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/2106133

The audit log shows consistent AppArmor denials such as:

  - ~/.pki/nssdb/cert9.db             (file_lock)
  - ~/.mozilla/firefox/*/cert9.db     (read)
  - /run/pcscd/pcscd.comm             (connect)
  - /sys/devices/...                  (open)

After testing, I confirmed that extending the AppArmor profile resolves
the issue and restores the digital-signature functionality. Adding the
following rules to `/etc/apparmor.d/usr.bin.papers` fixes the problem:

  owner @{HOME}/.pki/** lrk,
  /sys/devices/** r,
  /run/pcscd/pcscd.comm rw,

If possible, please consider adjusting the AppArmor file in Debian so
that GNOME Papers can access the necessary NSS and smartcard paths by
default.

This is the file in the repository:
https://salsa.debian.org/gnome-team/papers/-/blob/debian/latest/debian/apparmor-profile

These are the messages in my journalctl:
--------------------
Apr 02 23:23:23 desktop kernel: audit: type=1400
audit(1743647003.486:12599): apparmor="DENIED" operation="file_lock"
class="file" profile="/usr/bin/papers"
name="/home/cristiano/.pki/nssdb/cert9.db" pid=811514 comm="papers"
requested_mask="k" denied_mask="k" fsuid=1000 ouid=1000

Apr 02 23:25:37 desktop kernel: audit: type=1400
audit(1743647137.429:12896): apparmor="DENIED" operation="file_lock"
class="file" profile="/usr/bin/papers" name="/home/cristiano/.pki>

Apr 02 23:31:26 desktop kernel: audit: type=1400
audit(1743647486.460:13357): apparmor="DENIED" operation="open"
class="file" profile="/usr/bin/papers"
name="/sys/devices/pci0000:00/0>

Apr 02 23:33:49 desktop kernel: audit: type=1400
audit(1743647629.944:13632): apparmor="DENIED" operation="connect"
class="file" profile="/usr/bin/papers" name="/run/pcscd/pcscd.comm">
--------------------

Best regards,
Cristiano Fraga G. Nunes