Dear Maintainer,

*** Reporter, please consider answering these questions, where appropriate ***

   * What led up to the situation?
Run Firefox-esr on Debian Stretch with Apparmor active
   * What exactly did you do (or not do) that was effective (or ineffective)?
Run Firefox-esr
   * What was the outcome of this action?
Firefox-esr is running without protection
   * What outcome did you expect instead?
Firefox-esr would run with apparmor protection
but there is no profile
root@debian:/etc/apparmor.d# ls
abstractions                  usr.lib.dovecot.dovecot-lda
apache2.d                     usr.lib.dovecot.imap
bin.ping                      usr.lib.dovecot.imap-login
cache                         usr.lib.dovecot.lmtp
disable                       usr.lib.dovecot.log
force-complain                usr.lib.dovecot.managesieve
gst_plugin_scanner            usr.lib.dovecot.managesieve-login
local                         usr.lib.dovecot.pop3
sbin.klogd                    usr.lib.dovecot.pop3-login
sbin.syslogd                  usr.lib.dovecot.ssl-params
sbin.syslog-ng                usr.sbin.apt-cacher-ng
tunables                      usr.sbin.avahi-daemon
usr.bin.chromium-browser      usr.sbin.cups-browsed
usr.bin.evince                usr.sbin.cupsd
usr.bin.icedove               usr.sbin.dnsmasq
usr.bin.irssi                 usr.sbin.dovecot
usr.bin.pidgin                usr.sbin.identd
usr.bin.totem                 usr.sbin.mdnsd
usr.bin.totem-previewers      usr.sbin.nmbd
usr.lib.dovecot.anvil         usr.sbin.nscd
usr.lib.dovecot.auth          usr.sbin.smbd
usr.lib.dovecot.config        usr.sbin.smbldap-useradd
usr.lib.dovecot.deliver       usr.sbin.tcpdump
usr.lib.dovecot.dict          usr.sbin.traceroute
usr.lib.dovecot.dovecot-auth



*** End of the template - remove these template lines ***

it is in apparmor-profiles package:
https://packages.debian.org/stretch/all/apparmor-profiles/filelist

For Debian bookworm, an AppArmor profile is also available in the
apparmor-profiles package, but that profile is obsolete. It confines
binaries that match /usr/lib/firefox{,-[0-9]*}/firefox{,*[^s][^h]}
[1], which would not match the current location of the firefox-esr
binary which is at /usr/lib/firefox-esr/firefox-esr.

Debian should definitely ship an AppArmor profile with the firefox-esr
package. Web browsers are widely installed and have lots of security
vulnerabilities.

[1]: https://salsa.debian.org/apparmor-team/apparmor/-/blob/debian/3.0.8-3/profiles/apparmor/profiles/extras/usr.lib.firefox.firefox#L21