I got these in my log:

Sep 19 20:02:42 Watt kernel: [9950821.734919] audit: type=1400 audit(1537401762.512:297): apparmor="DENIED" operation="open" profile="thunderbird" name="/home/anthony/.mailcap" pid=9593 comm="thunderbird" requested_mask="r" denied_mask="r" fsuid=1000 ouid=1000
Sep 19 20:02:43 Watt kernel: [9950822.548807] audit: type=1400 audit(1537401763.328:298): apparmor="DENIED" operation="open" profile="thunderbird" name="/home/anthony/.mailcap" pid=9593 comm="thunderbird" requested_mask="r" denied_mask="r" fsuid=1000 ouid=1000

would make sense to allow a mail program to read ~/.mailcap (and execute
the programs found there, no idea how that's done in apparmor)

- -- System Information:
Debian Release: buster/sid
  APT prefers testing-debug
  APT policy: (500, 'testing-debug'), (500, 'testing'), (500, 'stable'), (130, 'unstable-debug'), (130, 'unstable'), (120, 'experimental-debug'), (120, 'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 4.16.0-1-amd64 (SMP w/8 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/bash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages thunderbird depends on:
ii  debianutils               4.8.6
ii  fontconfig                2.13.0-5
ii  libatk1.0-0               2.28.1-1
ii  libc6                     2.27-6
ii  libcairo-gobject2         1.15.12-1
ii  libcairo2                 1.15.12-1
ii  libdbus-1-3               1.12.10-1
ii  libdbus-glib-1-2          0.110-3
ii  libevent-2.0-5            2.0.21-stable-3
ii  libffi6                   3.2.1-8
ii  libfontconfig1            2.13.0-5
ii  libfreetype6              2.8.1-2
ii  libgcc1                   1:8.2.0-6
ii  libgdk-pixbuf2.0-0        2.36.12-2
ii  libglib2.0-0              2.56.1-2
ii  libgtk-3-0                3.22.30-2
ii  libgtk2.0-0               2.24.32-3
ii  libjsoncpp1               1.7.4-3
ii  libpango-1.0-0            1.42.4-1
ii  libpangocairo-1.0-0       1.42.4-1
ii  libpangoft2-1.0-0         1.42.4-1
ii  libstartup-notification0  0.12-5
ii  libstdc++6                8.2.0-6
ii  libvpx4                   1.6.1-3+deb9u1
ii  libx11-6                  2:1.6.6-1
ii  libx11-xcb1               2:1.6.6-1
ii  libxcb-shm0               1.13-3
ii  libxcb1                   1.13-3
ii  libxext6                  2:1.3.3-1+b2
ii  libxrender1               1:0.9.10-1
ii  libxt6                    1:1.1.5-1
ii  psmisc                    23.1-1+b1
ii  x11-utils                 7.7+4
ii  zlib1g                    1:1.2.11.dfsg-1

Versions of packages thunderbird recommends:
ii  hunspell-en-us [hunspell-dictionary]  1:2018.04.16-1
ii  lightning                             1:60.0-3~deb9u1

Versions of packages thunderbird suggests:
ii  apparmor          2.13-8
ii  fonts-lyx         2.3.0-3
ii  libgssapi-krb5-2  1.16-2

- -- debconf information excluded
-----BEGIN PGP SIGNATURE-----

iHMEARECADMWIQTlAc7j4DAtSNRJJ0z7P4jCVepZ/gUCW6QItRUcYW50aG9ueUBk
ZXJvYmVydC5uZXQACgkQ+z+IwlXqWf48vwCfXLjejfEz2GoDscwP2uaSlcxE8JoA
n0MMCFh2G4kIMxfwW3w8iSOGmGr8
=mDRk
-----END PGP SIGNATURE-----

Hello Vincas,

one more AppArmor thing you could please have a look at.

Thanks!

Am 20.09.18 um 22:53 schrieb Anthony DeRobertis:

On Thu, 20 Sep 2018 16:53:44 -0400 Anthony DeRobertis <anthony@derobert.net> wrote> would make sense
to allow a mail program to read ~/.mailcap (and execute

Allowing to read that file will be trivial, but AppArmor will not be able to parse it and
dynamically allow execute programs based on that file. You'll have to add rules to
`/etc/apparmor.d/local/usr.bin.thunderbird`, like:

```
/usr/bin/foo PUx, # your application mentioned in .mailcap
```

I'm not sure if anything needs to be done to let Thunderbird actually
fork/exec a program from ~/.mailcap, but just to read it is, I think:

diff --git a/apparmor.d/usr.bin.thunderbird b/apparmor.d/usr.bin.thunderbird
index 1ffb231..d418aa9 100644
- --- a/apparmor.d/usr.bin.thunderbird
+++ b/apparmor.d/usr.bin.thunderbird
@@ -108,6 +108,7 @@ profile thunderbird @{thunderbird_executable} {
   owner @{HOME}/.local/share/applications/defaults.list r,
   owner @{HOME}/.local/share/applications/mimeapps.list r,
   owner @{HOME}/.local/share/applications/mimeinfo.cache r,
+  owner @{HOME}/.mailcap r,
   owner @{HOME}/.recently-used r,
   /tmp/.X[0-9]*-lock r,
   /etc/udev/udev.conf r,


- -- System Information:
Debian Release: buster/sid
  APT prefers testing-debug
  APT policy: (500, 'testing-debug'), (500, 'testing'), (500, 'stable'), (130, 'unstable-debug'), (130, 'unstable'), (120, 'experimental-debug'), (120, 'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 4.16.0-1-amd64 (SMP w/8 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/bash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages thunderbird depends on:
ii  debianutils               4.8.6
ii  fontconfig                2.13.0-5
ii  libatk1.0-0               2.28.1-1
ii  libc6                     2.27-6
ii  libcairo-gobject2         1.15.12-1
ii  libcairo2                 1.15.12-1
ii  libdbus-1-3               1.12.10-1
ii  libdbus-glib-1-2          0.110-3
ii  libevent-2.1-6            2.1.8-stable-4
ii  libffi6                   3.2.1-8
ii  libfontconfig1            2.13.0-5
ii  libfreetype6              2.8.1-2
ii  libgcc1                   1:8.2.0-6
ii  libgdk-pixbuf2.0-0        2.36.12-2
ii  libglib2.0-0              2.56.1-2
ii  libgtk-3-0                3.22.30-2
ii  libgtk2.0-0               2.24.32-3
ii  libhunspell-1.6-0         1.6.2-1+b1
ii  libicu60                  60.2-6
ii  libjsoncpp1               1.7.4-3
ii  libnspr4                  2:4.20-1
ii  libnss3                   2:3.39-1
ii  libpango-1.0-0            1.42.4-1
ii  libpangocairo-1.0-0       1.42.4-1
ii  libpangoft2-1.0-0         1.42.4-1
ii  libsqlite3-0              3.24.0-1
ii  libstartup-notification0  0.12-5
ii  libstdc++6                8.2.0-6
ii  libvpx5                   1.7.0-3
ii  libx11-6                  2:1.6.6-1
ii  libx11-xcb1               2:1.6.6-1
ii  libxcb-shm0               1.13-3
ii  libxcb1                   1.13-3
ii  libxext6                  2:1.3.3-1+b2
ii  libxrender1               1:0.9.10-1
ii  libxt6                    1:1.1.5-1
ii  psmisc                    23.1-1+b1
ii  x11-utils                 7.7+4
ii  zlib1g                    1:1.2.11.dfsg-1

Versions of packages thunderbird recommends:
ii  hunspell-en-us [hunspell-dictionary]  1:2018.04.16-1
ii  lightning                             1:60.0-3

Versions of packages thunderbird suggests:
ii  apparmor          2.13-8
ii  fonts-lyx         2.3.0-3
ii  libgssapi-krb5-2  1.16-2

- -- Configuration Files:
/etc/apparmor.d/usr.bin.thunderbird changed [not included]

- -- debconf information excluded
-----BEGIN PGP SIGNATURE-----

iHMEARECADMWIQTlAc7j4DAtSNRJJ0z7P4jCVepZ/gUCW6kLhhUcYW50aG9ueUBk
ZXJvYmVydC5uZXQACgkQ+z+IwlXqWf4pAQCeJprWMtGqAHJe18jEJ96BfmnHPFUA
njpSrXpT+/mnIYSMyjEYoBdi1aNH
=5kmK
-----END PGP SIGNATURE-----

We believe that the bug you reported is fixed in the latest version of
thunderbird, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 909281@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Carsten Schoenert <c.schoenert@t-online.de> (supplier of updated thunderbird package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Mon, 22 Jun 2026 21:41:06 +0200
Source: thunderbird
Architecture: source
Version: 1:152.0-1
Distribution: experimental
Urgency: medium
Maintainer: Carsten Schoenert <c.schoenert@t-online.de>
Changed-By: Carsten Schoenert <c.schoenert@t-online.de>
Closes: 880424 882218 883245 900210 909281 914403 917613 928178 949450 949649 955380 961269 1127710 1128672 1128876 1138513
Changes:
 thunderbird (1:152.0-1) experimental; urgency=medium
 .
   [ Carsten Schoenert ]
   * [5097e09] d/control: Bump B-D for libnss3-dev
   * [5350030] New upstream version 152.0
     (Closes: #1138513)
   * [92962df] Rebuild patch queue from patch-queue branch
     Removed patch (included upstream):
     fixes/Fix-conflicting-types-for-once_flag-and-call_once-with-gl.patch
     fixes/Fix-math_private.h-for-i386-FTBFS.patch
     fixes/Fix-sandbox-to-build-with-glibc-2.43.patch
   * [46de392] d/mozconfig.default: Remove option --enable-av1
 .
   [ Christoph Goehre ]
   * [5308430] rebuild patch queue from patch-queue branch (Closes: #1128876)
 .
   [ intrigeri ]
   * [77d16c3] Don't install AppArmor policy anymore
     (Closes: #1128672, #1127710, #928178, #909281, #955380, #882218, #900210,
      #914403, #917613, #949450, #880424, #883245, #961269, #949649)
Checksums-Sha1:
 1e9bca601d3dab684f2c1e34bbd107712eb17f8e 8402 thunderbird_152.0-1.dsc
 5ed145d0f72ee7e539f3f0d40cea83ed62b1499f 12403192 thunderbird_152.0.orig-thunderbird-l10n.tar.xz
 dbef2f6a94cec7b667931b222bdd6f0aaf9a4810 931861244 thunderbird_152.0.orig.tar.xz
 6fc9531bd0e3c27e7908228227a542966eb827f8 537512 thunderbird_152.0-1.debian.tar.xz
 41476b21bed4090bcf2c148b0178ef52d0e2f2e7 40158 thunderbird_152.0-1_amd64.buildinfo
Checksums-Sha256:
 8d348b506605fc73d56722d5a55ed9dae8af623989312e5c039786edfbe4f0f2 8402 thunderbird_152.0-1.dsc
 f4afa9846377239357e485da027035fe53762cc8100ced5cf5abca87fca7a1f8 12403192 thunderbird_152.0.orig-thunderbird-l10n.tar.xz
 64f02562f1f4a18e39c67b07255feb5828acde86327f55b1ebe45e3ac63963ea 931861244 thunderbird_152.0.orig.tar.xz
 52abff98afbeb3859791f46e5602bbbf6982f38876f7e223d0ff1ac7bb77c778 537512 thunderbird_152.0-1.debian.tar.xz
 38ab10bf14449c38f7233f8d883b1a6ffbe412606232763f9bcaa5dcda320c03 40158 thunderbird_152.0-1_amd64.buildinfo
Files:
 cddc168c5e8bdb4c051a11b4e56831b8 8402 mail optional thunderbird_152.0-1.dsc
 27c69983d0063061996fc52794377743 12403192 mail optional thunderbird_152.0.orig-thunderbird-l10n.tar.xz
 f49e9b967f1a1fdceec316060aef4959 931861244 mail optional thunderbird_152.0.orig.tar.xz
 d435a5b441fa39456dfa21b01881fdf3 537512 mail optional thunderbird_152.0-1.debian.tar.xz
 20c10b422095bf9f1d461c01e152c30e 40158 mail optional thunderbird_152.0-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEtw38bxNP7PwBHmKqgwFgFCUdHbAFAmo5mL4ACgkQgwFgFCUd
HbCPqw/+LEBi5TrBqIfSUOoosSHHufs3R4FzJrZ6vNsK4ur6EVNNhR1u0Gc4VtEG
JIaiGg7fCDf3mgAowEIKSQpVHnqMPKpqZemfIWHNT0exdKp1RXlh9OuwGdOqg0Og
5MWrhKzrDVr7p9LmB7ilQ2V0I+xHx1zh/cG58Ar2Pp9Wn8YDlpIQmO0vp6sX2ex5
GTUYHvVrssW4L/hOAsbMu9YUnGPRiHPvj94JF7XT2JFC6mndXtiqvEOH5Oo1UluK
FcM8Xz1GsANmwB4gR7/g0f06RWEjAsOMXPU98ESaY85kRTJ4VlVvGWOknGa0Sptv
frrEG893xRFXFmnrDR7dLH8Ux1cnsGy5wpNCZeLVViuT6Pv4OIm83jijKqaGHvp3
jdD8OWx7YGbYdm+INBBnff5Y/IEEni7EIuX17/S3ZNqlLYJGPbL6OWG+pMK52+xZ
0dMFXCrSMc+xMMUHBQ/aUw3up5t4B5de51tX9kWTFv3W/qIiLdA+PpH2EGiJJJIF
Jgm9q0sAlXLC2GZW55MTbk2/jhewQOcShIRrEKFJUPzpPgeXZAAN/I47uKAzoUAW
0x/Hb0+b72NKBlK8jurZfKYBDPyxLnHSUcCbVCPj8SyzxcCHBZ12jsVhIEjUwMEH
cyFP/Ep5MDC7yo9XX+Xt4na47jktwLRJ5jRpySaIV9RfhvBHPNQ=
=jjF1
-----END PGP SIGNATURE-----