[pkg-apparmor] Bug#882048: Bug#882048: Bug#882048: Re: Bug#882048: apparmor should let thunderbird use signatures from files

[Vincas Dargis]

On 2017-11-28 03:36, Seth Arnold wrote:
> On Sat, Nov 25, 2017 at 05:23:16PM +0200, Vincas Dargis wrote:
>> $ sudo sysdig "proc.name=thunderbird and fd.name=/home/vincas/.vimrc"
>> 257671 17:14:42.523705164 7 thunderbird (8712) < open
>> fd=69(<f>/home/vincas/.vimrc) name=/home/vincas/.vimrc flags=1(O_RDONLY)
>> mode=0
> 
>> So glib/gio libraries not just opens, it actually reads these files
>> visible in file dialog. Twice!
> 
> This is likely to be intentional: I'm guessing it's part of thumbnailing
> the contents, or selecting the proper icon after running each file through
> something like libmagic.

I guess so, probably checking mime type.

> Can sysdig grab stacktraces at the time of the open() call? It might be
> educational to find out what exactly is doing the reading.

I do not know if sysdig could do that, though I doubt it. I could debug with gdb further, though I need to setup/find 
debug symbols for libgio-2.0.so, so backtrace I pasted earlier could give hints. I could step and check what's going on.