[pkg-apparmor] thunderbird: apparmor profile prevents launching thunderbird with gdk-pixbuf >= 2.44.5

[Debian Tester]

On 2/14/2026 3:05 PM, Jeremy Bícha wrote:
> Control: severity -1 important
>
> On Sat, Feb 14, 2026 at 2:26 PM Debian Tester <frchuck278 at yahoo.com> wrote:
> > FYI, after setting thunderbird back to enforce mode and causing Thunderbird to fail to launch,
> > here are the related apparmor messages related to thunderbird (note there is no mention of
> > glycin in these messages but there are mentions of bwrap):
>
> I figured out why Frederic & I could not reproduce this from a clean
> Debian Testing install. Thunderbird includes an apparmor profile but
> it has been disabled by default for many years. See this file:
>
> /usr/share/doc/thunderbird/README.apparmor
> https://salsa.debian.org/mozilla-team/thunderbird/-/blob/debian/sid/debian/README.apparmor

Both my sid and my testing apparently had the Thunderbird apparmor profile enabled
because now, after the gdk-pixbuf+glycin transition to testing, Thunderbird now also
needs its apparmor profile set to complain mode for it to launch in both my testing and
sid installations.

>
> It appears like you previously enabled the Thunderbird apparmor
> profile. Therefore, although this is clearly a regression, I don't
> consider it to be RC since this is a non-default configuration.

I am sure I did not enable the Thunderbird apparmor profile. Something did,
so from my perspective, the only question left for me is, what did enable
the Thunderbird apparmor profile on my boxes? If it was some install
script of some package in the Debian archive, then there could be some
pure Debian installations that do have the Thunderbird apparmor profile
enabled by default. Also, I am not convinced, based on a seven year-old
README file, that every pure Debian installation now, seven years later,
will have the Thunderbird apparmor profile disabled by default.

I would suggest that, until the Thunderbird apparmor profile is fixed, that
the next update to Thunderbird or apparmor check to see it it is enabled,
and if it is, then it should be set to complain mode until the Thunderbird
apparmor profile is fixed.

Cheers.

>
> Assistance is requested in fixing Thunderbird's apparmor profile.
> Recent versions of Ubuntu only provide Thunderbird as a Snap, so this
> issue doesn't currently affect Ubuntu.
>
> Thank you,
> Jeremy Bícha