[pkg-apparmor] Bug#1128672: /etc/apparmor.d/usr.bin.thunderbird: causes crash when trying to attach a file

[Marc Haber]

Control: severity -1 normal
thanks

Downgrading as workaround available.

On Sun, Feb 22, 2026 at 12:41:26PM +0000, Simon McVittie wrote:
> On Sun, 22 Feb 2026 at 13:20:16 +0100, Marc Haber wrote:
> > Starting thunderbird gives the following console messsages:
> ...
> > I then open a new message and click on "attach". Thunderbird crashes
> > reliably,
> > 
> > WARNING: Glycin running without sandbox.
> > WARNING: Glycin running without sandbox.
> > **
> > Gtk:ERROR:../../../gtk/gtkiconhelper.c:495:ensure_surface_for_gicon: assertion failed (error == NULL): Failed to load /usr/share/icons/breeze-dark/status/16/image-missing.svg: Could not spawn `env -i XDG_RUNTIME_DIR="/run/user/1001" "/usr/libexec/glycin-loaders/2+/glycin-svg" "--dbus-fd" "122"`: Permission denied (os error 13) (gdk-pixbuf-error-quark, 0)
> > Bail out! Gtk:ERROR:../../../gtk/gtkiconhelper.c:495:ensure_surface_for_gicon: assertion failed (error == NULL): Failed to load /usr/share/icons/breeze-dark/status/16/image-missing.svg: Could not spawn `env -i XDG_RUNTIME_DIR="/run/user/1001" "/usr/libexec/glycin-loaders/2+/glycin-svg" "--dbus-fd" "122"`: Permission denied (os error 13) (gdk-pixbuf-error-quark, 0)
> 
> This is another symptom of the same root cause as
> <https://bugs.debian.org/1127710>: thunderbird's AppArmor profile prevents
> gdk-pixbuf / glycin / bwrap from working as designed, by denying permission
> to do operations that they need. A workaround is to put thunderbird's
> AppArmor profile in "complain" (non-enforcing) mode, making it no longer a
> security boundary:
> 
>     aa-complain /etc/apparmor.d/usr.bin.thunderbird
> 
> or disable it completely.

Yes, I confirm that this helps. What also helps is GTK_USE_PORTAL=1 (the 
KDE launcher does that).

Greetings
Marc