thunderbird: fails to start with permission denied errors

Sat Feb 14 19:26:19 GMT 2026

On 2/14/2026 2:10 PM, Debian Tester wrote:
> On 2/12/2026 11:37 AM, Frederic Peters wrote:
> > I wrote:
> > 
> >>I'm available for anything that would help debugging this.
> > 
> > Looking further (in my case) it's related to apparmor,
> > 
> > kernel: audit: type=1400 audit(1770913688.152:456): apparmor="DENIED" operation="exec" class="file" profile="/usr/bin/evince" name="/usr/bin/bwrap" pid=34166 comm="blocking-2" requested_mask="x" denied_mask="x" fsuid=1000 ouid=0
> > 
> > Switching evince to complain mode (aa-complain /etc/apparmor.d/usr.bin.evince) 
> > allowed it to start.
> > 
> > Shawn, maybe aa-complain /etc/apparmor.d/usr.bin.thunderbird would fix 
> > it for you? (aa-complain is part of apparmor-utils).
> > 
> > 
> >          Frederic
> > 
> > 
>
> I am not the reporter of this bug (Shawn) but I am seeing the exact same problem
> with Thunderbird on sid after the gdk-pixbuf+glycin transition. The aa-complain
> workaround does fix Thunderbird on sid on my box. Thanks, Frederic!
>
> FWIW, here are the related apparmor messages I am getting after setting apparmor
> complain mode for Thunderbird, as it relates to glycin loaders:
>
> test at debian:~$ sudo journalctl -b --no-pager | grep audit | grep thunderbird | grep glycin
> Feb 14 13:38:31 debian kernel: audit: type=1400 audit(1771094311.887:1074): apparmor="ALLOWED" operation="exec" class="file" profile="thunderbird" name="/usr/libexec/glycin-loaders/2+/glycin-svg" pid=7225 comm="gly-hdl-loader" requested_mask="x" denied_mask="x" fsuid=1000 ouid=0 target="thunderbird//null-/usr/libexec/glycin-loaders/2+/glycin-svg"
> Feb 14 13:38:31 debian kernel: audit: type=1400 audit(1771094311.887:1075): apparmor="ALLOWED" operation="file_mmap" class="file" profile="thunderbird//null-/usr/libexec/glycin-loaders/2+/glycin-svg" name="/usr/libexec/glycin-loaders/2+/glycin-svg" pid=7225 comm="glycin-svg" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
> Feb 14 13:38:31 debian kernel: audit: type=1400 audit(1771094311.887:1076): apparmor="ALLOWED" operation="file_mmap" class="file" profile="thunderbird//null-/usr/libexec/glycin-loaders/2+/glycin-svg" name="/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2" pid=7225 comm="glycin-svg" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
> Feb 14 13:39:02 debian kernel: audit: type=1400 audit(1771094342.068:1271): apparmor="ALLOWED" operation="signal" class="signal" profile="thunderbird" pid=7085 comm="gly-global-exec" requested_mask="send" denied_mask="send" signal=kill peer="thunderbird//null-/usr/libexec/glycin-loaders/2+/glycin-image-rs"
> Feb 14 13:39:07 debian kernel: audit: type=1400 audit(1771094347.180:1272): apparmor="ALLOWED" operation="signal" class="signal" profile="thunderbird" pid=7085 comm="gly-global-exec" requested_mask="send" denied_mask="send" signal=kill peer="thunderbird//null-/usr/libexec/glycin-loaders/2+/glycin-svg"
> Feb 14 13:42:05 debian kernel: audit: type=1400 audit(1771094525.777:2390): apparmor="ALLOWED" operation="signal" class="signal" profile="thunderbird" pid=8238 comm="gly-global-exec" requested_mask="send" denied_mask="send" signal=kill peer="thunderbird//null-/usr/libexec/glycin-loaders/2+/glycin-image-rs"
> Feb 14 13:42:06 debian kernel: audit: type=1400 audit(1771094526.261:2391): apparmor="ALLOWED" operation="signal" class="signal" profile="thunderbird" pid=8238 comm="gly-global-exec" requested_mask="send" denied_mask="send" signal=kill peer="thunderbird//null-/usr/libexec/glycin-loaders/2+/glycin-svg"
> test at debian:~$
>
> Thanks again,
>
> Chuck, a Debian tester

FYI, after setting thunderbird back to enforce mode and causing Thunderbird to fail to launch,
here are the related apparmor messages related to thunderbird (note there is no mention of
glycin in these messages but there are mentions of bwrap):

Feb 14 14:20:13 debian kernel: audit: type=1400 audit(1771096813.204:2392): apparmor="STATUS" operation="profile_replace" profile="unconfined" name="thunderbird" pid=11854 comm="apparmor_parser"
Feb 14 14:20:13 debian kernel: audit: type=1400 audit(1771096813.244:2393): apparmor="STATUS" operation="profile_replace" info="same as current profile, skipping" profile="unconfined" name="thunderbird//browser_java" pid=11854 comm="apparmor_parser"
Feb 14 14:20:13 debian kernel: audit: type=1400 audit(1771096813.260:2394): apparmor="STATUS" operation="profile_replace" info="same as current profile, skipping" profile="unconfined" name="thunderbird//browser_openjdk" pid=11854 comm="apparmor_parser"
Feb 14 14:20:13 debian kernel: audit: type=1400 audit(1771096813.264:2395): apparmor="STATUS" operation="profile_replace" profile="unconfined" name="thunderbird//gpg" pid=11854 comm="apparmor_parser"
Feb 14 14:20:13 debian kernel: audit: type=1400 audit(1771096813.264:2396): apparmor="STATUS" operation="profile_replace" info="same as current profile, skipping" profile="unconfined" name="thunderbird//sanitized_helper" pid=11854 comm="apparmor_parser"
Feb 14 14:20:18 debian kernel: audit: type=1400 audit(1771096818.944:2397): apparmor="DENIED" operation="userns_create" class="namespace" profile="thunderbird" pid=11856 comm="thunderbird" requested="userns_create" denied="userns_create"
Feb 14 14:20:18 debian kernel: audit: type=1400 audit(1771096818.976:2398): apparmor="DENIED" operation="mknod" class="file" profile="thunderbird" name="/run/user/1000/wayland-proxy-11856" pid=11856 comm="thunderbird" requested_mask="c" denied_mask="c" fsuid=1000 ouid=1000
Feb 14 14:20:19 debian kernel: audit: type=1400 audit(1771096819.060:2399): apparmor="DENIED" operation="exec" class="file" profile="thunderbird" name="/usr/lib/thunderbird/glxtest" pid=11876 comm="thunderbird" requested_mask="x" denied_mask="x" fsuid=1000 ouid=0
Feb 14 14:20:19 debian kernel: audit: type=1400 audit(1771096819.152:2400): apparmor="DENIED" operation="open" class="file" profile="thunderbird" name="/proc/11856/oom_score_adj" pid=11856 comm="thunderbird" requested_mask="w" denied_mask="w" fsuid=1000 ouid=1000
Feb 14 14:20:19 debian kernel: audit: type=1400 audit(1771096819.152:2401): apparmor="DENIED" operation="open" class="file" profile="thunderbird" name="/proc/11856/cgroup" pid=11856 comm="thunderbird" requested_mask="r" denied_mask="r" fsuid=1000 ouid=1000
Feb 14 14:20:19 debian kernel: audit: type=1400 audit(1771096819.208:2402): apparmor="DENIED" operation="open" class="file" profile="thunderbird" name="/sys/devices/virtual/dmi/id/product_name" pid=11856 comm="thunderbird" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
Feb 14 14:20:19 debian kernel: audit: type=1400 audit(1771096819.208:2403): apparmor="DENIED" operation="open" class="file" profile="thunderbird" name="/sys/devices/virtual/dmi/id/product_sku" pid=11856 comm="thunderbird" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
Feb 14 14:20:19 debian kernel: audit: type=1400 audit(1771096819.348:2404): apparmor="DENIED" operation="file_inherit" class="net" info="failed af match" error=-13 profile="thunderbird//sanitized_helper" pid=11963 comm="bwrap" family="netlink" sock_type="raw" protocol=0 requested_mask="send receive" denied_mask="send receive"
Feb 14 14:20:19 debian kernel: audit: type=1400 audit(1771096819.348:2405): apparmor="DENIED" operation="open" class="file" info="Failed name lookup - disconnected path" error=-13 profile="thunderbird//sanitized_helper" name="apparmor/.null" pid=11963 comm="bwrap" requested_mask="wr" denied_mask="wr" fsuid=1000 ouid=0
Feb 14 14:20:19 debian kernel: audit: type=1400 audit(1771096819.348:2406): apparmor="DENIED" operation="getattr" class="file" info="Failed name lookup - disconnected path" error=-13 profile="thunderbird//sanitized_helper" name="" pid=11963 comm="bwrap" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0

Cheers