apparmor blocks FF 3.5 acroread plugin

Thank you for using Ubuntu and taking the time to report a bug. Can you paste the output of 'grep audit /var/log/kern.log' after trying to open a PDF file?

The 'Open Containing Folder' is bug #452591.

The requested log file is attached

Can you add the following to your /etc/apparmor.d/usr.bin.firefox-3.5 profile:
  /opt/Adobe/Reader9/bin/acroread Ux,

Then perform:
$ sudo apparmor_parser -r -T -W /etc/apparmor.d/usr.bin.firefox-3.5

and report back if it fixes the problem for you?

Jamie, thanks a lot for your help. The change fixes the acroread problem.

The second problem of not being able to open Containing Folder is still present. As soon as I disable apparmor profile, I can open the Containing Folder even without re-starting Firefox, so it is definitely caused by apparmor.

yuri,

Thanks for getting back. As mentioned, the 'Open Containing Folder' is known and is bug #452591. Look in that bug for a workaround until we can get this uploaded.

SRU REQUEST

1. Users of firefox are unable to use the Adobe Acorbat Reader software when the AppArmor profile is enabled. The fix is trivial

2. The fix is not in Lucid yet

3. The fix is to add the following to debian/usr.bin.firefox.apparmor.in:
  # Adobe Acrobat Reader
  /opt/Adobe/Reader9/bin/acroread Uxr,

4. TEST CASE:
- apt-get install acroread from -partner
- try to open a PDF from with firefox

5. The regression potential is very low. The profile is disabled in the default installation, and we only allow access to files that we didn't previously have access to.

I forgot to mention in the test case that you must enable the profile with:
$ sudo aa-enforce /etc/apparmor.d/usr.bin.firefox-3.5

Thanks for your help Jamie, the workaround in bug #452591 works.

The workaround in #3 => https://bugs.launchpad.net/ubuntu/karmic/+source/firefox-3.5/+bug/473268/comments/3 appears to have worked for my karmic install...

This bug was fixed in the package firefox-3.5 - 3.5.6+nobinonly-0ubuntu1

---------------
firefox-3.5 (3.5.6+nobinonly-0ubuntu1) lucid; urgency=low

  * New upstream release v3.5.6 (FIREFOX_3_5_6_RELEASE)
    - see USN-874-1

  [ Micah Gersten <email address hidden> ]
  * Bump minimum system cairo to 1.8.8
    - update debian/rules
  * Fix .desktop Name field for Slovak translation (LP: 448683)
    - update debian/firefox-3.5-final.desktop
  * Fix .desktop Name field for Estonian and Arabic translations
    (LP: 419507, LP: 321239)
    - update debian/firefox-3.5-final.desktop

  [ Jamie Strandboge <email address hidden> ]
  * AppArmor fixes:
    - allow access to nautilus, to allow "Open containing folder" to work
      (LP: #452591)
    - allow access for deluge (LP: #455792)
    - work better with KDE by adding kde abstraction, allow access to soffice,
      allow access to okular and read access to /etc/fstab (for print dialog)
      (LP: #447006)
    - allow access to acroread (LP: #473268)
    - allow access to eog (LP: #464016)
    - allow access to transmission (LP: #476299)
    - deny noisy write attempts to deny /usr/lib/xulrunner-*/components/*.tmp
      as seen with 'firefox --help')
    - deny noisy read to /.suspended (when navigating directories)
    - allow access to /usr/bin/liferea-add-feed (LP: #488851)
    - allow access to azureus (LP: #482677)
    - don't require 'owner' for /media (LP: #479580)
    - adjust AppArmor profile binary globbing to match other branches
    - allow ixr access to sed (for first runs)

  [ Alexander Sack <email address hidden> ]
  * bump lower bound for system sqlite3 to >= 3.6.16.1
    - update debian/rules
 -- Alexander Sack <email address hidden> Wed, 16 Dec 2009 00:43:08 +0100

Unassigning myself for the 9.10 task. I don't have time to prepare/test/floow through on an SRU for this, especially since there is an easy workaround. If someone else is inclined to take the lead on an SRU for this, feel free to do so. This should get fixed in the firefox 3.6 update for 9.10 anyway.

Thank you for reporting this bug to Ubuntu. Karmic has reached EOL
(End of Life) and is no longer supported. As a result, this bug is
being marked "Won't Fix". Please see this document for currently
supported Ubuntu releases: https://wiki.ubuntu.com/Releases

Please feel free to report any other bugs you may find.