Merge ~talkless/apparmor-profiles:thunderbird-mozilla-java-plugins into ~apparmor-dev/apparmor-profiles/+git/apparmor-profiles-old:master

[Vincas Dargis]

Fixes loading Mozilla and Java plugins, such as:
/usr/lib/jvm/java-7-openjdk-amd64/jre/lib/amd64/IcedTeaPlugin.so (Debian 7, icedtea-7-plugin)
/usr/lib/jvm/java-8-openjdk-amd64/jre/lib/amd64/IcedTeaPlugin.so (Debian 8, icedtea-7-plugin)
/usr/lib/mozilla/plugins/skypebuttons.so (7 and 8, kopete)

Fixes:

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=877324
https://bugs.launchpad.net/apparmor-profiles/+bug/1706870 (except python2.7 issue, I skipped for other MR)

[Simon Déziel (sdeziel)]

LGTM but would you mind making those rules "rm" to make the read access explicit.

[Vincas Dargis (talkless)]

> LGTM but would you mind making those rules "rm" to make the read access
> explicit.

Done.

[intrigeri (intrigeri)]

I see that abstractions/ubuntu-browsers.d/java has something about IcedTeaPlugin.so + other potentially useful stuff like access to /{,var/}run/user/*/icedteaplugin-*/, that I suspect we'll need for Thunderbird as well sooner or later. So how about including this abstraction instead?

review: Needs Information

[Vincas Dargis (talkless)]

OK I'm on it.

[Vincas Dargis (talkless)]

> I see that abstractions/ubuntu-browsers.d/java has something about
> IcedTeaPlugin.so + other potentially useful stuff like access to
> /{,var/}run/user/*/icedteaplugin-*/, that I suspect we'll need for Thunderbird
> as well sooner or later. So how about including this abstraction instead?

Done, pushed amended commit.

[intrigeri (intrigeri)]

LGTM

review: Approve

[intrigeri (intrigeri)]

It seems something went wrong: John marked this as merged but apparently it was not, so I just merged it myself (+ applied the same change to 18.04): https://gitlab.com/apparmor/apparmor-profiles/commit/5ecd985737ca1e1bb6954525dfc1a405f1fe16b7.

review: Approve

diff --git a/ubuntu/17.10/usr.bin.thunderbird b/ubuntu/17.10/usr.bin.thunderbird
index caec9ef..48a4cdf 100644
--- a/ubuntu/17.10/usr.bin.thunderbird
+++ b/ubuntu/17.10/usr.bin.thunderbird
@@ -23,6 +23,7 @@ profile thunderbird /usr/lib/thunderbird/thunderbird {
   #include <abstractions/private-files>
   #include <abstractions/ssl_certs>
   #include <abstractions/ubuntu-browsers>
+  #include <abstractions/ubuntu-browsers.d/java>
   #include <abstractions/ubuntu-helpers>
 
   # For Xubuntu to launch the browser
@@ -174,6 +175,7 @@ profile thunderbird /usr/lib/thunderbird/thunderbird {
   owner @{HOME}/.{icedove,thunderbird}/**/extensions/** mixrw,
   owner @{HOME}/.mozilla/extensions/**        mixr,
   /usr/share/xul-ext/**/*.sqlite              rk,
+  /usr/lib/mozilla/plugins/*.so               rm,
   /usr/lib/xul-ext/**/*.sqlite                rk,
   /usr/lib/thunderbird-addons/extensions/**/*.sqlite rk,