Bug#905437: libreoffice-common: AppArmor denies access to mesa shader cache
Package: libreoffice-common
Version: 1:6.1.0~rc2-3
Severity: normal
Tags: upstream
User: pkg-apparmor-team@lists.alioth.debian.org
Usertags: modify-profile
Dear Maintainer,
I got this deny:
```
type=AVC msg=audit(1533391970.983:584): apparmor="DENIED" operation="open" profile="libreoffice-soffice" name="/home/vincas/.cache/mesa_shader_cache/index" pid=20638 comm="soffice.bin" requested_mask="wrc" denied_mask="wrc" fsuid=1000 ouid=1000
```
This could be fixed with new `mesa` abstraction [0], though it is not
yeat available in Buster.
[0] https://gitlab.com/apparmor/apparmor/blob/59865e54c55c8f375460ba22a725468ce3fb6957/profiles/apparmor.d/abstractions/mesa
-- System Information:
Debian Release: buster/sid
APT prefers unstable-debug
APT policy: (500, 'unstable-debug'), (500, 'unstable'), (1, 'experimental-debug'), (1, 'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: i386
Kernel: Linux 4.17.0-1-amd64 (SMP w/8 CPU cores)
Locale: LANG=lt_LT.UTF-8, LC_CTYPE=lt_LT.UTF-8 (charmap=UTF-8), LANGUAGE=lt (charmap=UTF-8)
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled
Versions of packages libreoffice-common depends on:
ii libnumbertext-data 1.0-2
ii libreoffice-style-tango 1:6.1.0~rc2-3
ii ure 6.1.0~rc2-3
Versions of packages libreoffice-common recommends:
ii fonts-liberation2 2.00.1-7
ii libexttextcat-data 3.4.5-1
ii python3-uno 1:6.1.0~rc2-3
ii xdg-utils 1.1.3-1
Versions of packages libreoffice-common suggests:
ii libreoffice-style-tango [libreoffice-style] 1:6.1.0~rc2-3
Versions of packages python3-uno depends on:
ii libc6 2.27-5
ii libgcc1 1:8.2.0-3
ii libpython3.6 3.6.6-1
ii libreoffice-core 1:6.1.0~rc2-3
ii libstdc++6 8.2.0-3
ii python3 3.6.6-1
ii python3.6 3.6.6-1
ii uno-libs3 6.1.0~rc2-3
ii ure 6.1.0~rc2-3
-- Configuration Files:
/etc/apparmor.d/usr.lib.libreoffice.program.oosplash changed [not included]
/etc/apparmor.d/usr.lib.libreoffice.program.soffice.bin changed [not included]
-- no debconf information
Reply to: