Comment 53 for bug 1794064

Revision history for this message
Georgia Garcia (georgiag) wrote (last edit ):

Steve, the snap_browsers abstractions needed an update because the abstraction had not been updated in an year and the snap browsers now required read and lock permissions to the file /var/lib/snapd/inhibit/{browser-name}.lock, but this was also submitted, approved and merged upstream: https://gitlab.com/apparmor/apparmor/-/merge_requests/1045

Regarding the patch for evince, I kept the "Recommends" because, yes, the include if exists checks if the abstraction is present and it only includes in the case it is, but the actual rule which references the snap_browsers profile could fail for apparmor versions for which snap_browsers does not exist.
/{,snap/core/[0-9]*/,snap/snapd/[0-9]*/}usr/bin/snap mrCx -> snap_browsers,