Apparmor should have read rights granted to opensc.conf

[Jean-Louis Dupond]

type=1400 audit(1345917432.434:29): apparmor="DENIED" operation="open" parent=2579 profile="/usr/lib/firefox/firefox{,*[^s][^h]}" name="/etc/opensc/opensc.conf" pid=2627 comm="plugin-containe" requested_mask="r" denied_mask="r"
                  fsuid=1000 ouid=0

You get this when the OpenSC module is loaded in firefox.

I don't know if this should be added to the default firefox apparmor config.
---
ApportVersion: 2.5.1-0ubuntu2
Architecture: amd64
DistroRelease: Ubuntu 12.10
InstallationMedia: Ubuntu 11.10 "Oneiric Ocelot" - Alpha amd64 (20110705.1)
Package: firefox
PackageArchitecture: amd64
ProcEnviron:
 LANGUAGE=nl:en_AU:en
 TERM=xterm
 PATH=(custom, no user)
 LANG=nl_BE.UTF-8
 SHELL=/bin/bash
ProcKernelCmdline: BOOT_IMAGE=/boot/vmlinuz-3.5.0-11-generic root=UUID=af3a67b1-5cbf-48f1-b0b7-0848ae3017b4 ro quiet splash modeset=1 pcie_aspm=force i915.i915_enable_rc6=1 i915.i915_enable_fbc=1 i915.lvds_downclock=1 vt.handoff=7
ProcVersionSignature: Ubuntu 3.5.0-11.11-generic 3.5.2
Tags: quantal
Uname: Linux 3.5.0-11-generic x86_64
UpgradeStatus: Upgraded to quantal on 2012-06-19 (66 days ago)
UserGroups: adm admin cdrom dialout libvirtd lpadmin plugdev sambashare

[Jean-Louis Dupond (dupondje)]

apport information

[Jean-Louis Dupond (dupondje)]

apport information

[Jean-Louis Dupond (dupondje)]

apport information

[Jean-Louis Dupond (dupondje)]

apport information

[Jean-Louis Dupond (dupondje)]

apport information

[Jamie Strandboge (jdstrand)]

My first thought is this should probably be added to the authentication abstraction, but then, it has a lot of access that consumers of opensc doesn't necessarily need.

Jean-Louis, does adding '/etc/opensc/opensc.conf' allow firefox to work fully with opensc?

[Jean-Louis Dupond (dupondje)]

In my case, it now even works without having access to /etc/opensc/opensc.conf.
But if you have custom settings set in the config, then it won't work ofcourse :)

But read access to the opensc config should be enough I guess.