apparmor blocks access with Adobe Reader

[Jamie Strandboge]

Binary package hint: firefox

When accessing certain pages, I got these apparmor denied messages:
[20388.782426] type=1503 audit(1272303412.916:98): operation="open" pid=14168 parent=14164 profile="/usr/lib/firefox-3.6.3/firefox-*bin" requested_mask="::r" denied_mask="::r" fsuid=1001 ouid=0 name="/opt/Adobe/Reader9/Resource/Support/AdobeReader.desktop"

Adding the following to the profile fixes the issue:
  /opt/Adobe/Reader9/** r,

[Launchpad Janitor (janitor)]

This bug was fixed in the package firefox - 3.6.4+build7+nobinonly-0ubuntu1

---------------
firefox (3.6.4+build7+nobinonly-0ubuntu1) maverick; urgency=low

  * New upstream release v3.6.4 (FIREFOX_3_6_4_BUILD7)

  [ Micah Gersten <email address hidden> ]
  * Rebase patch after upstream landing of Lorentz branch
    - update debian/patches/bz460917_att350845_reload_new_plugins.patch
  * Drop patch after upstream landing of (bmo: 544481) aka
    Build fails on Ubuntu Lucid Lynx using 'dash' shell
    - drop debian/patches/fix-build-glitch.patch
    - update debian/patches/series

  [ Jamie Strandboge <email address hidden> ]
  * AppArmor:
    - allow ixr access to /usr/lib/xulrunner-*/plugin-container for xul builds
    - finetune Adobe Reader access (LP: #570337)
    - silence noisy denial on /boot/vmlinuz* and /boot/initrd.img* caused by
      readlinking symlinks in / (LP: #571761)
    - allow 'm' for java's 'classes.jsa' file (LP: #574459)
    - transition to firefox_java on Sun's jre/bin/java_vm too (LP: #570128)
    - allow Uxr for gnome-codec-install (LP: #577097)

  [ Chris Coulson <email address hidden> ]
  * Rebase patches for 3.6.4 release
    - update debian/patches/firefox-kde.patch
    - update debian/patches/mozilla-kde.patch
    - update debian/patches/add_syspref_dir.patch
  * Build with --enable-ipc on amd64, i386 and armel. These are the only
    architectures where OOPP is supported. Build with --disable-ipc on all
    other architectures
    - update debian/rules
  * Fix LP: #513887 - Install the plugin-container binary for OOPP support
    when building with --enable-ipc
    - update debian/rules
  * Fix build failure with fontconfig 2.5
    - update debian/patches/lp512615_cairo_lcd_filter.patch
  * Fix LP: #469752 - KDE/Gnome startup notification not disappearing
    when app window is up - build with --enable-startup-notification
    - update debian/rules
 -- Chris Coulson <email address hidden> Wed, 23 Jun 2010 15:31:44 +0100

[Launchpad Janitor (janitor)]

This bug was fixed in the package firefox - 3.6.6+nobinonly-0ubuntu0.10.04.1

---------------
firefox (3.6.6+nobinonly-0ubuntu0.10.04.1) lucid-security; urgency=low

  * New upstream release v3.6.6 (FIREFOX_3_6_6_RELEASE)
    - see USN-930-1

  [ Micah Gersten <email address hidden> ]
  * Rebase patch after upstream landing of Lorentz branch
    - update debian/patches/bz460917_att350845_reload_new_plugins.patch
  * Drop patch after upstream landing of (bmo: 544481) aka
    Build fails on Ubuntu Lucid Lynx using 'dash' shell
    - drop debian/patches/fix-build-glitch.patch
    - update debian/patches/series

  [ Jamie Strandboge <email address hidden> ]
  * Apparmor:
    - allow ixr access to /usr/lib/xulrunner-*/plugin-container for xul builds
    - finetune Adobe Reader access (LP: #570337)
    - silence noisy denial on /boot/vmlinuz* and /boot/initrd.img* caused by
      readlinking symlinks in / (LP: #571761)
    - allow 'm' for java's 'classes.jsa' file (LP: #574459)
    - transition to firefox_java on Sun's jre/bin/java_vm too (LP: #570128)
    - allow Uxr for gnome-codec-install (LP: #577097)

  [ Chris Coulson <email address hidden> ]
  * Rebase patches for 3.6.4 release
    - update debian/patches/firefox-kde.patch
    - update debian/patches/mozilla-kde.patch
    - update debian/patches/add_syspref_dir.patch
  * Build with --enable-ipc on amd64, i386 and armel. These are the only
    architectures where OOPP is supported. Build with --disable-ipc on all
    other architectures
    - update debian/rules
  * Fix LP: #513887 - Install the plugin-container binary for OOPP support
    when building with --enable-ipc
    - update debian/rules
  * Fix LP: #469752 - KDE/Gnome startup notification not disappearing
    when app window is up - build with --enable-startup-notification
    - update debian/rules
 -- Chris Coulson <email address hidden> Mon, 28 Jun 2010 12:46:36 +0100

[Launchpad Janitor (janitor)]

This bug was fixed in the package firefox-3.5 - 3.6.7+build2+nobinonly-0ubuntu0.9.10.1

---------------
firefox-3.5 (3.6.7+build2+nobinonly-0ubuntu0.9.10.1) karmic-security; urgency=low

  [ Chris Coulson <email address hidden> ]
  * New major upstream release v3.6.7 (FIREFOX_3_6_7_BUILD2)
    - see USN-930-1

  * Switch to using unversioned binaries. This means that firefox and
    firefox-gnome-support are no longer meta-packages depending on the latest
    versioned binary packages, but they ship the binary components. Convert
    firefox-3.5* packages to meta packages which pull in the unversioned binaries
    to ensure a smooth upgrade path
    - update debian/control
    - rename debian/firefox-3.5-dev.install => debian/firefox-dev.install
    - rename debian/firefox-3.5-dev.links => debian/firefox-dev.links
    - rename debian/firefox-3.5-final.desktop => debian/firefox-final.desktop
    - rename debian/firefox-3.5-gnome-support.install => debian/firefox-gnome-support.install
    - rename debian/firefox-3.5-gnome-support.postinst.in => debian/firefox-gnome-support.postinst
    - rename debian/firefox-3.5-minefield.desktop => debian/firefox-minefield.desktop
    - rename debian/firefox-3.5-restart-required.update-notifier => debian/firefox-restart-required.update-notifier
    - rename debian/firefox-3.5.dirs => debian/firefox.dirs
    - rename debian/firefox-3.5.install => debian/firefox.install
    - rename debian/firefox-3.5.links => debian/firefox.links
    - rename debian/firefox-3.5.menu => debian/firefox.menu
    - rename debian/firefox-3.5.postinst.in => debian/firefox.postinst.in
    - rename debian/firefox-3.5.postrm.in => debian/firefox.postrm.in
    - rename debian/firefox-3.5.preinst.in => debian/firefox.preinst.in
    - rename debian/firefox-3.5.prerm => debian/firefox.prerm.in
    - rename debian/abrowser-3.5.desktop => debian/abrowser.desktop
    - update Icon name in debian/firefox-final.desktop
    - update Icon name in debian/abrowser.desktop
    - update Icon and Exec fields in debian/firefox-minefield.desktop
    - update Name and Description in debian/firefox-restart-required.update-notifier
    - update debian/firefox.links to not create versioned link in /usr/bin
    - update fields in debian/firefox.menu
    - update debian/firefox.prerm.in
  * Use Namoroka instead of Shiretoko as brand name and use it for snapshots.
    Name it Namoroka in the Preferred Application UI too
    - update debian/firefox-3.6-shiretoko.desktop => debian/firefox-namoroka.desktop
    - update debian/firefox.xml
    - update debian/rules
  * Implement MIN_SYS_DEPS approach that does not use system xulrunner
    and only a minimal set of system dependencies.
    + drop patches not required anymore:
      - delete debian/patches/dont_depend_on_nspr_sources.patch
      - update debian/patches/series
    + move .install lines that depend on whether MIN_SYS_DEPS is used or not
      to debian/rules in ifneq (,$(MIN_SYS_DEPS)) blocks
      - update debian/rules
      - update debian/firefox.install
    + ship gnome support .so's inside of the main package, but keep dependencies in
      the (now empty) gnome-support package; to achieve ...