[Apparmor-general] usr.X11R6.bin.acroread causes error message

[John Johansen]

On Sat, Jan 06, 2007 at 03:36:25AM +0100, Malte Gell wrote:
> Hello,
> 
> I get an error that doesn´t sound plausible to mewhen opening a PDF 
> within Firefox.
> 
> /etc/subdomain.d/usr.X11R6.bin.acroread contains the following lines:
> 
> /home/*/.adobe/** lrw,
> /usr/X11R6/lib/Acrobat7/** mixr,
> 
> Nevertheless I get this error:
> 
> Jan  6 03:14:44 linux kernel: SubDomain: REJECTING link access 
> from /home/malte_gell/.adobe/Acrobat/7.0/Cert/curl-ca-bundle.crt to
>  /usr/X11R6/lib/Acrobat7/Reader/Cert/curl-ca-bundle.crt (acroread(32553) 
> profile /usr/X11R6/bin/acroread active /usr/X11R6/bin/acr
> oread)
> 
> There is write and linking permission to ~/.adobe/** according to the 
> Apparmor profile file, so I don´t unterstand why it can´t create the 
> link. Okay, not a big issue, created it now manually, just want to 
> learn.
> 
currently AA requires that
1. link being created has the l permission
2. the link and the target of the link have the same AA permissions
   (excluding the link permission)

in this case 1. is satisfied but the link only has rw while the target
has mixr, so AA won't allow this link to be created.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: not available
Url : http://forge.novell.com/pipermail/apparmor-general/attachments/20070105/17bc6624/attachment.pgp