Hello,
I have one issue with launching thunderbird from a libreoffice macro. Simple macro is below :
Sub CommandeShell
Dim iOutput as Integer
rem iOutput = Shell("gnucash",2)
iOutput = Shell("thunderbird",2)
End Sub
AppArmor is denying the launch “libreoffice-writer.desktop[3762]: snap-confine has elevated permissions and is not confined but should be. Refusing to continue to avoid permission escalation attacks”
This happens only for snap components like thunderbird or firefox. It works fine with gnucash which is not a snap componant.
Please find the systemlog :
2024-10-06T17:49:38.312759+02:00 admjeremy-Modern-15-B12MO kernel: kauditd_printk_skb: 12 callbacks suppressed
2024-10-06T17:49:38.312806+02:00 admjeremy-Modern-15-B12MO kernel: audit: type=1400 audit(1728229778.311:240): apparmor="ALLOWED" operation="exec" class="file" profile="libreoffice-soffice" name="/usr/bin/snap" pid=3762 comm="osl_executeProc" requested_mask="x" denied_mask="x" fsuid=1026 ouid=0 target="libreoffice-soffice//null-/usr/bin/snap"
2024-10-06T17:49:38.332709+02:00 admjeremy-Modern-15-B12MO kernel: audit: type=1400 audit(1728229778.331:241): apparmor="ALLOWED" operation="file_inherit" class="file" profile="libreoffice-soffice//null-/usr/bin/snap" name="/usr/lib/libreoffice/program/types.rdb" pid=3762 comm="thunderbird" requested_mask="r" denied_mask="r" fsuid=1026 ouid=0
2024-10-06T17:49:38.332758+02:00 admjeremy-Modern-15-B12MO kernel: audit: type=1400 audit(1728229778.331:242): apparmor="ALLOWED" operation="file_inherit" class="file" profile="libreoffice-soffice//null-/usr/bin/snap" name="/usr/lib/libreoffice/program/types/offapi.rdb" pid=3762 comm="thunderbird" requested_mask="r" denied_mask="r" fsuid=1026 ouid=0
2024-10-06T17:49:38.332766+02:00 admjeremy-Modern-15-B12MO kernel: audit: type=1400 audit(1728229778.331:243): apparmor="ALLOWED" operation="file_inherit" class="file" profile="libreoffice-soffice//null-/usr/bin/snap" name="/usr/lib/libreoffice/program/types/oovbaapi.rdb" pid=3762 comm="thunderbird" requested_mask="r" denied_mask="r" fsuid=1026 ouid=0
2024-10-06T17:49:38.332771+02:00 admjeremy-Modern-15-B12MO kernel: audit: type=1400 audit(1728229778.331:244): apparmor="ALLOWED" operation="file_inherit" class="file" profile="libreoffice-soffice//null-/usr/bin/snap" name="/home/jeremy/.config/libreoffice/4/user/extensions/bundled/extensions.pmap" pid=3762 comm="thunderbird" requested_mask="wr" denied_mask="wr" fsuid=1026 ouid=1026
2024-10-06T17:49:38.332775+02:00 admjeremy-Modern-15-B12MO kernel: audit: type=1400 audit(1728229778.331:245): apparmor="ALLOWED" operation="file_inherit" class="file" profile="libreoffice-soffice//null-/usr/bin/snap" name="/tmp/lu362117z6.tmp/lu3621{B6CDF2B1-94A5-4438-AC28-B5A26559F308}.tmp" pid=3762 comm="thunderbird" requested_mask="wr" denied_mask="wr" fsuid=1026 ouid=1026
2024-10-06T17:49:38.332841+02:00 admjeremy-Modern-15-B12MO kernel: audit: type=1400 audit(1728229778.331:246): apparmor="ALLOWED" operation="file_inherit" class="file" profile="libreoffice-soffice//null-/usr/bin/snap" name="/usr/share/libreoffice/share/config/images_yaru.zip" pid=3762 comm="thunderbird" requested_mask="r" denied_mask="r" fsuid=1026 ouid=0
2024-10-06T17:49:38.332846+02:00 admjeremy-Modern-15-B12MO kernel: audit: type=1400 audit(1728229778.331:247): apparmor="ALLOWED" operation="file_inherit" class="file" profile="libreoffice-soffice//null-/usr/bin/snap" name="/usr/lib/jvm/java-21-openjdk-amd64/lib/modules" pid=3762 comm="thunderbird" requested_mask="r" denied_mask="r" fsuid=1026 ouid=0
2024-10-06T17:49:38.332849+02:00 admjeremy-Modern-15-B12MO kernel: audit: type=1400 audit(1728229778.331:248): apparmor="ALLOWED" operation="file_inherit" class="file" profile="libreoffice-soffice//null-/usr/bin/snap" name="/usr/share/java/hsqldb1.8.0-1.8.0.10+dfsg.jar" pid=3762 comm="thunderbird" requested_mask="r" denied_mask="r" fsuid=1026 ouid=0
2024-10-06T17:49:38.332852+02:00 admjeremy-Modern-15-B12MO kernel: audit: type=1400 audit(1728229778.331:249): apparmor="ALLOWED" operation="file_inherit" class="file" profile="libreoffice-soffice//null-/usr/bin/snap" name="/usr/share/java/unoloader-24.2.5.jar" pid=3762 comm="thunderbird" requested_mask="r" denied_mask="r" fsuid=1026 ouid=0
2024-10-06T17:49:38.430281+02:00 admjeremy-Modern-15-B12MO systemd[1797]: Started snap.thunderbird.thunderbird-e8ccf22f-bbfc-4182-9030-767db0c44cfc.scope.
2024-10-06T17:49:38.446148+02:00 admjeremy-Modern-15-B12MO libreoffice-writer.desktop[3762]: snap-confine has elevated permissions and is not confined but should be. Refusing to continue to avoid permission escalation attacks
2024-10-06T17:49:38.446399+02:00 admjeremy-Modern-15-B12MO libreoffice-writer.desktop[3762]: Please make sure that the snapd.apparmor service is enabled and started.
I made a lot of forum search, and finally I got a silly workaround : aa-teardown followed by aa-load.
This works , but has to be done after each reboot. Any idea to fix it ?