Created attachment 350100 [details] content of /etc/apparmor.d I've tried to generate a profile for firefox-bin. Started 'aa-genprof -d /etc/apparmor.d/ firefox' and after I closed firefox 'aa-logprof -d /etc/apparmor.d/ -f firefox-apparmor-logs1.log -m e377982d33787516e962c32663fcada5' to process the logs (I've extracted the logfile from /var/log/messages and attach it later). Here's what I get. gaia3 balage # aa-logprof -d /etc/apparmor.d/ -f firefox-apparmor-logs1.log -m e377982d33787516e962c32663fcada5 firefox-apparmor-logs1.log naplóbejegyzéseinek olvasása. AppArmor profilok frissítése itt: /etc/apparmor.d. Profil: /usr/bin/firefox-bin Végrehajtás: /opt/firefox/firefox Súlyosság: ismeretlen (I)nherit / (P)rofile / (C)hild / (N)ame / (U)nconfined / (X)ix / (D)eny / Abo(r)t / (F)inish Profil: /usr/bin/firefox-bin Végrehajtás: /usr/bin/kde4-config Súlyosság: ismeretlen (I)nherit / (P)rofile / (C)hild / (N)ame / (U)nconfined / (X)ix / (D)eny / Abo(r)t / (F)inish PromptUser: Érvénytelen gyorsbillentyű a következőhöz: 'Igen' This means roughly in Hungarian that "Invalid shortcut to following: 'Yes'" However if I set the locale to en_US (found it working on another Gentoo installation where en_US is the default) it seems to work. gaia3 balage # export LC_ALL="en_US.UTF-8" gaia3 balage # aa-logprof -d /etc/apparmor.d/ -f firefox-apparmor-logs1.log -m e377982d33787516e962c32663fcada5 Reading log entries from firefox-apparmor-logs1.log. Updating AppArmor profiles in /etc/apparmor.d. Profile: /usr/bin/firefox-bin Execute: /opt/firefox/firefox Severity: unknown (I)nherit / (P)rofile / (C)hild / (N)ame / (U)nconfined / (X)ix / (D)eny / Abo(r)t / (F)inish Profile: /usr/bin/firefox-bin Execute: /usr/bin/kde4-config Severity: unknown (I)nherit / (P)rofile / (C)hild / (N)ame / (U)nconfined / (X)ix / (D)eny / Abo(r)t / (F)inish Should AppArmor sanitize the environment when switching profiles? Sanitizing the environment is more secure, but this application appears to use LD_PRELOAD or LD_LIBRARY_PATH and clearing these could cause functionality problems. (Y)es / [(N)o] Writing updated profile for /usr/bin/kde4-config. Complain-mode changes: Profile: /usr/bin/firefox-bin Path: /dev/dri/card0 Mode: rw Severity: unknown 1 - #include <abstractions/X> 2 - #include <abstractions/gnome> 3 - #include <abstractions/kde> 4 - #include <abstractions/ubuntu-gnome-terminal> 5 - #include <abstractions/ubuntu-konsole> [6 - /dev/dri/card0] [(A)llow] / (D)eny / (G)lob / Glob w/(E)xt / (N)ew / Abo(r)t / (F)inish / (O)pts Are you sure you want to abandon this set of profile changes and exit? (Y)es / [(N)o] Abandoning all changes. I though this may be related to perl so I upgraded from 5.12.4-r1 to 5.16.3 (and ran perl-cleaner all) but nothing has changed. I am attaching my profile directory and the logfiles too, as well as my emerge --info. gaia3 balage # emerge --info Portage 2.1.11.62 (default/linux/amd64/13.0/desktop/kde, gcc-4.6.3, glibc-2.15-r3, 3.8.13-gentoo x86_64) ================================================================= System uname: Linux-3.8.13-gentoo-x86_64-Intel-R-_Core-TM-_i5_CPU_M_520_@_2.40GHz-with-gentoo-2.2 KiB Mem: 7961364 total, 2660348 free KiB Swap: 3903484 total, 3903484 free Timestamp of tree: Mon, 03 Jun 2013 00:45:01 +0000 ld GNU ld (GNU Binutils) 2.22 ccache version 3.1.9 [enabled] app-shells/bash: 4.2_p45 dev-java/java-config: 2.1.12-r1 dev-lang/python: 2.7.3-r3, 3.2.3-r2 dev-util/ccache: 3.1.9 dev-util/cmake: 2.8.10.2-r2 dev-util/pkgconfig: 0.28 sys-apps/baselayout: 2.2 sys-apps/openrc: 0.11.8 sys-apps/sandbox: 2.5 sys-devel/autoconf: 2.13, 2.69 sys-devel/automake: 1.11.6, 1.12.6 sys-devel/binutils: 2.22-r1 sys-devel/gcc: 4.6.3 sys-devel/gcc-config: 1.7.3 sys-devel/libtool: 2.4-r1 sys-devel/make: 3.82-r4 sys-kernel/linux-headers: 3.7 (virtual/os-headers) sys-libs/glibc: 2.15-r3 Repositories: gentoo unoffical-balabit-overlay hardened-dev ACCEPT_KEYWORDS="amd64" ACCEPT_LICENSE="* -@EULA PUEL skype-eula dlj-1.1 googleearth AdobeFlash-10.3 google-talkplugin Q3AEULA Google-TOS AdobeFlash-11.x google-chrome" CBUILD="x86_64-pc-linux-gnu" CFLAGS="-march=native -O2 -pipe" CHOST="x86_64-pc-linux-gnu" CONFIG_PROTECT="/etc /usr/share/config /usr/share/gnupg/qualified.txt /usr/share/polkit-1/actions" CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/dconf /etc/env.d /etc/fonts/fonts.conf /etc/gconf /etc/gentoo-release /etc/php/apache2-php5.3/ext-active/ /etc/php/cgi-php5.3/ext-active/ /etc/php/cli-php5.3/ext-active/ /etc/revdep-rebuild /etc/sandbox.d /etc/splash /etc/terminfo" CXXFLAGS="-march=native -O2 -pipe" DISTDIR="/_gentoo_portage/distfiles" FCFLAGS="-O2 -pipe" FEATURES="assume-digests binpkg-logs ccache config-protect-if-modified distlocks ebuild-locks fixlafiles merge-sync metadata-transfer news parallel-fetch protect-owned sandbox sfperms strict unknown-features-warn unmerge-logs unmerge-orphans userfetch webrsync-gpg" FFLAGS="-O2 -pipe" GENTOO_MIRRORS="http://de-mirror.org/distro/gentoo/ http://mirror.switch.ch/ftp/mirror/gentoo/ http://gentoo.osuosl.org/ http://gentoo.inode.at/" LANG="hu_HU.UTF-8" LC_ALL="hu_HU.UTF-8" LDFLAGS="-Wl,-O1 -Wl,--as-needed" MAKEOPTS="-j3" PKGDIR="/_gentoo_portage/packages" PORTAGE_CONFIGROOT="/" PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress --force --whole-file --delete --stats --human-readable --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages" PORTAGE_TMPDIR="/_gentoo_portage/tmp" PORTDIR="/_gentoo_portage/portage" PORTDIR_OVERLAY="/_gentoo_portage/overlays/balabit /_gentoo_portage/overlays/hardened-dev" SYNC="rsync://rsync.europe.gentoo.org/gentoo-portage" USE="X a52 aac acl acpi alsa amd64 bash-completion berkdb branding bzip2 cairo cdda cdr cli consolekit cracklib crypt cups cxx dbus declarative dri dts dvd dvdr emboss exif fam firefox flac fortran gdbm gif gpm gtk iconv icu ipv6 jpeg kde kipi lcms libnotify mad mmx mmxext mng modules mp3 mp4 mpeg mudflap multilib ncurses nls nptl ogg opengl openmp pam pango pcre pdf phonon plasma png policykit ppds pulseaudio qt3support qt4 readline sdl semantic-desktop session sse sse2 sse3 ssl ssse3 startup-notification svg tcpd tiff truetype udev udisks unicode upower usb v4l vorbis wxwidgets x264 xcb xcomposite xinerama xml xscreensaver xv xvid zlib" ABI_X86="64" ALSA_CARDS="hda-intel" APACHE2_MODULES="authn_core authz_core socache_shmcb unixd actions alias auth_basic authn_alias authn_anon authn_dbm authn_default authn_file authz_dbm authz_default authz_groupfile authz_host authz_owner authz_user autoindex cache cgi cgid dav dav_fs dav_lock deflate dir disk_cache env expires ext_filter file_cache filter headers include info log_config logio mem_cache mime mime_magic negotiation rewrite setenvif speling status unique_id userdir usertrack vhost_alias" CALLIGRA_FEATURES="kexi words flow plan sheets stage tables krita karbon braindump author" CAMERAS="ptp2" COLLECTD_PLUGINS="df interface irq load memory rrdtool swap syslog" ELIBC="glibc" GPSD_PROTOCOLS="ashtech aivdm earthmate evermore fv18 garmin garmintxt gpsclock itrax mtk3301 nmea ntrip navcom oceanserver oldstyle oncore rtcm104v2 rtcm104v3 sirf superstar2 timing tsip tripmate tnt ubx" INPUT_DEVICES="keyboard mouse evdev synaptics" KERNEL="linux" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" LIBREOFFICE_EXTENSIONS="presenter-console presenter-minimizer" LINGUAS="en hu" OFFICE_IMPLEMENTATION="libreoffice" PHP_TARGETS="php5-3" PYTHON_SINGLE_TARGET="python2_7" PYTHON_TARGETS="python2_7 python3_2" RUBY_TARGETS="ruby19 ruby18" USERLAND="GNU" VIDEO_CARDS="vesa intel fbdev" XTABLES_ADDONS="quota2 psd pknock lscan length2 ipv4options ipset ipp2p iface geoip fuzzy condition tee tarpit sysrq steal rawnat logmark ipmark dhcpmac delude chaos account" Unset: CPPFLAGS, CTARGET, EMERGE_DEFAULT_OPTS, INSTALL_MASK, PORTAGE_BUNZIP2_COMMAND, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS, USE_PYTHON I've got the kernel patches for gentoo-sources-3.8.13 from here: https://git.kernel.org/cgit/linux/kernel/git/jj/linux-apparmor.git/refs/heads
Created attachment 350102 [details] input for aa-logprof
USE flags of apparmor-utils consist of linguas_hu and python_targets_python2_7.
Created attachment 350836 [details, diff] apparmor-utils-2.8.1-hu.patch The problem is that there is no shortcut key defined in the translated string ie. it should be "(I)gen". The attached patch should solve the issue you are having. I will raise this with upstream too.
(In reply to Michael Palimaka (kensington) from comment #3) > Created attachment 350836 [details, diff] [details, diff] > apparmor-utils-2.8.1-hu.patch > > The problem is that there is no shortcut key defined in the translated > string ie. it should be "(I)gen". > > The attached patch should solve the issue you are having. I will raise this > with upstream too. Thanks a lot Michael. I confirm that after I applied your patch it works! How would you like to incorporate it into the ebuild?
Thanks for testing. The patch has been acknowledged upstream, and hopefully will be merged soon. In the meantime, I have added a revision bump to the overlay with the patch.
