From c691b11d6e9cdc8c03e45af4ccea0fafefea31d2 Mon Sep 17 00:00:00 2001 From: Alex Murray Date: Thu, 6 Apr 2023 11:47:44 +0930 Subject: [PATCH] abstractions/base: allow reading tzdata ICU zoneinfo DB This is used by various applications including libreoffice etc so it may as well be added to the base abstraction along with the existing zoneinfo DB access. AVC apparmor="DENIED" operation="open" class="file" profile="snap.libreoffice.calc" name="/usr/share/zoneinfo-icu/44/le/zoneinfo64.res" pid=44742 comm="soffice.bin" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0 Signed-off-by: Alex Murray --- profiles/apparmor.d/abstractions/base | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/profiles/apparmor.d/abstractions/base b/profiles/apparmor.d/abstractions/base index 81c50359e..58925807e 100644 --- a/profiles/apparmor.d/abstractions/base +++ b/profiles/apparmor.d/abstractions/base @@ -36,8 +36,8 @@ /usr/share/locale-langpack/** r, /usr/share/locale/** r, /usr/share/**/locale/** r, - /usr/share/zoneinfo/ r, - /usr/share/zoneinfo/** r, + /usr/share/zoneinfo{,-icu}/ r, + /usr/share/zoneinfo{,-icu}/** r, /usr/share/X11/locale/** r, @{run}/systemd/journal/dev-log w, # systemd native journal API (see sd_journal_print(4))