firefox profile fails to load when java abstraction is enabled

If default-jre-headless is installed, the following line in /etc/apparmor.d/abstractions/ubuntu-browsers.d/java causes the parser to fail:
/usr/lib/jvm/java-6-openjdk*/jre/bin/java cx -> browser_openjdk,

Changing this to allows it to succeed:
/usr/lib/jvm/java-6-openjdk/jre/bin/java cx -> browser_openjdk,
/usr/lib/jvm/java-6-openjdk-{amd64,armel,armhf,i386,powerpc}/jre/bin/java cx -> browser_openjdk,

Interestingly, using:
/usr/lib/jvm/java-6-openjdk/jre/bin/java cx -> browser_openjdk,
/usr/lib/jvm/java-6-openjdk-*/jre/bin/java cx -> browser_openjdk,

also fails, which is curious as the directories with default-jre-headless installed are:
$ ls -1 /usr/lib/jvm/
default-java
java-1.6.0-openjdk
java-1.6.0-openjdk-amd64
java-6-openjdk
java-6-openjdk-amd64
java-6-openjdk-common
java-7-openjdk-amd64

But without are:
$ ls -1 /usr/lib/jvm/
java-1.6.0-openjdk-amd64
java-6-openjdk-amd64
java-6-openjdk-common
java-7-openjdk-amd64

/usr/lib/jvm/java-6-openjdk-*/ should work out to the same directories as /usr/lib/jvm/java-6-openjdk-{amd64,armel,armhf,common,i386,powerpc}/, but the parser doesn't like it.

This bug was fixed in the package apparmor - 2.7.99-0ubuntu3

---------------
apparmor (2.7.99-0ubuntu3) precise; urgency=low

  * debian/patches/0009-lp943161.patch: update to not fail when
    default-jre-headless is installed (LP: #945019)
 -- Jamie Strandboge <email address hidden> Fri, 02 Mar 2012 12:47:03 -0600

default-jre-headless is not installed on my system (see bug #945022)

i'm using java6 (ferramroberto ppa) and openjdk is not installed at all, so this issue might have some other(s) source.

The default-jre-headless was a red herring (y testing apparently failed). However, why this works:
/usr/lib/jvm/java-6-openjdk/jre/bin/java cx -> browser_openjdk,
/usr/lib/jvm/java-6-openjdk-{amd64,armel,armhf,i386,powerpc}/jre/bin/java cx -> browser_openjdk,

but this does not:
/usr/lib/jvm/java-6-openjdk*/jre/bin/java cx -> browser_openjdk,

is still confusing.

Thanks Jamie

will this new package land into builders queue ? (queue is empty & i does not see it)

Hopes that the apparmor new settings built in kernel 3.2.0-18-28 will not conflict (im already using it from pre-proposed ppa)

dino99, no it won't conflict with that kernel and it looks like it is already built: https://launchpad.net/ubuntu/+source/apparmor/2.7.99-0ubuntu3

Ok received it and the installation does not complaint :) Sorry for the previous comments, can be forgotten now.

The reason a there is no conflict for
 1. /usr/lib/jvm/java-6-openjdk/jre/bin/java cx -> browser_openjdk,
 2. /usr/lib/jvm/java-6-openjdk-{amd64,armel,armhf,i386,powerpc}/jre/bin/java cx -> browser_openjdk,
but there is for
 3. /usr/lib/jvm/java-6-openjdk/jre/bin/java cx -> browser_openjdk,
 4. /usr/lib/jvm/java-6-openjdk*/jre/bin/java cx -> browser_openjdk,

is that there is an intersection where both rules match
    /usr/lib/jvm/java-6-openjdk/jre/bin/java

while this should be allowed as they specify the same transition and permissions there appears to be a bug with the exec permissions tracking in the apparmor parser so that this intersection is being rejected as having conflicting x permissions.

The issue is that

  /usr/lib/jvm/java-6-openjdk*/jre/bin/java

overlaps with the immediately following line

  /usr/lib/jvm/java-*-sun-1.*/jre/bin/java{,_vm}

and they have different cx targets.