apparmor override helpers

[Konfekt]

Can one configure msmtp to execute a helper without a shell so that no /bin/sh is spawned and helpers is not entered ?
Since msmtp’s passwordeval always uses /bin/sh -c (common behavior), this does not seem feasible.

Rules within the helpers subprofile can only be added inside that subprofile’s braces.
The (Debian) packaged profile already defines “profile helpers { … }”. A second “profile helpers { … }” in a later include produces “Multiple definitions for hat helpers …”.
Without modifying the packaged file, the only safe way to place rules inside helpers is to ship a replacement profile file that contains a helpers-local include.

Therefore, could on include “#include <local/usr.bin.msmtp.helpers>” inside the helpers subprofile in the packaged file to support site-local extensions without replacements?

[Konfekt]

@hseg pointed out @ferdinandyb 's msmtpq set-up which recommends changing the helpers section directly

profile helpers { #include <abstractions/base> /{,usr/}bin/bash mr, /{,usr/}bin/dash mr, /tmp/ rw, owner /tmp/* rw, /usr/bin/secret-tool PUx, /usr/bin

While this will work fine till the next msmtp package update, the idea of this issue is to make it survive these as well, likely similar to the purpose of the “#include <local/usr.bin.msmtp.helpers>” line.

In case one uses Debian or one of its derivatives, an issue has already been opened there