Looks like it's enough to add:
/dev/shm/org.chromium.* rw,
To make Thunderbird 58 work again.
I do see some more strange denies, that I've seen with other applications too:
type=AVC msg=audit(1516647002.344:734): apparmor="DENIED" operation="file_mmap" profile="thunderbird"
name="/home/vincas/#12976645" pid=23705 comm="thunderbird" requested_mask="m" denied_mask="m" fsuid=1000 ouid=1000
type=SYSCALL msg=audit(1516647002.344:734): arch=c000003e syscall=9 success=no exit=-13 a0=0 a1=20000 a2=5 a3=1 items=0
ppid=23694 pid=23705 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts2
ses=4 comm="thunderbird" exe="/usr/lib/thunderbird/thunderbird-bin" key=(null)
type=AVC msg=audit(1516647002.968:744): apparmor="DENIED" operation="mkdir" profile="thunderbird"
name="/home/vincas.nv/" pid=23705 comm="thunderbird" requested_mask="c" denied_mask="c" fsuid=1000 ouid=1000
type=SYSCALL msg=audit(1516647002.968:744): arch=c000003e syscall=83 success=no exit=-13 a0=7f81fc94ac20 a1=1ff a2=1
a3=1 items=0 ppid=23694 pid=23705 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000
fsgid=1000 tty=pts2 ses=4 comm="thunderbird" exe="/usr/lib/thunderbird/thunderbird-bin" key=(null)
"/home/vincas/#12976645" and "/home/vincas.nv/" ???
It reproduces only if I run Thunderbird via `optirun`, to enable descrete
NVIDIA graphics.
