The pidgin profile from apparmor-profiles-extra is not okay in Whonix. See
https://www.whonix.org/forum/index.php/topic,97.msg6432.html#msg6432

On top of the kde messages, they include some Ubuntu abstractions that create some parsing errors in Whonix, preventing the profile to load.
https://www.whonix.org/forum/index.php/topic,97.msg6343.html#msg6343

Retested the profile from apparmor-profiles-extra in Whonix 11, same issues,

There was another issue, when after an update, a bunch of denied messages popped, and we replaced the adapted Debian profile with the original from Whonix.
https://www.whonix.org/forum/index.php/topic,97.msg7707.html#msg7707

Retested the adapted Debian profile in Whonix 11, okay except for one new kde message that shows in the host too. Not big problem. This is the one you merged in https://github.com/troubadoour/apparmor-profile-pidgin/commit/0b33fe34ef453f620e932d35eab1b2cb6937df6b

If we want to install apparmor-profiles-extra, we should probably use your magic (config-package-dev displace to replace the original profile with our modified one).

Updated apparmor-profile-pidgin.

Because it's working in jessie, usr.bin.pidgin.anondist is reverted to the Debian profile. There is an addition, a denied message for /usr/share/aspell.
https://github.com/troubadoour/apparmor-profile-pidgin/commit/7dde08febaa2fe8310c2eb3e377a248d6783b54c

There is an issue with some profiles form apparmor-profiles and apparmor-profiles-extra. They are not loaded because of conflicting x modifiers. The problem does not show in the host. Looking onto it.

Merged. And added to repository.

sudo aa-enforce /etc/apparmor.d/usr.bin.chromium-browser

Setting /etc/apparmor.d/usr.bin.chromium-browser to enforce mode.
Traceback (most recent call last):
  File "/usr/sbin/aa-enforce", line 30, in <module>
    tool.cmd_enforce()
  File "/usr/lib/python3/dist-packages/apparmor/tools.py", line 166, in cmd_enforce
    raise apparmor.AppArmorException(cmd_info[1])
apparmor.common.AppArmorException: 'profile has merged rule with conflicting x modifiers\nERROR processing regexs for profile sanitized_helper, failed to load\n'
Setting /etc/apparmor.d/usr.bin.evince to enforce mode.
Traceback (most recent call last):
  File "/usr/sbin/aa-enforce", line 30, in <module>
    tool.cmd_enforce()
  File "/usr/lib/python3/dist-packages/apparmor/tools.py", line 166, in cmd_enforce
    raise apparmor.AppArmorException(cmd_info[1])
apparmor.common.AppArmorException: 'profile has merged rule with conflicting x modifiers\nERROR processing regexs for profile sanitized_helper, failed to load\n'

The issue must be somewhere within these lines:
https://github.com/Whonix/apparmor-profile-anondist/blob/814ec01c4189ea0e897ba066ee3f914aa530f2ae/etc/apparmor.d/abstractions/base.anondist#L118-152

(Because when commenting those out, the profile can be loaded.)

I missed that post. Thanks for the finding.

Another one. config-package-dev displace installs the .orig file in /etc/apparmor.d. So after installing apparmor-profiles-extra, the original Pidgin profile is parsed by AppArmor, and we end up with the same situation.

What error do you get? The install error?

Unpacking apparmor-profiles-extra (1.4) ...
dpkg: error processing archive /var/cache/apt/archives/apparmor-profiles-extra_1.4_all.deb (--unpack):
 trying to overwrite '/etc/apparmor.d/usr.bin.pidgin', which is also in package apparmor-profile-pidgin 3:1.2-1
Errors were encountered while processing:
 /var/cache/apt/archives/apparmor-profiles-extra_1.4_all.deb
E: Sub-process /usr/bin/dpkg returned an error code (1)

That's maybe because apparmor-profile pidgin isn't updated in the Whonix jessie / developers repository. Still working on that (T342, T325).

Otherwise if somehow the .orig file is parsed, maybe instead of config-package-dev displace, I should have used config-package-dev hide. Then that file is moved out of the way.

Actually a different issue:
https://phabricator.whonix.org/T314#5122

I think this happens because /etc/apparmor.d/usr.bin.chromium-browser tries to grant rights to files located in /usr/share/ somewhere, while apparmor-profile-anondist /etc/apparmor.d/abstractions/base.anondist granted different rights.

It was not the install error, but the original file was parsed, provoking the conflicting x modifiers error.

The problem, along with the offending profiles (chromium-browser, evince) is solved in https://github.com/troubadoour/apparmor-profile-anondist/commit/fbf9542507b998751a4f727d7f90307c47ed831a

For executables, we have to give permissions to files individually, wildcards are not allowed, apparently. What is strange is that the Whonix profiles do not complain. Anyhow, I have been on and off on this for quite some time, and did not look at the obvious: base.anondist.

We can either remove the file displacement, or better I think, remove the Pidgin profile completely from Whonix, and users can install the one from apparmor-profiles-extra. They are similar, I was just removing some Ubuntu abstractions.

In T314#5374, @troubadour wrote:

It was not the install error, but the original file was parsed, provoking the conflicting x modifiers error.

I see. So I suppose if one deleted the .orig file, the issue would be gone?

The problem, along with the offending profiles (chromium-browser, evince) is solved in https://github.com/troubadoour/apparmor-profile-anondist/commit/fbf9542507b998751a4f727d7f90307c47ed831a

Nice! Merged!

We can either remove the file displacement, or better I think, remove the Pidgin profile completely from Whonix, and users can install the one from apparmor-profiles-extra. They are similar, I was just removing some Ubuntu abstractions.

Yeah. If the upstream profile works with Whonix, by all means, let's remove it.

If you want, I'll empty the package. Remove the apparmor profile and add a config-package-dev undisplace to restore original state. (And keep the empty package, perhaps it will be reintroduced in not so far future.)

The upstream profile works with Whonix, and it's probably safer to keep the empty package.

Clearing config-package-dev is non-trival. Postponing this to Whonix 12.