I took the liberty to login on baloo, and noticed two groups of denials: profile /usr/bin/mlmmj-receive /var/spool/mlmmj-gone/gone2/incoming/* rw, Any idea what the difference between /var/spool/mlmmj/ and /var/spool/mlmmj-gone/ is and if allowing this makes sense? profile /usr/bin/mlmmj-sub /var/spool/mlmmj/*/moderation/subscribe* rw, .../moderation/* of course also works, but I'd tend to restrict mlmmj to .../moderation/subscribe* - given the binary name, I hope it doesn't do other things ;-)