Comment 16 for bug 177924

Followup:
I think the issue may be an old profile sitting in enforce mode during dist-upgrade that didn't get handled properly.

I was able to load the profile from scratch properly on a clean heron install on another machine.

tldr "nevermind i fixed it"