[apparmor] Evince failes to create new directory on USB-Stick (Save Dialog)

[Dieter Burghardt]

When saving a copy of a PDF to the USB-stick (automaticvally mounted when plugged in, vfat) evince can save files, but it failes to create new directories, claiming insufficent permissions.
The strange thing is, other applications (like gedit, or 'mkdir' in a terminal) have no problems creating a new directory in exactly the same location, i.e. the user should be allowed to do so and mount options should be ok too.

Mount will show the the following about the USB-stick:
/dev/sdc1 on /media/anonymous/SPACELOOP type vfat (rw,nosuid,nodev,uid=1000,gid=1000,shortname=mixed,dmask=0077,utf8=1,showexec,flush,uhelper=udisks2)

When starting evince from the terminal the console-output does not show anything when reproducing the problem.
Except for the one line that seems to be there all the time right after starting evince:
(evince:30984): EvinceDocument-CRITICAL **: ev_document_get_n_pages: assertion 'EV_IS_DOCUMENT (document)' failed

[Ubuntu Foundations Team Bug Bot (crichton)]

Thank you for taking the time to report this bug and helping to make Ubuntu better. It seems that your bug report is not filed about a specific source package though, rather it is just filed against Ubuntu in general. It is important that bug reports be filed about source packages so that people interested in the package can find the bugs about it. You can find some hints about determining what package your bug might be about at https://wiki.ubuntu.com/Bugs/FindRightPackage. You might also ask for help in the #ubuntu-bugs irc channel on Freenode.

To change the source package that this bug is filed about visit https://bugs.launchpad.net/ubuntu/+bug/1265491/+editstatus and add the package name in the text box next to the word Package.

[This is an automated message. I apologize if it reached you inappropriately; please just reply to this message indicating so.]

[Sebastien Bacher (seb128)]

Thanks, I can confirm that, it's due to apparmor it seems

"type=1400 audit(1389199770.160:157): apparmor="DENIED" operation="mkdir" parent=14276 profile="/usr/bin/evince" name="/media/user/A3D9-8295/debug/" pid=14347 comm="evince" requested_mask="c" denied_mask="c" fsuid=1000 ouid=1000"

(there are also some DENIED about open calls before)

[Sebastien Bacher (seb128)]

Not sure what to change in the profile to fix that, maybe the security team can help there? ;-)

[Sebastien Bacher (seb128)]

Jamie suggested

"+ # allow creating directories that we own
+ owner /media/**/ w,
+ owner @{HOME}/**/ w,"

which does the trick, thanks!

[Launchpad Janitor (janitor)]

This bug was fixed in the package evince - 3.10.3-0ubuntu2

---------------
evince (3.10.3-0ubuntu2) trusty; urgency=medium

  * debian/apparmor-profile.abstraction, debian/apparmor-profile:
    - let create directories, from the file selector, on devices mounted
      by the user, thanks Jamie Strandboge (lp: #1265491)
    - updated to allow opening/saving pdf.xz files, thanks Martin Thornton
      (lp: #1252771)
  * debian/control.in: Depends on gnome-icon-theme-symbolic (lp: #1246448)
 -- Sebastien Bacher <email address hidden> Wed, 08 Jan 2014 18:24:03 +0100