Can't preview document in evince - Ubuntu 18.10 Failed to execute child process (Permission Denied)

[Chris Guiver]

Ubuntu 18.10 Evince of a PDF

Clicking PREVIEW I get busy awhile then

Failed to print document
Failed to execute child process "/usr/lib/x86_64-linux-gnu/glib-2.0/gio-launch-desktop" (Permissions denied)

--

I looked at this only because of https://community.ubuntu.com/t/failed-to-preview-print/7956 where a user "flaviosm" reported the same thing.

In `dmesg` I noted the following

[43361.474096] audit: type=1400 audit(1536710182.492:65): apparmor=“DENIED” operation=“exec” profile="/usr/bin/evince" name="/usr/lib/x86_64-linux-gnu/glib-2.0/gio-launch-desktop" pid=11840 comm=“evince” requested_mask=“x” denied_mask=“x” fsuid=1000 ouid=0

I rebooted and tried again, (same result)

[ 400.208807] audit: type=1400 audit(1536711261.421:51): apparmor=“DENIED” operation=“exec” profile="/usr/bin/evince" name="/usr/lib/x86_64-linux-gnu/glib-2.0/gio-launch-desktop" pid=5302 comm=“evince” requested_mask=“x” denied_mask=“x” fsuid=1000 ouid=0

Note: I don't have a printer setup on my box (I don't print from it), so this could be the cause! I don't know if this applies to "flaviosm" too.. I can connect & test after printer is setup if deemed helpful (headcold - so no motivation currently)

Filed online as unsuccessful via via `ubuntu-bug` on actual box..

[Olivier Tilloy (osomon)]

I'm getting a similar error when clicking a hyperlink in a PDF document. An error ribbon appears:

    Unable to open external link
    Failed to execute child process “/usr/lib/x86_64-linux-gnu/glib-2.0/gio-launch-desktop” (Permission denied)

[Olivier Tilloy (osomon)]

Unloading the evince apparmor profile makes the issue go away (until the next reboot):

    sudo apparmor_parser -R /etc/apparmor.d/usr.bin.evince

[Olivier Tilloy (osomon)]

Added an apparmor task as this should probably be fixed in /etc/apparmor.d/abstractions/gnome which is installed by apparmor.

[Olivier Tilloy (osomon)]

Patch submitted upstream: https://gitlab.com/apparmor/apparmor/merge_requests/198
If upstream signs it off I will backport it to ubuntu as a distro patch.

[Olivier Tilloy (osomon)]

debian bug report: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=908516

[Olivier Tilloy (osomon)]

Removed the apparmor task as upstream nacked my patch, they say the new rule should go in the evince profile.

[Olivier Tilloy (osomon)]

Merge request against debian package: https://salsa.debian.org/gnome-team/evince/merge_requests/1

[Olivier Tilloy (osomon)]

Related bug for opening a hyperlink when the default browser is a snap: bug #1794064.

[Olivier Tilloy (osomon)]

This is fixed in evince 3.30.0-3 in debian, and a sync has been requested, it's currently sitting in the unapproved queue because of the beta freeze.

[Olivier Tilloy (osomon)]

Now in cosmic-proposed.

[Olivier Tilloy (osomon)]

Now in cosmic.