thumbnailer cannot create tempfiles (with apparmor denials)

[Ralf Hildebrandt]

* Impact

Nautilus fails to generate previews for pdf files

* Test case

Download/copy a pdf, open the directory in nautilus, a preview image should be displayed

* Regression potential

Check that there are no other apparmor denials and the thumbnailer works

-------------

While trying to create thumbnails in a directory from within nautilus, I got:

[781429.784125] audit: type=1400 audit(1539694722.247:989): apparmor="DENIED" operation="mknod" profile="/usr/bin/evince-thumbnailer" name="/tmp/gnome-desktop-thumbnailer.png" pid=30937 comm="evince-thumbnai" requested_mask="c" denied_mask="c" fsuid=1000 ouid=1000
[781429.940592] audit: type=1400 audit(1539694722.403:990): apparmor="DENIED" operation="mknod" profile="/usr/bin/evince-thumbnailer" name="/tmp/gnome-desktop-thumbnailer.png" pid=30941 comm="evince-thumbnai" requested_mask="c" denied_mask="c" fsuid=1000 ouid=1000
[781430.314591] audit: type=1400 audit(1539694722.779:991): apparmor="DENIED" operation="mknod" profile="/usr/bin/evince-thumbnailer" name="/tmp/gnome-desktop-thumbnailer.png" pid=30945 comm="evince-thumbnai" requested_mask="c" denied_mask="c" fsuid=1000 ouid=1000
[781431.283522] audit: type=1400 audit(1539694723.747:992): apparmor="DENIED" operation="mknod" profile="/usr/bin/evince-thumbnailer" name="/tmp/gnome-desktop-thumbnailer.png" pid=30949 comm="evince-thumbnai" requested_mask="c" denied_mask="c" fsuid=1000 ouid=1000
[781431.518566] audit: type=1400 audit(1539694723.983:993): apparmor="DENIED" operation="mknod" profile="/usr/bin/evince-thumbnailer" name="/tmp/gnome-desktop-thumbnailer.png" pid=30953 comm="evince-thumbnai" requested_mask="c" denied_mask="c" fsuid=1000 ouid=1000

ProblemType: Bug
DistroRelease: Ubuntu 18.10
Package: evince 3.30.1-1
ProcVersionSignature: Ubuntu 4.18.0-8.9-generic 4.18.7
Uname: Linux 4.18.0-8-generic x86_64
ApportVersion: 2.20.10-0ubuntu13
Architecture: amd64
CurrentDesktop: ubuntu:GNOME
Date: Tue Oct 16 14:59:00 2018
InstallationDate: Installed on 2014-06-19 (1580 days ago)
InstallationMedia: Ubuntu 14.04 LTS "Trusty Tahr" - Release amd64 (20140417)
ProcEnviron:
 TERM=xterm-256color
 PATH=(custom, no user)
 XDG_RUNTIME_DIR=<set>
 LANG=de_DE.UTF-8
 SHELL=/bin/bash
SourcePackage: evince
UpgradeStatus: Upgraded to cosmic on 2018-10-07 (9 days ago)

[Jamie Strandboge (jdstrand)]

It looks like the path changed. We have a rule for this already:

owner /tmp/.gnome_desktop_thumbnail.* w,

I'll adjust.

[Jamie Strandboge (jdstrand)]

Ralf, you can workaround this by adjust /etc/apparmor.d/local/usr.bin.evince to have this at the end of the evince-thumbnailer profile:

owner /tmp/{,.}gnome_desktop_thumbnail.* w,

then running: sudo apparmor_parser -r /etc/apparmor.d/usr.bin.evince

[Jamie Strandboge (jdstrand)]

Sorry, I said "at the end of the thumbnailer profile". I mean to say:

Ralf, you can workaround this by adjusting /etc/apparmor.d/local/usr.bin.evince to have this:

owner /tmp/{,.}gnome_desktop_thumbnail.* w,

then running: sudo apparmor_parser -r /etc/apparmor.d/usr.bin.evince

[Launchpad Janitor (janitor)]

This bug was fixed in the package evince - 3.30.1-1ubuntu1

---------------
evince (3.30.1-1ubuntu1) cosmic; urgency=medium

  * debian/apparmor-profile: adjust thumbnailer policy for updated temporary
    file path during nautilus thumbnail generation (LP: #1798091)

 -- Jamie Strandboge <email address hidden> Tue, 16 Oct 2018 14:28:09 +0000

[Sebastien Bacher (seb128)]

Hey Jamie, sorry but it seems that issue didn't get fixed, see bug #1799688

The denied error states
name="/tmp/gnome-desktop-thumbnailer.png"

or your rule is
"owner /tmp/{,.}gnome_desktop_thumbnail.* w,"

there is at least a mismatch _ vs - in the filename

but also "thumnail.*" seems to not work, if I replace ".*" by "er.png" (e.g the exact filename) then nautilus starts showing the pdf previews (I tested by copying a pdf as a new bug.pdf name)

[Sebastien Bacher (seb128)]

using "owner /tmp/{,.}gnome-desktop-thumbnailer.* w," and reloading the profile works

[Benoit Tainturier (b-tainturier)]

Using "owner /tmp/{,.}gnome_desktop_thumbnail.* w," and reloading the profile doesn't work.
Using "owner /tmp/{,.}gnome-desktop-thumbnailer.* w," and reloading the profile works.

[Sebastien Bacher (seb128)]

The filename changed when starting to use bubblewrap, the gnome-desktop corresponding code is
https://gitlab.gnome.org/GNOME/gnome-desktop/blob/master/libgnome-desktop/gnome-desktop-thumbnail-script.c#L730

[Jamie Strandboge (jdstrand)]

I'll be updating a new version on top of Seb's changes. Marking back to In Progress for now.

[Jamie Strandboge (jdstrand)]

Uploaded 3.30.1-1ubuntu1.2 to cosmic-proposed.

[Steve Langasek (vorlon)]

Hello Ralf, or anyone else affected,

Accepted evince into cosmic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/evince/3.30.1-1ubuntu1.2 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-cosmic to verification-done-cosmic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-cosmic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Hugo Otto (hugootto)]

Bug fixed for me. evince 3.30.1-1ubuntu1.2
Thanks!

[Launchpad Janitor (janitor)]

This bug was fixed in the package evince - 3.30.2-1

---------------
evince (3.30.2-1) unstable; urgency=medium

  [ Jeremy Bicha ]
  * New upstream release

  [ Jamie Strandboge ]
  * debian/apparmor-profile: Update thumbnailer policy
    for temporary file path with and without bubblewrap (LP: #1798091)
    (Closes: #911161)

 -- Jeremy Bicha <email address hidden> Sat, 03 Nov 2018 17:30:50 -0400

[Launchpad Janitor (janitor)]

This bug was fixed in the package evince - 3.30.1-1ubuntu1.2

---------------
evince (3.30.1-1ubuntu1.2) cosmic; urgency=medium

  * debian/apparmor-profile:
    - fine-tune the apparmor profile to allow the previous access in addition
      to the new accesses to fix LP: #1798091

evince (3.30.1-1ubuntu1.1) cosmic; urgency=medium

  * debian/apparmor-profile:
    - use the correct thumbnailer temp filename, fixes nautilus failing
      to generate pdf previews (lp: #1798091)

 -- Jamie Strandboge <email address hidden> Wed, 31 Oct 2018 19:26:39 +0000

[Brian Murray (brian-murray)]

The verification of the Stable Release Update for evince has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

[Cristina Franzolini (forkirara)]

I have evince (3.30.1-1ubuntu1.2) cosmic but bug is not fixed for me

[Jamie Strandboge (jdstrand)]

@Christina - I suggest filing a new bug with more specifics. That said, I suspect you have a .dpkg-dist file in /etc/apparmor.d or /etc/apparmor.d/abstractions that has changes that need to be merged into your evince profile.

[roussel geoffrey (roussel-geoffrey)]

I also have an issue with the thumbnailer but it only occurs using Nemo file browser and only when browsing SMB share folder:

https://bugs.launchpad.net/ubuntu/+source/evince/+bug/1834386

[Christophe Boschmans (christophe-boschmans)]

not fixed with ubuntu 19.04 pop os evince 3.32.0-1ubuntu0.1

[mike-g2 (mikeg-utk)]

I'm running MATE 18.04.4 and have this problem.
The fix above needs to be tweaked slightly for my system and I just wanted to note how. Basically, the tmp file names can vary between Ubuntu flavors and to get the right one you need to consult your /var/log/syslog file. Here's a snippet from mine.

-------
Mar 24 12:55:01 HOST kernel: [168408.433315] audit: type=1400 audit(1585068901.826:56): apparmor="DENIED" operation="open" profile="/usr/bin/evince-thumbnailer" name="/tmp/.mate_desktop_thumbnail.8S5NH0" pid=18303 comm="evince-thumbnai" requested_mask="wc" denied_mask="wc" fsuid=1000 ouid=1000
------

The 'name=' entry tells me I need to add the following line to my
    /etc/apparmor.d/local/usr.bin.evince
file
owner /tmp/{,.}mate_desktop_thumbnail.* w,