evince does not print (apparmor, pxgsettings)

[Togo28]

* Impact

Evince hangs when opening the printing dialog for some users with a remote printer configured and connected

* Test case

- configure a remote printer and turn it on
- open a pdf
- try to print the document

the print dialog shouldn't freeze the viewer

* What could go wrong

The change is only allowing access to one extra system binary from the apparmor profile so shouldn't really have an impact on the software behaviour. If the syntax or content of the change was incorrect it could make the apparmor profile not been loaded anymore or block access to thing that should be allowed, so ensure that opening documents, printing and thumbnailing are still working

----------------------------------------------------------------------

audit: type=1400 audit(1613557537.646:81): apparmor="DENIED" operation="exec" profile="/usr/bin/evince" name="/usr/lib/x86_64-linux-gnu/libproxy/0.4.17/pxgsettings" pid=3500 comm="sh" requested_mask="x" denied_mask="x" fsuid=1000 ouid=0

It seems that evince has no rights to print if I understand this correctly

Printing the same pdf-file from the same origin/folder works with OCULAR

The error is reproduceable

[Togo28 (togo28)]

Ubuntu = Ubuntu 21.04 hirsute (x86-64)
Cinnamon = 4.8.6
Kernel = 5.8.0-36-generic
Prozessor = Intel© Core™ i7-9700 CPU @ 3.00GHz × 8
Ram = 31.2 GiB
Graphics = Intel Corporation CoffeeLake-S GT2 [UHD Graphics 630]

[Togo28 (togo28)]

With the yesterday installed new kernel, the problem has gone here. Can somebody confirm that?

[Togo28 (togo28)]

PS: I made a complete new install - maybe the had also some influence

[Togo28 (togo28)]

AVC apparmor="DENIED" operation="exec" profile="/usr/bin/evince" name="/usr/lib/x86_64-linux-gnu/libproxy/0.4.17/pxgsettings" pid=16617 comm="sh" requested_mask="x" denied_mask="x" fsuid=1000 ouid=0

[Togo28 (togo28)]

The bug appeared again! The posting before shows the apparmor log file entry

[Bernard Bordja (bbordja-j)]

The printing problem with evince only appears with Cinnamon in my case.
Works perfectly with Enlightment, Gnome, Unity ...

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Karsten (kpbenz)]

I have the same issue on Unity:

$ echo $XDG_CURRENT_DESKTOP
Unity:Unity7:ubuntu

$ lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu 21.04
Release: 21.04
Codename: hirsute

Jul 4 11:02:35 jupiter org.gnome.Nautilus[7271]: sh: 1: /usr/lib/x86_64-linux-gnu/libproxy/0.4.17/pxgsettings: Permission denied
Jul 4 11:02:35 jupiter kernel: [ 2602.257706] audit: type=1400 audit(1625353355.770:76): apparmor="DENIED" operation="exec" profile="/usr/bin/evince" name="/usr/lib/x86_64-linux-gnu/libproxy/0.4.17/pxgsettings" pid=7271 comm="sh" requested_mask="x" denied_mask="x" fsuid=1000 ouid=0

[Rolf Leggewie (r0lf)]

$ evince ~/Documents/fullblack.pdf
sh: 1: /usr/lib/x86_64-linux-gnu/libproxy/0.4.15/pxgsettings: Permission denied

Above excerpt from my terminal lends me to believe this is a problem in the libproxy package, after all, with permissions on the /usr/lib/x86_64-linux-gnu/libproxy/0.4.15/pxgsettings file or another file it calls.

[Karsten (kpbenz)]

Workaround that worked for me: add

/usr/lib/x86_64-linux-gnu/libproxy/0.4.17/pxgsettings Cx -> sanitized_helper, # Print Dialog

to

/etc/apparmor.d/usr.bin.evince

*** /tmp/usr.bin.evince 2021-08-24 18:11:43.031953626 +1200
--- usr.bin.evince 2021-08-14 10:15:55.455083638 +1200
***************
*** 67,72 ****
--- 67,73 ----
    /usr/bin/pcmanfm Cx -> sanitized_helper, # LXDE
    /usr/bin/krusader Cx -> sanitized_helper, # KDE
    /usr/bin/thunar Cx -> sanitized_helper, # XFCE
+ /usr/lib/x86_64-linux-gnu/libproxy/0.4.17/pxgsettings Cx -> sanitized_helper, # Print Dialog

    # For Xubuntu to launch the browser
    /usr/bin/exo-open ixr,

[Lacyc3 (lacyc3)]

Thanks Karsten, it works!

[padeler (padeler)]

The apparmor config works. Thanks Karsten.

[jbfoley (jbfoley1)]

Same issue, 21,10 using Unity, and the apparmor workaround fixes it for me as well.

[Etienne URBAH (eurbah)]

Same issue with evince 42.1-3 and apparmor 3.0.4-2ubuntu2 on cinnamon 5.2.7-4 from Ubuntu 22.04 (Jammy Jellyfish)

The apparmor workaround fixes it for me. Thanks Karsten.

[ts (toto-23)]

Same issue here with

$ echo $XDG_CURRENT_DESKTOP
MATE

$ lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu 22.04 LTS
Release: 22.04
Codename: jammy

$ apt-cache policy evince
evince:
  Installed: 42.1-3
  Candidate: 42.1-3
  Version table:
 *** 42.1-3 500
        500 http://de.archive.ubuntu.com/ubuntu jammy/main amd64 Packages
        100 /var/lib/dpkg/status

$ apt-cache policy apparmor
apparmor:
  Installed: 3.0.4-2ubuntu2
  Candidate: 3.0.4-2ubuntu2
  Version table:
 *** 3.0.4-2ubuntu2 500
        500 http://de.archive.ubuntu.com/ubuntu jammy/main amd64 Packages
        100 /var/lib/dpkg/status

$ evince
sh: 1: /usr/lib/x86_64-linux-gnu/libproxy/0.4.17/pxgsettings: Permission denied

The fix in #10 also works here (thanks Karsten)

[peddanet (peddanet)]

This bug affects me as well, I am using Ubuntu 22.04, standard desktop configuration with Gnome3.

$ evince ./reise_scheng_formular.pdf\;jsessionid\=581D11B486915D0476F672CBA29B8143.pdf

(evince:42771): dbind-WARNING **: 11:21:54.609: Couldn't connect to accessibility bus: Failed to connect to socket /run/user/1000/at-spi/bus_1: Permission denied
Gtk-Message: 11:21:54.649: Failed to load module "unity-gtk-module"
Gtk-Message: 11:21:54.650: Failed to load module "unity-gtk-module"

[Etienne URBAH (eurbah)]

With evince 42.3-0ubuntu2 and apparmor 3.0.4-2ubuntu2.1 on cinnamon 5.2.7-4 from Ubuntu 22.04 (Jammy Jellyfish) :

- The 'at-spi/bus' issue is fixed.

- The print issue is NOT fixed yet, but Karsten's workaround inside apparmor still works.

[Etienne URBAH (eurbah)]

Same issue with evince 43.0-1 and apparmor 3.0.7-1ubuntu2 on cinnamon 5.4.12-1 from Ubuntu 22.10 (Kinetic Kudu)

The apparmor workaround provided by Karsten has to be updated :

Inside '/etc/apparmor.d/usr.bin.evince', add following line after the line containing 'thunar' :

  /usr/lib/x86_64-linux-gnu/libproxy/0.4.18/pxgsettings Cx -> sanitized_helper, # Print Dialog

This updated workaround works for me.

[Jefferson Ascaneo (ascaneo)]

Same issue with evince 42.3-0ubuntu2, apparmor 3.0.4-2ubuntu2.1, cinnamon 5.2.7-4 on Ubuntu 22.04.1 (jammy).

I believe the apparmor workaround below is better, since it works on any version:

Inside '/etc/apparmor.d/usr.bin.evince', add following line after the line containing 'thunar':

  /usr/lib/x86_64-linux-gnu/libproxy/[0-9.]+/pxgsettings Cx -> sanitized_helper, # Print Dialog

Alternatively, run the command below (one line):

$ sudo sed -i 's|.*/usr/bin/thunar Cx -> sanitized_helper,.*|&\n /usr/lib/x86_64-linux-gnu/libproxy/[0-9.]+/pxgsettings Cx -> sanitized_helper, # Print Dialog|' /etc/apparmor.d/usr.bin.evince

The workaround above solves the issue for me.

[Karsten (kpbenz)]

Thanks for the update, Jefferson!

Wasn't sure whether regex woold work here.

[w-sky (w-sky)]

Hello everyone, I applied Jeffersons version of the solution and it seemed to help at first, but then I noticed that Evince still does hang when trying to print when my WiFi printer is online. When it's turned off, I can open the print dialog and print to the printer spooler or print as PDF, but not when it is turned on.
I have permanently added the extra line in '/etc/apparmor.d/usr.bin.evince' and also rebooted.

[w-sky (w-sky)]

Hello everyone subscribed to this topic, I totally edited my previous comment because it was a misconception. Now I noticed, the problem depends on whether the printer is connected.

[Sebastien Bacher (seb128)]

Ok, fix uploaded to Lunar and 22.04 now

[Andreas Hasenack (ahasenack)]

Hi all,

I'm reviewing this SRU, and was trying to reproduce the issue following the given test case, but no matter what I try, it just works.

I installed cinnamon 22.10 from the ISO image into a VM, and added a remote network printer (not wifi, though: wired ethernet). I monitored dmesg, and launched evince from a terminal so I could spot errors there, but it printed to that remote printer just fine, directly to it.

I also tested installing ubuntu jammy 22.04, then the cinnamon desktop, and it also printed find, but there was some problem with the driver and the printed page just said "Unsupported Personality: UNKNOWN".

In any case, it feels like we need to narrow this case down a bit further. I therefore ask all who are affected, what else could it be that is triggering the apparmor error on your end? What would make pxgsettings be called by evince? Something in particular to the PDF file that is being printed? Perhaps an image? Or a font?

[Launchpad Janitor (janitor)]

This bug was fixed in the package evince - 43.1-2

---------------
evince (43.1-2) unstable; urgency=medium

  [ Andrej Shadura ]
  * Print dialog requires access to libproxy’s pxgsettings (Closes: #1002725)
    (LP: #1915910)

 -- Sebastien Bacher <email address hidden> Wed, 07 Dec 2022 11:20:50 +0100

[Brian Murray (brian-murray)]

Hello Togo28, or anyone else affected,

Accepted evince into kinetic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/evince/43.0-1ubuntu1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-kinetic to verification-done-kinetic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-kinetic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Sebastien Bacher (seb128)]

could those having the issue also share output of
$ echo $DESKTOP_SESSION
?

[Brian Murray (brian-murray)]

Hello Togo28, or anyone else affected,

Accepted evince into jammy-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/evince/42.3-0ubuntu3 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-jammy to verification-done-jammy. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-jammy. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[mike-g2 (mikeg-utk)]

The proposed packages evince and evince-common versions 42.3-0ubuntu3 from jammy-proposed fixes the problem for me on MATE 22.04. Much obliged.

[Sebastien Bacher (seb128)]

Setting as verification done since it works correctly here on J/K/L and the previous post also confirms the fix is working for flavors

[Launchpad Janitor (janitor)]

This bug was fixed in the package evince - 43.0-1ubuntu1

---------------
evince (43.0-1ubuntu1) kinetic; urgency=medium

  * debian/apparmor-profile:
    - allow access to the libproxy helper pxgsettings which is needed on
      some configuration to access remote printers (LP: #1915910)

 -- Sebastien Bacher <email address hidden> Thu, 08 Dec 2022 20:37:29 +0100

[Brian Murray (brian-murray)]

The verification of the Stable Release Update for evince has completed successfully and the package is now being released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

[Launchpad Janitor (janitor)]

This bug was fixed in the package evince - 42.3-0ubuntu3

---------------
evince (42.3-0ubuntu3) jammy; urgency=medium

  * debian/apparmor-profile:
    - allow access to the libproxy helper pxgsettings which is needed on
      some configuration to access remote printers (LP: #1915910)

 -- Sebastien Bacher <email address hidden> Wed, 07 Dec 2022 11:35:07 +0100

[w-sky (w-sky)]

And finally this bugfix reached Ubuntu 22.04 LTS today through updates. :) Took a while but it's working great, again. Thanks!