Evince Document Viewer(42.0) does not remember last page in 22.04 and opens in a tiny window when launched

[ManOnTheMoon]

[Impact]

 * Evince does not behave as expected and launches with a very small window resulting in a poor user experience

 * Fixing this requires only a minor change to the exo-open abstraction and results in correctly functioning evince

 * By removing the dbus deny rule in the exo-open abstraction, evince is able to correctly communicate with gvfs and start up as normal

[Test Plan]

 * Start dbus-monitor to watch for AppArmor denials

 $ dbus-monitor --session | grep AppArmor

 * Launch evince and there should be no AppArmor message shown above from dbus-monitor

[Where problems could occur]

 * By removing this deny rule from the exo-open abstraction, AppArmor will be more permissive for anything which uses the exo-open abstraction and potentially allow it access to gvfs where it did not before.

 * This should not result in any regressions as we are granting extra functionality which wasn't allowed before, however perhaps in the case of an application which expects *not* to be able to use gvfs as this was previously explicitly denied, it may now be able to (if it has a less specific allow rule) and hence it may function differently than before.

[Other Info]

 * Whilst on the surface by removing this deny rule it may appear that this grants additional permissions to anything which uses the exo-open abstraction, this is not necessarily true as AppArmor denies all accesses by default unless explicitly allowed by a profile. And so in general this will not grant permission to use a DBus interface that an application did not have before. However, due to the way that deny rules take precedence over allow rules in AppArmor, if an application had been allowed generic dbus access to the user's session bus, the previous deny rule in the exo-open abstraction would then have denied them access to just gvfs via dbus. With this new proposed change, this is not explicitly denied and so is now allowed as expected. But for applcations which may have used the exo-open abstraction and which did *not* have DBus access before, this change will not result in them obtaining DBus access either.

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[ManOnTheMoon (manonthemoon)]

when entered evince in the terminal this error message appears:

(evince:4680): dbind-WARNING **: 16:52:55.494: Couldn't connect to accessibility bus: Failed to connect to socket /run/user/1000/at-spi/bus_1: Permission denied

Also tried:

sudo chown username:username ~/.local/share/gvfs-metadata/home
sudo chmod 600 ~/.local/share/gvfs-metadata/home

which did not resolve the problem.

The bookmark option does not work either

[Jurgen Schellaert (jurgen-schellaert-j)]

I am seeing the same issues.

They seem to be caused by apparmor as they do not occur when I disable the evince profile (sudo apparmor_parser -R /etc/apparmor.d/usr.bin.evince).

[ManOnTheMoon (manonthemoon)]

tested and it seems indeed that apparmor is related to the issues. Both bookmarking and returning to last view page is working when disable.

[tumelo (tumelondaba)]

you can disable the AppArmor profile of evince permanently using the following commands:

sudo ln -s /etc/apparmor.d/usr.bin.evince /etc/apparmor.d/disable/
sudo /etc/init.d/apparmor restart

[vasilis34 (vmanolop)]

I have the same problem on a new 22.04 installation. Both last viewed page and creating/deleting bookmarks are not working. I tried the workaround of disabling apparmor ( both ways posted here ) but looks like it doesn't solve the problem.

[ManOnTheMoon (manonthemoon)]

@vasilis34 (vmanolop) are you using the apt or the snap version?

[Eugene (sakralbar)]

In my case Evince also does not remember the window size. Documents are opened in a small window each time.

[Paul (ep42)]

I confirm that bug as well. Happened since I upgraded to Ubuntu 22.04 and also the workaround with "apparmour" does not work. Even when I stop the apparmor service and then start evince in a terminal, I get these messages ...

#1 directly after start of evince:
(evince:23863): dbind-WARNING **: 15:21:04.749: Couldn't connect to accessibility bus: Failed to connect to socket /run/user/1000/at-spi/bus_0: Keine Berechtigung

#2 when trying to save current settings as default:
(evince:23863): GLib-GObject-WARNING **: 15:21:16.449: invalid cast from 'GtkFileChooserNative' to 'GtkWidget'

[sol2070 (sol2070)]

This is happening to me too, since I upgraded from 21.04 to 22.04. One simple workaround is to install the Evince flatpak. Works as expected.

[Jurgen Schellaert (jurgen-schellaert-j)]

But the flatpak version typically fails to generate thumbnails.

[sol2070 (sol2070)]

"But the flatpak version typically fails to generate thumbnails."

I noticed that this happens when the .deb version and its dependencies are removed, but if you keep both flatpak and the .deb installed, thumbnails appear as usual.

[Sebastien Bacher (seb128)]

could someone having the issue trigger the bug then do

$ journalctl -b 0 > journal

and add the journal file to the report?

(or do 'journalctl -f', trigger the bug and see if anything is printed in the log)

[Christian Sarrasin (sxc731)]

Running APT evince 42.1-3 on stock Ubuntu 22.04/GNOME 42.0/Wayland.

My issue is Evince opening in a tiny window every time it's fired off; this deployment was upgraded from 21.10, which didn't suffer from such issue.

I attach below the output from `journalctl -f` while starting up Evince, which clearly shows AppArmor violations.

I thus attempted the approach from https://askubuntu.com/a/886011/145568 . When running with `aa-complain evince`, Evince behaves properly; I accepted `aa-logprof`'s suggestion to grant /usr/bin/evince [owner /run/user/1000/at-spi/bus rw,]. Unfortunately as soon as I reinstate `aa-enforce evince`, the tiny window issue re-appears.

(Note: at first I Ignored /usr/sbin/cups-browsed [capability sys_nice,] because I thought it was unrelated; I tried to grant it but this still doesn't solve the issue).

[vasilis34 (vmanolop)]

@ManOnTheMoon (manonthemoon): I have tested both, both have the same problems.

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Etienne URBAH (eurbah)]

I fully confirm that this Evince issue is linked to Apparmor :
$ aa-exec -p unconfined evince example.pdf
systematically opens the PDF file in the same large windows and with the same side pane as the last time.

I have added following line at the end of /etc/apparmor.d/local/usr.bin.evince :
  owner /{,var/}run/user/*/at-spi/bus_* rw,

Then apparmor does not complain about at-spi/bus anymore.

But Evince still systematically opens all PDF files (already opened in the past or not) in a window :
- so small that the document is NOT readable,
- without side pane.

[Sebastien Bacher (seb128)]

Could those having the issue give some details on your configuration, do you use an xorg or wayland session? is your userdir a normal local one or a nfs mount or similar? anything special worth mentioning about your configuration?

[Florian Beier (flobeier)]

I upgraded from 21.10 to 22.04. The issue happens when using a Wayland session or an Xorg session. My userdir is a local one. There is nothing special about my configuration. One thing that might be noteworthy is that before upgrading I was using the night mode of Evince and now it is stuck in night mode. I can disable night mode but this is not saved, meaning that when I close Evince and open it again it is back to night mode.

[Florian Beier (flobeier)]

I just opened Evince from the command line ('evince' -> Enter) and am seeing this error:

Entity: line 41: parser error : Extra content at the end of the document
<?xpacket end="w"?>endstream

It could be totally unrelated to this bug though.

[sol2070 (sol2070)]

I upgraded from 21.10 to 22.04.
This bug happens to me both in Wayland and Xorg (in Wayland this was fixed installing the Evince flatpak alongside the .deb. In Xorg, this doesn't work).
I don't use any special directory.

[renbag (renbag)]

If someone does not want to disable apparmor for evince, then he can install the package "devilspie2" and use a lua configuration file to set the window size (see the manual of the program):

if (get_window_class()=="Evince") then
  set_window_size(800,600)
end

But this is not optimal and not suitable for everyone.

As a user that opens very frequently pdf files this bug is highly irritating and makes the ubuntu desktop experience very poor.
Can someone raise the importance of this bug?

[Sebastien Bacher (seb128)]

I'm still not able to trigger that issue :/

[Robert Piosik (robertpiosik)]

It is really cumbersome to work with Ubuntu now :( Please raise the importance.

[Sebastien Bacher (seb128)]

Changed to high, it's not going to automatically resolve the issue though, that needs debugging from someone who is getting the problem

[Roi C. (magnum777)]

Has anybody checked if this happens only when upgrading from 21.10 to 22.04?

[Robert Piosik (robertpiosik)]

If the problem doesn't occur on 22.04 fresh install, I can confirm it happens during upgrade from 21.10. Thanks for raising and responsiveness.

[sol2070 (sol2070)]

For me too: upgraded from 21.10 to 22.04.

[renbag (renbag)]

I found that this bug is also present when you use a different desktop environment (I'm using cinnamon).

Step to reproduce:

 - run a 22.04 CD image of a different ubuntu flavour in a virtual machine (I tried xubuntu and kubuntu)
 - install evince
 - run evince from a terminal: (evince:5081): dbind-WARNING **: 05:32:50.298: Couldn't connect to accessibility bus: Failed to connect to socket /run/user/999/at-spi/bus_0: Permission denied
 - after disabling apparmor for evice all is OK

[Tushar (rafattushar)]

This problem occurs on my fresh Ubuntu 22.04 install.

[Austin Adams (ausbin)]

To summarize for other people with the problem: `sudo aa-complain /usr/bin/evince` fixes this for me. (I had to install the apparmor-utils package to run that)

[sol2070 (sol2070)]

Works for me, thanks!

[Tushar (rafattushar)]

This may be an Ubuntu kernel problem. I have upgraded my kernel from 5.15.0.37.39 to 5.15.1-051501.202111061036 without changing anything else, and the mentioned problem with Evince has gone away.

But this problem resurfaces after changing back to the previous kernel 5.15.0.37.39 from grub during boot. So, some changes from kernel 5.15.0.37.39 to 5.15.1-051501.202111061036 solve this problem.

Can anybody confirm this?

[Sebastien Bacher (seb128)]

The kernel you are trying might have a different configuration leading to have apparmor not enforced the same way perhaps?

[Christian Sarrasin (sxc731)]

@ausbin: `aa-complain` is hardly a "fix": it bypasses AppArmor, which is not optimal, knowing how PDF documents are often used as a malware vector. Admittedly, malware is less likely to be targeted at Linux desktops but still...

[Sebastien Bacher (seb128)]

Ok, after more investigating I could reproduce the issue and narrow down the problem, for some reason it isn't doing it on my upgraded system but it is a problem a fresh xubuntu install in a VM and seems to be due to the fix for bug #1891338

Editing /etc/apparmor.d/usr.bin.evince to delete L72
' #include <abstractions/exo-open>'
and then doing
$ sudo aa-enforce evince

seems to make it work again

or a more selective version
- edit /etc/apparmor.d/abstractions/exo-open
- delete the section

  deny dbus send
    bus=session
    path=/org/gtk/vfs/mounttracker,

- $ sudo apparmor_parser -r /etc/apparmor.d/abstractions/exo-open
- $ sudo aa-enforce evince

Alex, from the apparmor changelog adding the exo profile you worked on it, any idea about the issue?

Using
$ dbus-monitor --session | grep vfs

shows that evince fails to talk to gvfs with the apparmor profile loaded but it works once in complains mode or with the change suggested before

[renbag (renbag)]

The selective version of the fix works for me, even if I'm not using xubuntu (I use the Cinnamon desktop).
Thanks to Sebastien!

[Sebastien Bacher (seb128)]

THe vfs mounttracker denial seems to discourage evince to use vfs, unsure why that section was added to the exo-open abstraction but I think it would make sense to delete it

[Etienne URBAH (eurbah)]

Thanks to Sebastien Bacher for his selective fix proposal (delete the 'deny dbus send' section in '/etc/apparmor.d/abstractions/exo-open').

$ sudo apparmor_parser -r /etc/apparmor.d/abstractions/exo-open
fails with error message 'AppArmor parser error for /etc/apparmor.d/abstractions/exo-open in profile /etc/apparmor.d/abstractions/dri-common at line 8: syntax error, unexpected TOK_MODE, expecting TOK_OPEN'

But following command succeeds :
$ sudo systemctl restart apparmor

Then evince remembers last page, window size and side pane.

[Alex Murray (alexmurray)]

FYI I have sent a MR to the upstream AppArmor project to remove this dbus deny rule from the exo-open abstraction: https://gitlab.com/apparmor/apparmor/-/merge_requests/884

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Merca (marexposed)]

I have this issue also.
Previously 18.04 no problems with evince.
I installed a fresh root leaving my separate home untouched (in a different device).
Now 22.04 (fresh install deleting previous root, home untouched), have this problem.

[Launchpad Janitor (janitor)]

This bug was fixed in the package apparmor - 3.0.4-2ubuntu3

---------------
apparmor (3.0.4-2ubuntu3) kinetic; urgency=medium

  * Add upstream commit to remove dbus deny rule from exo-open abstraction
    to fix evince startup
    (LP: #1969896)
    - d/p/u/abstraction-exo-open-Remove-dbus-deny-rule.patch

 -- Alex Murray <email address hidden> Fri, 17 Jun 2022 20:34:25 +0930

[Chris Halse Rogers (raof)]

Hello ManOnTheMoon, or anyone else affected,

Accepted apparmor into jammy-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/apparmor/3.0.4-2ubuntu2.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-jammy to verification-done-jammy. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-jammy. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[ManOnTheMoon (manonthemoon)]

Hi Chris Halse Rogers(raof), kindly confirm the package is:

apparmor/jammy-proposed 3.0.4-2ubuntu2.1 amd64 [upgradable from: 3.0.4-2ubuntu2]

In addition, two evince packages(listed below) popped up in the list of jammy-proposed packages. Are they related or should i disregard them and install solely the apparmor/jammy-proposed package for testing.

evince-common/jammy-proposed,jammy-proposed 42.3-0ubuntu1 all [upgradable from: 42.1-3]
evince/jammy-proposed 42.3-0ubuntu1 amd64 [upgradable from: 42.1-3]

[Sebastien Bacher (seb128)]

> In addition, two evince packages(listed below) popped up in the list of jammy-proposed packages. Are they related or should i disregard them and install solely the apparmor/jammy-proposed package for testing.

Just install the apparmor one, the evince update is a new version but not related to this fix.

[ManOnTheMoon (manonthemoon)]

@Sebastien Bacher(seb128), downloaded and tested.

NVIDIA with X11
Evince 42.0(deb)
Ubuntu 22.04 LTS
Gnome Version 42.2

Bookmark: Working
Thumbnails: Working
Annotations: Working
Remember Window Size: Working
Save Current Setting as Default: Dark(Regular) Mode not applied to some PDF when set as default(tested about 10 PDF)

when entered 'evince' in the terminal this warning appears:

(evince:11320): dbind-WARNING **: 17:59:55.889: Couldn't connect to accessibility bus: Failed to connect to socket /run/user/1000/at-spi/bus_1: Permission denied

when attempting to open a file from evince, the following warnings appear:

(evince:11320): GVFS-WARNING **: 18:00:27.813: The peer-to-peer connection failed: Error while getting peer-to-peer dbus connection: Could not connect: Permission denied. Falling back to the session bus. Your application is probably missing --filesystem=xdg-run/gvfsd privileges.

(evince:11320): GVFS-WARNING **: 18:00:27.815: The peer-to-peer connection failed: Error while getting peer-to-peer dbus connection: Could not connect: Permission denied. Falling back to the session bus. Your application is probably missing --filesystem=xdg-run/gvfsd privileges.

(evince:11320): GLib-GObject-WARNING **: 18:00:27.856: invalid cast from 'GtkFileChooserNative' to 'GtkWidget'

(evince:11320): GVFS-WARNING **: 18:00:27.929: The peer-to-peer connection failed: Could not connect: Permission denied. Falling back to the session bus. Your application is probably missing --filesystem=xdg-run/gvfsd privileges.

(evince:11320): GVFS-WARNING **: 18:00:27.935: The peer-to-peer connection failed: Error while getting peer-to-peer dbus connection: Could not connect: Permission denied. Falling back to the session bus. Your application is probably missing --filesystem=xdg-run/gvfsd privileges.

(evince:11320): GVFS-WARNING **: 18:00:27.936: The peer-to-peer connection failed: Error while getting peer-to-peer dbus connection: Could not connect: Permission denied. Falling back to the session bus. Your application is probably missing --filesystem=xdg-run/gvfsd privileges.

(evince:11320): GVFS-WARNING **: 18:00:27.938: The peer-to-peer connection failed: Error while getting peer-to-peer dbus connection: Could not connect: Permission denied. Falling back to the session bus. Your application is probably missing --filesystem=xdg-run/gvfsd privileges.

(evince:11320): GVFS-WARNING **: 18:00:28.043: The peer-to-peer connection failed: Could not connect: Permission denied. Falling back to the session bus. Your application is probably missing --filesystem=xdg-run/gvfsd privileges.

Kindly take note that even with the error messages, evince is still able to open, open target PDF and perform the tasks listed above.

[Etienne URBAH (eurbah)]

In order that evince does not trigger the "dbind-WARNING : Couldn't connect to accessibility bus" error message anymore, following workaround works for me :

Add following line at the end of /etc/apparmor.d/local/usr.bin.evince :
  owner /{,var/}run/user/*/at-spi/bus* rw,

Does this workaround also suppress the "GVFS-WARNING : The peer-to-peer connection failed" error message ?

If yes, this issue could perhaps be fixed by adding the above mentioned line directly inside /etc/apparmor.d/usr.bin.evince

[Ubuntu SRU Bot (ubuntu-sru-bot)]

All autopkgtests for the newly accepted apparmor (3.0.4-2ubuntu2.1) for jammy have finished running.
The following regressions have been reported in tests triggered by the package:

libreoffice/1:7.3.3-0ubuntu0.22.04.1 (amd64, armhf)
systemd/249.11-0ubuntu3.1 (amd64, armhf)

Please visit the excuses page listed below and investigate the failures, proceeding afterwards as per the StableReleaseUpdates policy regarding autopkgtest regressions [1].

https://people.canonical.com/~ubuntu-archive/proposed-migration/jammy/update_excuses.html#apparmor

[1] https://wiki.ubuntu.com/StableReleaseUpdates#Autopkgtest_Regressions

Thank you!

[Alex Murray (alexmurray)]

I have verified this as follows:

# enable proposed so we can install apparmor from there
# https://wiki.ubuntu.com/Testing/EnableProposed
cat <<EOF | sudo tee /etc/apt/sources.list.d/ubuntu-$(lsb_release -cs)-proposed.list
# Enable Ubuntu proposed archive
deb http://archive.ubuntu.com/ubuntu/ $(lsb_release -cs)-proposed restricted main multiverse universe
EOF
cat <<EOF | sudo tee /etc/apt/preferences.d/proposed-updates
# Configure apt to allow selective installs of packages from proposed
Package: *
Pin: release a=$(lsb_release -cs)-proposed
Pin-Priority: 400
EOF
sudo apt update
sudo apt install apparmor/jammy-proposed libapparmor1/jammy-proposed

# run test case from bug description
dbus-monitor --session | grep AppArmor

# then from a graphical session launch evince and check there is no AppArmor denial showed in the dbus-monitor output above

[ManOnTheMoon (manonthemoon)]

after testing the proposed packages "apparmor/jammy-proposed libapparmor1/jammy-proposed" is it necessary to remove them, if so, do i just do sudo apt remove apparmor/jammy-proposed ? And do i have to change:

'problem_types': ['Bug', 'Package', 'Crash']

back to

'problem_types': ['Bug', 'Package'].

Kindly advise

[tea for one (markexhome)]

Following the comments from Alex Murray in #55:-

I enabled the jammy-proposed repository
I updated evince to version 42.3 (I do not know if this was essential or not)
I installed apparmor/jammy-proposed libapparmor1/jammy-proposed
I then shut down the PC and rebooted

After opening evince graphically and selecting a suitable pdf (Full Circle magazine Issue 181), I then saved my current settings as default.

I re-opened evince graphically and the saved settings were used.

Opening evince via the terminal does not produce any error messages and the saved settings were preserved.

A successful fix.

Ubuntu 22.04
Gnome 42.1
Wayland

[vasilis34 (vmanolop)]

I can confirm that the proposed packages work. Thanks for the fix!

[Sebastien Bacher (seb128)]

the autopkgtest regression mentioned were just flaky tests which worked on retry, the update should be ready to be moved to updates

[Launchpad Janitor (janitor)]

This bug was fixed in the package apparmor - 3.0.4-2ubuntu2.1

---------------
apparmor (3.0.4-2ubuntu2.1) jammy; urgency=medium

  * Add upstream commit to remove dbus deny rule from exo-open abstraction
    to fix evince startup (LP: #1969896)
    - d/p/u/abstraction-exo-open-Remove-dbus-deny-rule.patch

 -- Alex Murray <email address hidden> Tue, 21 Jun 2022 14:16:01 +0930

[Chris Halse Rogers (raof)]

The verification of the Stable Release Update for apparmor has completed successfully and the package is now being released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.