"Open containing folder" does not work with Nemo (Cinnamon desktop)

[Mikko Rantalainen]

Cinnamon uses "Nemo" /usr/bin/nemo as the file browser and default apparmor config is too strict and prevents "Open Containing Folder" feature from working and instead an error message will appear:

Failed to execute child process "nemo" (Permission denied)"

A simple fix would be to add line

  /usr/bin/nemo Cx -> sanitized_helper, # Cinnamon

below the line

  /usr/bin/thunar Cx -> sanitized_helper, # XFCE

in file /etc/apparmor.d/usr.bin.evince

See also: bug 1022962

ProblemType: Bug
DistroRelease: Ubuntu 16.04
Package: evince-common 3.18.2-1ubuntu4
ProcVersionSignature: Ubuntu 4.4.0-24.43-lowlatency 4.4.10
Uname: Linux 4.4.0-24-lowlatency x86_64
ApportVersion: 2.20.1-0ubuntu2.1
Architecture: amd64
CurrentDesktop: X-Cinnamon
Date: Wed Jul 13 15:27:14 2016
InstallationDate: Installed on 2015-02-23 (506 days ago)
InstallationMedia: Ubuntu 14.04.2 LTS "Trusty Tahr" - Release amd64 (20150218.1)
PackageArchitecture: all
SourcePackage: evince
UpgradeStatus: Upgraded to xenial on 2016-06-10 (33 days ago)
mtime.conffile..etc.apparmor.d.usr.bin.evince: 2016-07-13T15:26:08.817770

[Ubuntu Foundations Team Bug Bot (crichton)]

The attachment "modified.conffile..etc.apparmor.d.usr.bin.evince.txt" seems to be a patch. If it isn't, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are a member of the ~ubuntu-reviewers, unsubscribe the team.

[This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issues please contact him.]

[Sebastien Bacher (seb128)]

Thank you for your bug report. I'm subscribing the security team to get input on that, it seems unpractical to have to maintain a list of possible filemanager in the profile, unsure if there is a better way though...

[Mikko Rantalainen (mira)]

Yeah, I think you should just hardcode xdg-open and then list only that.
Current implementation seems to be execute whatever is in the config and
that cannot be set in apparmor config.

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.