thumbnailer cannot create tempfiles (with apparmor denials)

Bug #1798091 reported by Ralf Hildebrandt
78
This bug affects 19 people
Affects Status Importance Assigned to Milestone
evince (Debian)
Fix Released
Unknown
evince (Ubuntu)
High
Sebastien Bacher
Cosmic
High
Unassigned
Disco
High
Sebastien Bacher

Bug Description

* Impact

Nautilus fails to generate previews for pdf files

* Test case

Download/copy a pdf, open the directory in nautilus, a preview image should be displayed

* Regression potential

Check that there are no other apparmor denials and the thumbnailer works

-------------

While trying to create thumbnails in a directory from within nautilus, I got:

[781429.784125] audit: type=1400 audit(1539694722.247:989): apparmor="DENIED" operation="mknod" profile="/usr/bin/evince-thumbnailer" name="/tmp/gnome-desktop-thumbnailer.png" pid=30937 comm="evince-thumbnai" requested_mask="c" denied_mask="c" fsuid=1000 ouid=1000
[781429.940592] audit: type=1400 audit(1539694722.403:990): apparmor="DENIED" operation="mknod" profile="/usr/bin/evince-thumbnailer" name="/tmp/gnome-desktop-thumbnailer.png" pid=30941 comm="evince-thumbnai" requested_mask="c" denied_mask="c" fsuid=1000 ouid=1000
[781430.314591] audit: type=1400 audit(1539694722.779:991): apparmor="DENIED" operation="mknod" profile="/usr/bin/evince-thumbnailer" name="/tmp/gnome-desktop-thumbnailer.png" pid=30945 comm="evince-thumbnai" requested_mask="c" denied_mask="c" fsuid=1000 ouid=1000
[781431.283522] audit: type=1400 audit(1539694723.747:992): apparmor="DENIED" operation="mknod" profile="/usr/bin/evince-thumbnailer" name="/tmp/gnome-desktop-thumbnailer.png" pid=30949 comm="evince-thumbnai" requested_mask="c" denied_mask="c" fsuid=1000 ouid=1000
[781431.518566] audit: type=1400 audit(1539694723.983:993): apparmor="DENIED" operation="mknod" profile="/usr/bin/evince-thumbnailer" name="/tmp/gnome-desktop-thumbnailer.png" pid=30953 comm="evince-thumbnai" requested_mask="c" denied_mask="c" fsuid=1000 ouid=1000

ProblemType: Bug
DistroRelease: Ubuntu 18.10
Package: evince 3.30.1-1
ProcVersionSignature: Ubuntu 4.18.0-8.9-generic 4.18.7
Uname: Linux 4.18.0-8-generic x86_64
ApportVersion: 2.20.10-0ubuntu13
Architecture: amd64
CurrentDesktop: ubuntu:GNOME
Date: Tue Oct 16 14:59:00 2018
InstallationDate: Installed on 2014-06-19 (1580 days ago)
InstallationMedia: Ubuntu 14.04 LTS "Trusty Tahr" - Release amd64 (20140417)
ProcEnviron:
 TERM=xterm-256color
 PATH=(custom, no user)
 XDG_RUNTIME_DIR=<set>
 LANG=de_DE.UTF-8
 SHELL=/bin/bash
SourcePackage: evince
UpgradeStatus: Upgraded to cosmic on 2018-10-07 (9 days ago)

Revision history for this message
Ralf Hildebrandt (ralf-hildebrandt) wrote :
summary: - thumbnailer cannot create tempfiles
+ thumbnailer cannot create tempfiles (with apparmor denials)
Revision history for this message
Jamie Strandboge (jdstrand) wrote :

It looks like the path changed. We have a rule for this already:

owner /tmp/.gnome_desktop_thumbnail.* w,

I'll adjust.

Changed in evince (Ubuntu):
assignee: nobody → Jamie Strandboge (jdstrand)
status: New → In Progress
Revision history for this message
Jamie Strandboge (jdstrand) wrote :

Ralf, you can workaround this by adjust /etc/apparmor.d/local/usr.bin.evince to have this at the end of the evince-thumbnailer profile:

owner /tmp/{,.}gnome_desktop_thumbnail.* w,

then running: sudo apparmor_parser -r /etc/apparmor.d/usr.bin.evince

Revision history for this message
Jamie Strandboge (jdstrand) wrote :

Sorry, I said "at the end of the thumbnailer profile". I mean to say:

Ralf, you can workaround this by adjusting /etc/apparmor.d/local/usr.bin.evince to have this:

owner /tmp/{,.}gnome_desktop_thumbnail.* w,

then running: sudo apparmor_parser -r /etc/apparmor.d/usr.bin.evince

Changed in evince (Ubuntu):
status: In Progress → Fix Committed
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package evince - 3.30.1-1ubuntu1

---------------
evince (3.30.1-1ubuntu1) cosmic; urgency=medium

  * debian/apparmor-profile: adjust thumbnailer policy for updated temporary
    file path during nautilus thumbnail generation (LP: #1798091)

 -- Jamie Strandboge <email address hidden> Tue, 16 Oct 2018 14:28:09 +0000

Changed in evince (Ubuntu):
status: Fix Committed → Fix Released
Revision history for this message
Sebastien Bacher (seb128) wrote :

Hey Jamie, sorry but it seems that issue didn't get fixed, see bug #1799688

The denied error states
name="/tmp/gnome-desktop-thumbnailer.png"

or your rule is
"owner /tmp/{,.}gnome_desktop_thumbnail.* w,"

there is at least a mismatch _ vs - in the filename

but also "thumnail.*" seems to not work, if I replace ".*" by "er.png" (e.g the exact filename) then nautilus starts showing the pdf previews (I tested by copying a pdf as a new bug.pdf name)

Changed in evince (Ubuntu):
status: Fix Released → Confirmed
Revision history for this message
Sebastien Bacher (seb128) wrote :

using "owner /tmp/{,.}gnome-desktop-thumbnailer.* w," and reloading the profile works

Revision history for this message
Benoit Tainturier (b-tainturier) wrote :

Using "owner /tmp/{,.}gnome_desktop_thumbnail.* w," and reloading the profile doesn't work.
Using "owner /tmp/{,.}gnome-desktop-thumbnailer.* w," and reloading the profile works.

Changed in evince (Ubuntu):
importance: Undecided → High
status: Confirmed → In Progress
assignee: Jamie Strandboge (jdstrand) → Sebastien Bacher (seb128)
description: updated
Revision history for this message
Sebastien Bacher (seb128) wrote :

The filename changed when starting to use bubblewrap, the gnome-desktop corresponding code is
https://gitlab.gnome.org/GNOME/gnome-desktop/blob/master/libgnome-desktop/gnome-desktop-thumbnail-script.c#L730

Changed in evince (Ubuntu):
status: In Progress → Fix Committed
Revision history for this message
Jamie Strandboge (jdstrand) wrote :

I'll be updating a new version on top of Seb's changes. Marking back to In Progress for now.

Changed in evince (Ubuntu):
status: Fix Committed → In Progress
Revision history for this message
Jamie Strandboge (jdstrand) wrote :

Uploaded 3.30.1-1ubuntu1.2 to cosmic-proposed.

Changed in evince (Ubuntu):
status: In Progress → Fix Committed
Changed in evince (Ubuntu):
status: Fix Committed → Fix Released
Revision history for this message
Steve Langasek (vorlon) wrote : Please test proposed package

Hello Ralf, or anyone else affected,

Accepted evince into cosmic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/evince/3.30.1-1ubuntu1.2 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-cosmic to verification-done-cosmic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-cosmic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

Changed in evince (Ubuntu Cosmic):
status: New → Fix Committed
tags: added: verification-needed verification-needed-cosmic
Revision history for this message
Hugo Otto (hugootto) wrote :

Bug fixed for me. evince 3.30.1-1ubuntu1.2
Thanks!

tags: added: verification-done-cosmic
removed: verification-needed-cosmic
Changed in evince (Ubuntu Disco):
status: Fix Released → Triaged
Changed in evince (Debian):
status: Unknown → Fix Released
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package evince - 3.30.2-1

---------------
evince (3.30.2-1) unstable; urgency=medium

  [ Jeremy Bicha ]
  * New upstream release

  [ Jamie Strandboge ]
  * debian/apparmor-profile: Update thumbnailer policy
    for temporary file path with and without bubblewrap (LP: #1798091)
    (Closes: #911161)

 -- Jeremy Bicha <email address hidden> Sat, 03 Nov 2018 17:30:50 -0400

Changed in evince (Ubuntu Disco):
status: Triaged → Fix Released
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package evince - 3.30.1-1ubuntu1.2

---------------
evince (3.30.1-1ubuntu1.2) cosmic; urgency=medium

  * debian/apparmor-profile:
    - fine-tune the apparmor profile to allow the previous access in addition
      to the new accesses to fix LP: #1798091

evince (3.30.1-1ubuntu1.1) cosmic; urgency=medium

  * debian/apparmor-profile:
    - use the correct thumbnailer temp filename, fixes nautilus failing
      to generate pdf previews (lp: #1798091)

 -- Jamie Strandboge <email address hidden> Wed, 31 Oct 2018 19:26:39 +0000

Changed in evince (Ubuntu Cosmic):
status: Fix Committed → Fix Released
Revision history for this message
Brian Murray (brian-murray) wrote : Update Released

The verification of the Stable Release Update for evince has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

Mathew Hodson (mhodson)
Changed in evince (Ubuntu Cosmic):
importance: Undecided → High
Revision history for this message
Cristina Franzolini (forkirara) wrote :

I have evince (3.30.1-1ubuntu1.2) cosmic but bug is not fixed for me

Revision history for this message
Jamie Strandboge (jdstrand) wrote :

@Christina - I suggest filing a new bug with more specifics. That said, I suspect you have a .dpkg-dist file in /etc/apparmor.d or /etc/apparmor.d/abstractions that has changes that need to be merged into your evince profile.

Revision history for this message
roussel geoffrey (roussel-geoffrey) wrote :

I also have an issue with the thumbnailer but it only occurs using Nemo file browser and only when browsing SMB share folder:

https://bugs.launchpad.net/ubuntu/+source/evince/+bug/1834386

Revision history for this message
Christophe Boschmans (christophe-boschmans) wrote :

not fixed with ubuntu 19.04 pop os evince 3.32.0-1ubuntu0.1

tags: added: verification-failed-dingo
removed: cosmic
tags: added: verification-failed-disco
removed: verification-failed-dingo
Revision history for this message
mike-g2 (mikeg-utk) wrote :

I'm running MATE 18.04.4 and have this problem.
The fix above needs to be tweaked slightly for my system and I just wanted to note how. Basically, the tmp file names can vary between Ubuntu flavors and to get the right one you need to consult your /var/log/syslog file. Here's a snippet from mine.

-------
Mar 24 12:55:01 HOST kernel: [168408.433315] audit: type=1400 audit(1585068901.826:56): apparmor="DENIED" operation="open" profile="/usr/bin/evince-thumbnailer" name="/tmp/.mate_desktop_thumbnail.8S5NH0" pid=18303 comm="evince-thumbnai" requested_mask="wc" denied_mask="wc" fsuid=1000 ouid=1000
------

The 'name=' entry tells me I need to add the following line to my
    /etc/apparmor.d/local/usr.bin.evince
file
owner /tmp/{,.}mate_desktop_thumbnail.* w,

To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Duplicates of this bug

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.