Package: libgdk-pixbuf-2.0-0
Version: 2.44.6+dfsg-2
Followup-For: Bug #1130030
X-Debbugs-Cc: [email protected]
========================================================
▗▄▄▄▖ ▗▄▖ ▗▖ ▗▖▗▖ ▗▖▗▄▄▄ ▗▄▖ ▗▄▄▄▖▗▄▄▄▖▗▖ ▗▖
▐▌ ▐▌ ▐▌▐▌ ▐▌▐▛▚▖▐▌▐▌ █ ▐▌ ▐▌ ▐▌ █ ▝▚▞▘
▐▛▀▀▘▐▌ ▐▌▐▌ ▐▌▐▌ ▝▜▌▐▌ █ ▐▛▀▜▌ ▐▛▀▀▘ █ ▐▌
▐▌ ▝▚▄▞▘▝▚▄▞▘▐▌ ▐▌▐▙▄▄▀ ▐▌ ▐▌ ▐▌ ▗▄█▄▖▗▞▘▝▚▖
========================================================
Dear Maintainer,
Root cause: Not gdk-pixbuf/glycin.
The `evince` AppArmor profile (`/etc/apparmor.d/usr.bin.evince`) blocks
executing `bwrap` (used by glycin's sandbox) and denies writing the output
thumbnail file.
Check with:
$ sudo dmesg | grep -i apparmor | grep evince-thumbnailer
Output shows:
apparmor="DENIED" operation="exec" ... name="/usr/bin/bwrap" ...
profile="/usr/bin/evince-thumbnailer"
apparmor="DENIED" operation="mknod" ... profile="/usr/bin/evince-
thumbnailer"
Fix:
$ sudo tee -a /etc/apparmor.d/local/usr.bin.evince <<'EOF'
/usr/bin/bwrap ix,
EOF
$ sudo apparmor_parser -r /etc/apparmor.d/usr.bin.evince
If write still fails, add `owner <path>/** rw,` matching where the output file
lands.
Confirmed working after reboot. `libgdk-pixbuf2.0-bin` had no effect — AppArmor
is the actual blocker.
Live long and prosper!
Daniel Dias.
-- System Information:
Debian Release: forky/sid
APT prefers testing
APT policy: (500, 'testing')
Architecture: amd64 (x86_64)
Foreign Architectures: i386
Kernel: Linux 7.0.13+deb14-amd64 (SMP w/12 CPU threads; PREEMPT)
Kernel taint flags: TAINT_CPU_OUT_OF_SPEC
Locale: LANG=pt_BR.UTF-8, LC_CTYPE=pt_BR.UTF-8 (charmap=UTF-8) (ignored: LC_ALL
set to pt_BR.UTF-8), LANGUAGE=pt_BR:pt:en
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled
Versions of packages libgdk-pixbuf-2.0-0 depends on:
ii glycin-thumbnailers 2.1.5+ds-2
ii libc6 2.42-17
ii libgdk-pixbuf2.0-common 2.44.6+dfsg-2
ii libglib2.0-0t64 2.88.2-1
ii libglycin-2-0 2.1.2+ds-2
ii shared-mime-info 2.4-5+b3
libgdk-pixbuf-2.0-0 recommends no packages.
libgdk-pixbuf-2.0-0 suggests no packages.
-- no debconf information
