Control: reopen 1127935
On Thu, 19 Feb 2026 at 19:31:18 +0200, Faidon Liambotis wrote:
retitle 1127935 evince: AppArmor profile doesn't allow running bwrap
...
When opening evince, without opening a particular file (just the main
screen) I get 64 of these warnings, one for every recent document:
** (evince:49238): WARNING **: 19:21:12.499: Failed to save thumbnail file file:///...: Could not spawn `"bwrap"
"--unshare-all" ... --seccomp" "89" "/usr/libexec/glycin-loaders/2+/glycin-image-rs" "--dbus-fd"
"87"`: Permission denied (os error 13)
Yes, this is an example of a general problem with AppArmor: it's easy
for an AppArmor profile to be overly sensitive to implementation
details, such as whether gdk-pixbuf loads/saves files directly or in a
sandboxed helper. This is certainly a bug in the profile, whether RC or
not.
If you want to repurpose this bug report to track that, to be useful for
that purpose it will need to be reopened; doing that now.
severity 1127935 serious
I'm not convinced this is a serious Policy violation, but I'll let
someone more involved with evince maintenance make that decision.
smcv
