Hi Gerard
Brave does not work currently because we only added support to Chromium,
Firefox and Opera as you can see in the current snap_browsers abstraction [1].
I'm adding Brave support as well [2].
While that change is not applied to the apparmor package, as a workaround, you
could apply the
Hi, I'm on Ubuntu 23.10 using Brave browser SNAP and I still face the
issue (cannot open links in evince -using Brave browser snap).
Here are the versions:
```console
❯ apt list --installed | rg 'evince|apparmor'
apparmor/mantic,now 4.0.0~alpha2-0ubuntu5 amd64 [installed,automatic]
This bug was fixed in the package apparmor - 3.0.4-2ubuntu2.3
---
apparmor (3.0.4-2ubuntu2.3) jammy; urgency=medium
* Add support for applications like evince opening browsers
distributed as snaps (LP: #1794064)
- d/p/u/add-snap-browsers-profile-lp1794064.patch: add
a
This bug was fixed in the package evince - 42.3-0ubuntu3.1
---
evince (42.3-0ubuntu3.1) jammy; urgency=medium
* Allow evince to spawn browsers distributed as snaps (LP: #1794064)
- debian/apparmor-profile: include snap-browsers abstracted profile
and allow transitions to
Ah, jbicha had already retriggered the autopkgtests, and they now pass.
Huzzah!
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to apparmor in Ubuntu.
https://bugs.launchpad.net/bugs/1794064
Title:
Clicking a hyperlink in a
Retriggered the autopkgtest to use the correct apparmor version; let's
see if that fixes things.
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to apparmor in Ubuntu.
https://bugs.launchpad.net/bugs/1794064
Title:
Clicking a
The autopkgtests for apparmor failed for the evince update because the
test requires the apparmor update which is also in proposed
https://launchpad.net/ubuntu/+source/apparmor/3.0.4-2ubuntu2.3 but it is
not a regression.
--
You received this bug notification because you are a member of Ubuntu
I have tested evince 42.3-0ubuntu3.1 and apparmor 3.0.4-2ubuntu2.3 from
jammy-proposed, the bug appears to be fixed - I can now click hyperlinks
from PDFs in Evince and Firefox as a Snap package correctly opens a new
tab
** Tags removed: verification-needed-jammy
** Tags added:
Hello Olivier, or anyone else affected,
Accepted evince into jammy-proposed. The package will build now and be
available at https://launchpad.net/ubuntu/+source/evince/42.3-0ubuntu3.1
in a few hours, and then in the -proposed repository.
Please help us by testing this new package. See
Uploaded as 42.3-0ubuntu3.1, because we can re-use version numbers that
never make it into the archive.
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to apparmor in Ubuntu.
https://bugs.launchpad.net/bugs/1794064
Title:
** Changed in: evince (Ubuntu Jammy)
Assignee: (unassigned) => Graham Inggs (ginggs)
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to apparmor in Ubuntu.
https://bugs.launchpad.net/bugs/1794064
Title:
Clicking a
Reuploading because I had a conflicting version with what was rejected
in -proposed
** Patch added: "evince_42.3-0ubuntu3.2.debdiff"
https://bugs.launchpad.net/ubuntu/+source/evince/+bug/1794064/+attachment/5711859/+files/evince_42.3-0ubuntu3.2.debdiff
--
You received this bug notification
** Patch removed: "evince_42.3-0ubuntu3.1.debdiff"
https://bugs.launchpad.net/ubuntu/+source/evince/+bug/1794064/+attachment/5711419/+files/evince_42.3-0ubuntu3.1.debdiff
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to
Hi! You're right, I forgot to request a sponsorship.
I uploaded the patch for evince/jammy, could you take a look and sponsor
if possible? Thanks
** Patch added: "evince_42.3-0ubuntu3.1.debdiff"
Hi Georgia, is this still pending an evince fix? Your PPA has an updated
evince package, but I don't think it was uploaded to unapproved yet,
without the recommends.
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to apparmor in
** Changed in: apparmor (Debian)
Status: Fix Committed => Fix Released
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to apparmor in Ubuntu.
https://bugs.launchpad.net/bugs/1794064
Title:
Clicking a hyperlink in a PDF
Apparmor in jammy-proposed has the necessary changes, we just need a new
evince upload to jammy without the recommends then.
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to apparmor in Ubuntu.
** Changed in: apparmor (Debian)
Status: New => Fix Committed
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to apparmor in Ubuntu.
https://bugs.launchpad.net/bugs/1794064
Title:
Clicking a hyperlink in a PDF fails to
This bug was fixed in the package evince - 44.1-1ubuntu0.1
---
evince (44.1-1ubuntu0.1) lunar; urgency=medium
* Allow evince to spawn browsers distributed as snaps (LP: #1794064)
- debian/apparmor-profile: include snap-browsers abstracted profile
and allow transitions to
Andreas, Jeremy, you are correct. The worst that could happen is the
same behavior we have currently: when we click a URL the browser does
not open, we get a denied log and evince prints "Permission denied".
My previous statement that profile loading could fail if apparmor did
not find
** Changed in: apparmor (Debian)
Status: Unknown => New
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to apparmor in Ubuntu.
https://bugs.launchpad.net/bugs/1794064
Title:
Clicking a hyperlink in a PDF fails to open
Looks like we get this if evince is update, apparmor is not, and a link
in a pdf is clicked:
Jul 06 18:36:59 j-evince kernel: audit: type=1400
audit(1688668619.304:78): apparmor="DENIED" operation="exec"
info="profile transition not found" error=-13 profile="/usr/bin/evince"
name="/usr/bin/snap"
Andreas, Debian Testing right now has the updated evince but not the
updated apparmor. https://bugs.debian.org/1040481
The consequence is that hyperlinks from Evince don't open if the default
browser is a Snap. That's the same consequence as before the Evince
change.
** Bug watch added: Debian
> Do we need evince to be reuploaded for jammy there since the previous
upload was rejected by Steve?
I'm trying to see what type of error we get if we load a profile with
such a rule and the target profile does not exist:
/{,snap/core/[0-9]*/,snap/snapd/[0-9]*/}usr/bin/snap mrCx ->
This bug was fixed in the package apparmor - 3.0.8-1ubuntu2.1
---
apparmor (3.0.8-1ubuntu2.1) lunar; urgency=medium
* Update abstractions/snap-browsers to include lock permissions
(LP: #1794064)
- d/p/u/update-snap-browsers-permissions-lp1794064.patch
-- Georgia Garcia
Do we need evince to be reuploaded for jammy there since the previous
upload was rejected by Steve?
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to apparmor in Ubuntu.
https://bugs.launchpad.net/bugs/1794064
Title:
The autopkgtest passed for apparmor lunar libreoffice/armhf
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to apparmor in Ubuntu.
https://bugs.launchpad.net/bugs/1794064
Title:
Clicking a hyperlink in a PDF fails to open it
evince and apparmor for lunar should be released together to fix this
bug, but there is still a DEP8 failure that needs clearing under
apparmor: libreoffice/armhf
https://ubuntu-archive-team.ubuntu.com/proposed-
migration/lunar/update_excuses.html#apparmor
It was retried a few times already, but
I have verified on lunar with both apparmor and evince packages updated
from the proposed pocket, it works as expected.
** Tags removed: verification-needed-lunar
** Tags added: verification-done-lunar
--
You received this bug notification because you are a member of Ubuntu
Touch seeded
I have confirmed that the updated evince, without an updated apparmor,
fails in lunar with this error on stderr from evince:
internal error, please report: running "chromium" failed: open
/var/lib/snapd/inhibit/chromium.lock: permission denied
that looks sufficient to me to move forward with
Steve, the snap_browsers abstractions needed an update because the
abstraction had not been updated in an year and the snap browsers now
required read and lock permissions to the file
/var/lib/snapd/inhibit/{browser-name}.lock, but this was also submitted,
approved and merged upstream:
This bug was fixed in the package apparmor - 3.0.8-1ubuntu3
---
apparmor (3.0.8-1ubuntu3) mantic; urgency=medium
* Update abstractions/snap-browsers to include lock permissions
(LP: #1794064)
- d/p/u/update-snap-browsers-permissions-lp1794064.patch
-- Georgia Garcia
The evince upload to jammy still does:
+Recommends: default-dbus-session-bus | dbus-session-bus,
+ apparmor (>= 3.0.4-2ubuntu2.3),
with the explanation that:
+- debian/control.in: recommend apparmor version that includes the
+ snap_browsers abstraction, or else policy loads
I see that there is an apparmor upload for this bug in the lunar queue,
in addition to the evince upload. The apparmor upload adds a line to
abstractions/snap_browsers. This bug report does not explain that the
abstractions/snap_browsers was previously inadequate or that it should
be updated to
This bug was fixed in the package evince - 44.1-1ubuntu1
---
evince (44.1-1ubuntu1) mantic; urgency=medium
* Allow evince to spawn browsers distributed as snaps (LP: #1794064)
- debian/apparmor-profile: include snap-browsers abstracted profile
and allow transitions to
** Changed in: evince (Ubuntu Jammy)
Status: Confirmed => In Progress
** Changed in: apparmor (Ubuntu Jammy)
Status: Confirmed => In Progress
** Changed in: apparmor (Ubuntu)
Status: Confirmed => Fix Committed
** Changed in: apparmor (Ubuntu Lunar)
Status: Confirmed
** Changed in: evince (Ubuntu Lunar)
Status: Confirmed => In Progress
** Changed in: evince (Ubuntu)
Status: Confirmed => Fix Committed
** Changed in: evince (Ubuntu)
Assignee: James Henstridge (jamesh) => (unassigned)
** Changed in: evince (Ubuntu Lunar)
Importance:
** Also affects: evince (Ubuntu Lunar)
Importance: Undecided
Status: New
** Also affects: apparmor (Ubuntu Lunar)
Importance: Undecided
Status: New
** Changed in: evince (Ubuntu Lunar)
Status: New => Confirmed
** Changed in: apparmor (Ubuntu Lunar)
Status: New
** Changed in: evince (Ubuntu)
Status: Incomplete => Confirmed
** Changed in: evince (Ubuntu Jammy)
Status: Incomplete => Confirmed
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to apparmor in Ubuntu.
Hi Steve.
I updated the patches containing the requested changes and uploaded them to
https://launchpad.net/~georgiag/+archive/ubuntu/lp1794064/+packages
Please let me know if you prefer I attached the debdiffs here.
I'm resubscribing ~ubuntu-sponsors. Thanks
** Patch removed:
** Changed in: evince (Debian)
Status: New => Confirmed
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to apparmor in Ubuntu.
https://bugs.launchpad.net/bugs/1794064
Title:
Clicking a hyperlink in a PDF fails to open
Here is one made for the very purpose of (not) being clickable.
** Attachment added: "evince-test.pdf"
https://bugs.launchpad.net/ubuntu/+source/evince/+bug/1794064/+attachment/5677900/+files/evince-test.pdf
--
You received this bug notification because you are a member of Ubuntu
Touch
Georgia, as noted in comment #31, it's better to use '#include if
exists' than to add a versioned dependency on apparmor. Can you update
the patches to do this and verify that it works as expected? Once this
is done please resubscribe ~ubuntu-sponsors and we can get this done.
** Changed in:
Found one locally that doesn't contain any confidential information, so
attaching
** Attachment added: "invoice.pdf"
https://bugs.launchpad.net/ubuntu/+source/evince/+bug/1794064/+attachment/5677898/+files/invoice.pdf
--
You received this bug notification because you are a member of Ubuntu
Can someone provide a reference PDF showing this issue, to use in the
SRU verification? (They are common, but we shouldn't have to hunt for
one for the verification)
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to apparmor
Still here in 22.04 LTS; the workaround I use is the last one suggested
in https://askubuntu.com/a/1428798/16395 (WARNING; that will allow
evince to launch *any* snap in your system. But otherwise, evince is
severely limited...)
--
You received this bug notification because you are a member of
The bug still exist on Kinetic.
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to apparmor in Ubuntu.
https://bugs.launchpad.net/bugs/1794064
Title:
Clicking a hyperlink in a PDF fails to open it if the default browser
is
Is there any update on the issue?
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to apparmor in Ubuntu.
https://bugs.launchpad.net/bugs/1794064
Title:
Clicking a hyperlink in a PDF fails to open it if the default browser
Still broken, 17th September 2022 in Ubuntu 22.04.
Evince prints the following message "env: ‘/snap/bin/firefox’: Permission
denied"
Workaround: https://github.com/popey/unsnap
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed
Status changed to 'Confirmed' because the bug affects multiple users.
** Changed in: evince (Ubuntu Jammy)
Status: New => Confirmed
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to apparmor in Ubuntu.
Status changed to 'Confirmed' because the bug affects multiple users.
** Changed in: apparmor (Ubuntu Jammy)
Status: New => Confirmed
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to apparmor in Ubuntu.
@georgiag we could move the abstraction include to "include if exists"
to take care of the depends. Generally speaking evince shouldn't depend
on apparmor, but of course make use of it if it is available.
--
You received this bug notification because you are a member of Ubuntu
Touch seeded
@Sebastien, yes, I asked people from the security team to sponsor it but
we are still reviewing the snap_browsers abstraction. We are denying
access to /run/user/[0-9]*/gdm/Xauthority in the policy but if that was
the case, then the browser should not have been able to open, but it
does open so we
** Also affects: evince (Ubuntu Jammy)
Importance: Undecided
Status: New
** Also affects: apparmor (Ubuntu Jammy)
Importance: Undecided
Status: New
** Tags removed: rls-jj-incoming
--
You received this bug notification because you are a member of Ubuntu
Touch seeded
@Georgia, thanks for the work! Is anyone from the security team going to
sponsor the apparmor updates for you?
Also in the evince debdiff, you added apparmor to the Build-Depends but
is that needed? If the intend is to ensure a recent enough apparmor is
available on the sytem then the Depends
** Patch added: "apparmor_2.12-4ubuntu5.2.debdiff"
https://bugs.launchpad.net/ubuntu/+source/evince/+bug/1794064/+attachment/5581885/+files/apparmor_2.12-4ubuntu5.2.debdiff
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to
@Sebastien, yes, just did. Thank you!
I also attached the debdiffs for evince and apparmor for bionic, focal, impish
and jammy. They were also uploaded into the Security Proposed PPA:
https://launchpad.net/~ubuntu-security-proposed/+archive/ubuntu/ppa/+packages?field.name_filter=apparmor
** Patch added: "apparmor_2.13.3-7ubuntu5.2.debdiff"
https://bugs.launchpad.net/ubuntu/+source/evince/+bug/1794064/+attachment/5581884/+files/apparmor_2.13.3-7ubuntu5.2.debdiff
** Patch removed: "apparmor_3.0.3-0ubuntu1.1.debdiff"
** Patch added: "apparmor_3.0.3-0ubuntu1.1.debdiff"
https://bugs.launchpad.net/ubuntu/+source/evince/+bug/1794064/+attachment/5581883/+files/apparmor_3.0.3-0ubuntu1.1.debdiff
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed
** Patch added: "apparmor_3.0.3-0ubuntu1.1.debdiff"
https://bugs.launchpad.net/ubuntu/+source/evince/+bug/1794064/+attachment/5581882/+files/apparmor_3.0.3-0ubuntu1.1.debdiff
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed
** Patch added: "evince_3.28.4-0ubuntu1.3.debdiff"
https://bugs.launchpad.net/ubuntu/+source/evince/+bug/1794064/+attachment/5581880/+files/evince_3.28.4-0ubuntu1.3.debdiff
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to
** Patch added: "apparmor_3.0.4-2ubuntu3.debdiff"
https://bugs.launchpad.net/ubuntu/+source/evince/+bug/1794064/+attachment/5581881/+files/apparmor_3.0.4-2ubuntu3.debdiff
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to
** Patch added: "evince_40.4-2ubuntu0.1.debdiff"
https://bugs.launchpad.net/ubuntu/+source/evince/+bug/1794064/+attachment/5581878/+files/evince_40.4-2ubuntu0.1.debdiff
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to
** Patch added: "evince_3.36.10-0ubuntu1.1.debdiff"
https://bugs.launchpad.net/ubuntu/+source/evince/+bug/1794064/+attachment/5581879/+files/evince_3.36.10-0ubuntu1.1.debdiff
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed
** Patch added: "evince_42.1-3ubuntu1.debdiff"
https://bugs.launchpad.net/ubuntu/+source/evince/+bug/1794064/+attachment/5581877/+files/evince_42.1-3ubuntu1.debdiff
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to apparmor
** Description changed:
- This is related to bug #1792648. After fixing that one (see discussion
- at https://salsa.debian.org/gnome-team/evince/merge_requests/1),
- clicking a hyperlink in a PDF opens it correctly if the default browser
- is a well-known application (such as /usr/bin/firefox),
** Changed in: apparmor (Ubuntu)
Assignee: (unassigned) => Georgia Garcia (georgiag)
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to apparmor in Ubuntu.
https://bugs.launchpad.net/bugs/1794064
Title:
Clicking a
@Georgia, great, should we assign the apparmor line of the bug to you?
** Changed in: apparmor (Ubuntu)
Importance: Undecided => High
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to apparmor in Ubuntu.
I'm working on a SRU for apparmor and evince to introduce the snap_browsers
abstraction on apparmor as a workaround for this issue.
It is based on these two merge requests from upstream:
https://gitlab.com/apparmor/apparmor/-/merge_requests/806
it sounds like something that we should fix one way or another at least
for the LTS, maybe in the futur we will have evince as a snap instead
and the situation will be different. Could you suggest a patch for
review with the change you described?
--
You received this bug notification because you
> Is there any option to do this via portals - ie can evince use
> org.freedesktop.portal.OpenURI to open the URI? Would then this
> allow to avoid going via xdg-open?
Evince is using g_app_info_launch_default_for_uri(), which can use the
portal interface:
** Changed in: evince (Ubuntu)
Assignee: Georgia Garcia (georgiag) => James Henstridge (jamesh)
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to apparmor in Ubuntu.
https://bugs.launchpad.net/bugs/1794064
Title:
** Tags added: desktop-lts-wishlist
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to apparmor in Ubuntu.
https://bugs.launchpad.net/bugs/1794064
Title:
Clicking a hyperlink in a PDF fails to open it if the default browser
I'm running Jammy, upgraded from Focal, and this bug bites me:
(evince:56279): dbind-WARNING **: 12:05:26.897: Couldn't connect to
accessibility bus: Failed to connect to socket /run/user/1000/at-spi/bus:
Permission denied
... then /var/log/syslog:
[...] audit: type=1400
** Tags added: rls-jj-incoming
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to apparmor in Ubuntu.
https://bugs.launchpad.net/bugs/1794064
Title:
Clicking a hyperlink in a PDF fails to open it if the default browser
is a
** Changed in: evince (Debian)
Status: Unknown => New
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to apparmor in Ubuntu.
https://bugs.launchpad.net/bugs/1794064
Title:
Clicking a hyperlink in a PDF fails to open it
** Bug watch added: Debian Bug tracker #923345
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=923345
** Also affects: evince (Debian) via
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=923345
Importance: Unknown
Status: Unknown
--
You received this bug notification because
I pulled the evince source and there does not appear to be any direct
support for portals, and sandbox support is an untasked item on their
roadmap. However it still may be possible via the gnome libs, or via
dlopen. Those routes would need to be further investigated.
--
You received this bug
Is there any option to do this via portals - ie can evince use
https://flatpak.github.io/xdg-desktop-portal/portal-docs.html#gdbus-
org.freedesktop.portal.OpenURI to open the URI? Would then this allow to
avoid going via xdg-open?
--
You received this bug notification because you are a member of
I was able to reproduce this issue on focal and bionic but not on
impish. I'm still investigating why, since I don't see any changes in
policies that might affect this issue, but I could have missed
something.
--
You received this bug notification because you are a member of Ubuntu
Touch seeded
** Changed in: evince (Ubuntu)
Assignee: (unassigned) => Georgia Garcia (georgiag)
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to apparmor in Ubuntu.
https://bugs.launchpad.net/bugs/1794064
Title:
Clicking a
Olivier, yes, I shouldn't be assigned. Ian, you're right the profile is
suboptimal (it's also old so likely needs updating).
Do note that this is a separate named profile and evince (and if this is
put in an abstraction, anything that uses the abstraction) only has the
** Changed in: evince (Ubuntu)
Assignee: Jamie Strandboge (jdstrand) => (unassigned)
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to apparmor in Ubuntu.
https://bugs.launchpad.net/bugs/1794064
Title:
Clicking a
Also I'm not sure I agree with jdstrand's apparmor profile which
includes:
/run/snapd.socket rw,
which I don't think we want to grant to any PDF file opened with evince?
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to
Status changed to 'Confirmed' because the bug affects multiple users.
** Changed in: apparmor (Ubuntu)
Status: New => Confirmed
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to apparmor in Ubuntu.
** Also affects: apparmor (Ubuntu)
Importance: Undecided
Status: New
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to apparmor in Ubuntu.
https://bugs.launchpad.net/bugs/1794064
Title:
Clicking a hyperlink in a
86 matches
Mail list logo
