Public bug reported:
Evince's AppArmor profile does not include the Glycin abstraction. When Evince
generates thumbnails, gdk-pixbuf may use Glycin, which launches its image
loader through bwrap. AppArmor then prevents the loader from running, and
Evince reports warnings such as:
Failed to save thumbnail ... Could not spawn "bwrap" ... glycin-image-rs:
Permission denied (os error 13)
On Ubuntu 26.04 with Evince 49~alpha-2ubuntu222, I added this line to the
Evince AppArmor profile:
include if exists <abstractions/glycin>
I reloaded the profile, moved ~/.cache/thumbnails aside, and restarted Evince.
It regenerated about 16 thumbnails without printing the bwrap/Glycin
warnings. The kernel log showed profile reload STATUS messages and no
AppArmor DENIED messages related to bwrap or Glycin.
The include is conditional, so it should be harmless on systems where
abstractions/glycin is not installed.
I propose adding this include to debian/apparmor-profile (the profile installed
as /etc/apparmor.d/usr.bin.evince). I also tested adding it to the
evince-previewer profile stanza.
This issue is also tracked in Debian bug #1127935:
https://bugs.debian.org/1127935
I have attached the updated debian/apparmor-profile used for the successful
test.
** Affects: evince (Ubuntu)
Importance: Undecided
Status: New
** Attachment added: "/etc/apparmor.d/usr.bin.evince"
https://bugs.launchpad.net/bugs/2169891/+attachment/6006920/+files/apparmor-profile
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2169891
Title:
AppArmor profile blocks Glycin/bwrap, preventing thumbnail generation
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/evince/+bug/2169891/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
