Home / ubuntu / Questions / 1091654
Accepted
Tarass
Asked: 2018-11-11 03:53:33 +0800 CST

Evince - Libreoffice - Geogebra - Apparmor issues

  • 772

I try to authorize evince to open Geogebra and libreoffice files as links.

Using evince 3.18.2 on ubuntu 16.04.

Update 1: I've just installed a fresh 18.04 with the same problem.

Update 2: Here are the files to try. Both sort of links work fine with Okular.

For that I've added :

/usr/bin/geogebra ixr,
/usr/bin/libreoffice ixr,

just after :

# For text attachments
/usr/bin/gedit ixr,

in usr.bin.evince and ran : sudo /etc/init.d/apparmor restart

On a libreoffice link, evince says :

Impossible de lancer l'application externe.
L'exécution du processus fils « libreoffice » a échoué (Permission non accordée)

And no other message in the terminal from wich evince is launched.

On a geogebra link, evince says nothing :

but in the terminal windows from wich evince is launched there is the message:

/usr/bin/geogebra: ligne 9: /usr/bin/basename: Permission non accordée
/usr/bin/geogebra: /usr/share/geogebra/geogebra : /bin/bash : mauvais interpréteur: Permission non accordée
/usr/bin/geogebra: ligne 19: /usr/share/geogebra/geogebra: Succès

Geogebra is not launched but the icon in the launcher is blinking a while.

pdf libreoffice evince okular apparmor

1 Answers

  1. Best Answer

    I give some tries on 18.04.1, for evince.

    Add below lines into /etc/apparmor.d/local/usr.bin.evince

    /usr/lib/libreoffice/program/* ixr,
/{usr/,}bin/* ixr,

    You can see I use wildcard, I'm just lazy. You can explicitly specify all needed executables' path here. You should notice "/usr/bin/libreoffice" itself is a shell script. So all it launches is confined by rules of "usr.bin.evince"; I think it is same situation for geogebra

    I'm not an expert of apparmor, maybe others have better idea.

    EDIT 1

    Another idea is, if you don't care apparmor's confinement, you can just put evince into complain mode, which will not confine its actions by:

    $ sudo aa-complain /usr/bin/evince

    in case you don't have aa-complain, you can install it by:

    $ sudo apt install -y apparmor-utils

    EDIT 2

    Ok, since you have concerns of bypassing apparmor, I think you can do this:

    1. Continue from my original answer, replace those wildcard with exact binary/script needed by /usr/bin/libreoffice - it is actually a symbolic link to /usr/lib/libreoffice/program/soffice;
    2. Reload apparmor to update rules;
    3. Do what you want to do in evince, and check shell output(or syslog) to see which executable is blocked, so you can add it into apparmor rules; Take your example of geogebra, you should add "/usr/bin/basename", "/bin/bash", "/usr/share/geogebra/geogebra" in your apparmor rules;
    4. Repeat 2~4, until you don't see any problems.
    • 1