7

If I go into evince's save dialog, go to /home/username/Documents, in my home directory, and try to create a new directory (e.g. foo), the operation fails. Evince says:

Could not create directory /home/[username]/Documents/foo: Permission denied

Evince refuses to save files, too, with the same sort of message.

I am running Ubuntu 12.04 and evince 3.4.0. I should also mention that /home is a symlink to /media/hdd/home (the filesystem is split across a solid-state drive and HDD; a bit of an experiment). This does not bother any other applications. Evince is running as me, and should have write permissions on /media/hdd/home/username/Documents, according to ls -l.

dmesg shows that evince tried to create the directory, but was denied:

[10991.212472] type=1400 audit(1355983426.653:614): apparmor="DENIED"
operation="mkdir" parent=1 profile="/usr/bin/evince" name="/media/hdd/home
/username/Documents/foo/" pid=2940 comm="evince" requested_mask="c" denied_mask="c"
fsuid=1001 ouid=1001

3 Answers 3

9

I had the same problem and solved it with:

$ sudo apt-get install apparmor-utils
$ sudo aa-complain /usr/bin/evince

This changes the apparmor profile for evince into complain mode. This means apparmor will complain in syslog about every action of evince that should be denied (according to the profile) ... but it allows it nevertheless.

Of course this is not the best solution as the whole profile is kind of "turned off" then. But as I don't know how to convince apparmor to allow evince doing mkdir on symlinked targets outside of ~ (which is the reason for the denial), this works well for me.

3
  • What if apparmor is not installed by default, and you do not want to install it only because of this bug? I get: sudo: aa-complain: command not found Apr 13, 2014 at 18:50
  • 1
    Maybe you do have apparmor installed, but you have to install apparmor-utils for the aa-complain command to be available.
    – Nicolas
    Apr 15, 2014 at 20:35
  • $ dpkg -l apparmor indeed reveals that it is installed, as in any Ubuntu distro. apparmor-utils is not installed by default; I edited your answer accordingly. Thanks for the solution. Apr 15, 2014 at 22:51
4

In my case my home directory was a symlink to a network share which was mounted not in /home. This caused Apparmor to deny the creation of the directory. I fixed this by adding my real home directory path to the set of home directory paths in the Apparmor configuration:

echo '@{HOMEDIRS}+=/myrealhomedir/' > /etc/apparmor.d/tunables/home.d/somename
sudo dpkg-reconfigure apparmor
1
  • This is a much better solution than the other answer and should fix the problem for all applications. Thanks!
    – Calimo
    Aug 17, 2017 at 16:34
0

I saw the same problem as soon as I changed the way I mounted my samba share. If you use the "standard" Nautilus way to access files on a network share, Nautilus will mount the share in

/run/user/

or

~/.local/share/gvfs-metadata/

Apparmor is set up to accept these directories. But if you mount the share yourself in another directory, it will not work. So we have to add the whole network share to the list of authorized directories.

This is well explained here in the Ubuntu help pages . Although user1225999's answer works, the first line is unneeded as the purpose of

sudo dpkg-reconfigure apparmor

is to allow you to type your share path to add it to the home directory paths. The command will add the path to

/etc/apparmor.d/tunables/home.d/ubuntu

file (this file already exists).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .