34
convert /home/bill/TempScan/*.png  myfile.pdf

gives error message:

convert-im6.q16: not authorized `myfile.pdf' @ error/constitute.c/WriteImage/1037.

Any help would be appreciated!

48

convert is a powerful command line tool to convert graphics. Allegedly, that provides security risks, especially where it is used in conjunction with a web server. In recent versions of Ubuntu, a policy file is implemented, where certain uses of convert are restricted. Apparently, that file by default prohibits "converting" multiple graphic files into one PDF file.

The policy file is /etc/ImageMagick-6/policy.xml. You may edit that file as root user to change the policies.

Eliminating all usage restrictions

For desktop users not running a webserver, simply eliminating these restrictions might be good enough. To that aim, one may delete the file, but it is better practice to "move the file out" by renaming it. With this command, you are renaming the file. As a result, all policies are lifted, but you still can revert if needed:

sudo mv /etc/ImageMagick-6/policy.xml /etc/ImageMagick-6/policy.xmlout

To revert to the original situation, just rename back to the original name:

sudo mv /etc/ImageMagick-6/policy.xmlout /etc/ImageMagick-6/policy.xml

Eliminating only the restriction to combine into PDF

For your specific case, gene_wood in a comment pointed to the posibility to selectively relax the policy for working with PDF files by commenting out one line:

<policy domain="coder" rights="none" pattern="PDF" />

Edit the file, and place comment marks around this line to disable this rule:

<!-- <policy domain="coder" rights="none" pattern="PDF" /> -->

If you do not want to eliminate all security policies, this is the way to go.

Disclaimer: you have been warned that removing this policy file removes certain security policies.

  • Thanks vanadium, I renamed the file as suggested and it worked a treat. – bill-lancaster Oct 8 '18 at 11:58
  • 2
    I went into the policy.xml file and found the line that was preventing me from combining png files into pdfs and commented it out. That line was <policy domain="coder" rights="none" pattern="PDF" /> if you'd like to leave the other rules intact but allow working with pdfs. – gene_wood Oct 8 '18 at 22:33
  • 1
    @gene_wood, thank you: I added to the post because it provides more insight and options for users wanting to be more careful in eliminating restrictions. – vanadium Oct 9 '18 at 9:18
  • Ok, this works in Ubuntu 18.04 with imagemagick 8:6.9.7.4+dfsg-16ubuntu6.4. Thank you. – Geppettvs D'Constanzo Oct 14 '18 at 22:19
  • Can we get rid of the disclaimer? It seems to me it only wastes the time of the reader. – banan3'14 Jan 31 at 12:24
11

As vanadium posted, you have to change the ImageMagick policy.

sudo vim /etc/ImageMagick-6/policy.xml

and replace the line

<policy domain="coder" rights="none" pattern="PDF" />

with

<policy domain="coder" rights="read|write" pattern="PDF" />

If you only want to allow write, and not read, you can also erase the read| part in the line above.


BTW, for those who are interested about the ImageMagick vulnerability, here are 2 informational links:

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.