123
convert /home/bill/TempScan/*.png  myfile.pdf

gives error message:

convert-im6.q16: not authorized `myfile.pdf' @ error/constitute.c/WriteImage/1037.

Any help would be appreciated!

173

convert is a powerful command line tool to convert graphics. Allegedly, that provides security risks, especially where it is used in conjunction with a web server. In recent versions of Ubuntu, a policy file is implemented, where certain uses of convert are restricted. Apparently, that file by default prohibits "converting" multiple graphic files into one PDF file.

The policy file is /etc/ImageMagick-6/policy.xml. You may edit that file as root user to change the policies.

Eliminating all usage restrictions

For desktop users not running a webserver, simply eliminating these restrictions might be good enough. To that aim, one may delete the file, but it is better practice to "move the file out" by renaming it. With this command, you are renaming the file. As a result, all policies are lifted, but you still can revert if needed:

sudo mv /etc/ImageMagick-6/policy.xml /etc/ImageMagick-6/policy.xmlout

To revert to the original situation, just rename back to the original name:

sudo mv /etc/ImageMagick-6/policy.xmlout /etc/ImageMagick-6/policy.xml

Eliminating only the restriction to combine into PDF

For your specific case, gene_wood in a comment pointed to the posibility to selectively relax the policy for working with PDF files by commenting out one line:

<policy domain="coder" rights="none" pattern="PDF" />

Edit the file, and place comment marks around this line to disable this rule:

<!-- <policy domain="coder" rights="none" pattern="PDF" /> -->

If you do not want to eliminate all security policies, this is the way to go.

Disclaimer: you have been warned that removing this policy file removes certain security policies.

  • Thanks vanadium, I renamed the file as suggested and it worked a treat. – bill-lancaster Oct 8 '18 at 11:58
  • 4
    I went into the policy.xml file and found the line that was preventing me from combining png files into pdfs and commented it out. That line was <policy domain="coder" rights="none" pattern="PDF" /> if you'd like to leave the other rules intact but allow working with pdfs. – gene_wood Oct 8 '18 at 22:33
  • 1
    @gene_wood, thank you: I added to the post because it provides more insight and options for users wanting to be more careful in eliminating restrictions. – vanadium Oct 9 '18 at 9:18
  • 2
    Ok, this works in Ubuntu 18.04 with imagemagick 8:6.9.7.4+dfsg-16ubuntu6.4. Thank you. – Geppettvs D'Constanzo Oct 14 '18 at 22:19
  • The second method worked for me, but the first didn't. – The Ledge Feb 16 at 4:07
40

As vanadium posted, you have to change the ImageMagick policy.

sudo vim /etc/ImageMagick-6/policy.xml

and replace the line

<policy domain="coder" rights="none" pattern="PDF" />

with

<policy domain="coder" rights="read|write" pattern="PDF" />

If you only want to allow write, and not read, you can also erase the read| part in the line above.


BTW, for those who are interested about the ImageMagick vulnerability, here are 2 informational links:

0

Solution of abu_bua's Solution really worked well for me. For convenience here in one command line with sed:

sudo sed -i 's/rights="none" pattern="PDF"/rights="read|write" pattern="PDF"/g' /etc/ImageMagick-6/policy.xml /etc/ImageMagick-6/policy.xml

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.