0

I try to authorize evince to open Geogebra and libreoffice files as links.

Using evince 3.18.2 on ubuntu 16.04.

Update 1: I've just installed a fresh 18.04 with the same problem.

Update 2: Here are the files to try. Both sort of links work fine with Okular.

For that I've added :

/usr/bin/geogebra ixr,
/usr/bin/libreoffice ixr,

just after :

# For text attachments
/usr/bin/gedit ixr,

in usr.bin.evince and ran : sudo /etc/init.d/apparmor restart

On a libreoffice link, evince says :

Impossible de lancer l'application externe.
L'exécution du processus fils « libreoffice » a échoué (Permission non accordée)

And no other message in the terminal from wich evince is launched.

On a geogebra link, evince says nothing :

but in the terminal windows from wich evince is launched there is the message:

/usr/bin/geogebra: ligne 9: /usr/bin/basename: Permission non accordée
/usr/bin/geogebra: /usr/share/geogebra/geogebra : /bin/bash : mauvais interpréteur: Permission non accordée
/usr/bin/geogebra: ligne 19: /usr/share/geogebra/geogebra: Succès

Geogebra is not launched but the icon in the launcher is blinking a while.

1 Answer 1

1
+50

I give some tries on 18.04.1, for evince.

Add below lines into /etc/apparmor.d/local/usr.bin.evince

/usr/lib/libreoffice/program/* ixr,
/{usr/,}bin/* ixr,

You can see I use wildcard, I'm just lazy. You can explicitly specify all needed executables' path here. You should notice "/usr/bin/libreoffice" itself is a shell script. So all it launches is confined by rules of "usr.bin.evince"; I think it is same situation for geogebra

I'm not an expert of apparmor, maybe others have better idea.

EDIT 1

Another idea is, if you don't care apparmor's confinement, you can just put evince into complain mode, which will not confine its actions by:

$ sudo aa-complain /usr/bin/evince

in case you don't have aa-complain, you can install it by:

$ sudo apt install -y apparmor-utils

EDIT 2

Ok, since you have concerns of bypassing apparmor, I think you can do this:

  1. Continue from my original answer, replace those wildcard with exact binary/script needed by /usr/bin/libreoffice - it is actually a symbolic link to /usr/lib/libreoffice/program/soffice;
  2. Reload apparmor to update rules;
  3. Do what you want to do in evince, and check shell output(or syslog) to see which executable is blocked, so you can add it into apparmor rules; Take your example of geogebra, you should add "/usr/bin/basename", "/bin/bash", "/usr/share/geogebra/geogebra" in your apparmor rules;
  4. Repeat 2~4, until you don't see any problems.
7
  • It solves the libreoffice part. I don't know how to adapt this for geogebra, since geogebra script is launched but some calls in it are forbiden ?
    – Tarass
    Nov 12, 2018 at 15:15
  • @Tarass, do you really need apparmor to confine your apps? Maybe you can just simply put "/usr/bin/evince" to complain mode. See my update.
    – alfred
    Nov 13, 2018 at 3:07
  • Thank you it solves the problem. Does some app can start automatically without clicking on a link ?
    – Tarass
    Nov 13, 2018 at 5:57
  • @Tarass, I think you mean to automatically launch some app by just opening a PDF file? It doesn't seems to be related to this question; You can start a new question, which I think it will receive wider readers.
    – alfred
    Nov 13, 2018 at 7:56
  • It is an objection to your idea to put evince to complain mode. I ask you: is it safe or a pdf file opened in evince in complain mode could run a program without a click. You ask me "if I need apparmor", I ask you "do I need, or is it unsafe" ?
    – Tarass
    Nov 13, 2018 at 8:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.