Evince - Libreoffice - Geogebra - Apparmor issues

Question

I try to authorize evince to open Geogebra and libreoffice files as links.

Using evince 3.18.2 on ubuntu 16.04.

Update 1: I've just installed a fresh 18.04 with the same problem.

Update 2: Here are the files to try. Both sort of links work fine with Okular.

For that I've added :

/usr/bin/geogebra ixr,
/usr/bin/libreoffice ixr,

just after :

# For text attachments
/usr/bin/gedit ixr,

in usr.bin.evince and ran : sudo /etc/init.d/apparmor restart

On a libreoffice link, evince says :

Impossible de lancer l'application externe.
L'exécution du processus fils « libreoffice » a échoué (Permission non accordée)

And no other message in the terminal from wich evince is launched.

On a geogebra link, evince says nothing :

but in the terminal windows from wich evince is launched there is the message:

/usr/bin/geogebra: ligne 9: /usr/bin/basename: Permission non accordée
/usr/bin/geogebra: /usr/share/geogebra/geogebra : /bin/bash : mauvais interpréteur: Permission non accordée
/usr/bin/geogebra: ligne 19: /usr/share/geogebra/geogebra: Succès

Geogebra is not launched but the icon in the launcher is blinking a while.

Answer 1

I give some tries on 18.04.1, for evince.

Add below lines into /etc/apparmor.d/local/usr.bin.evince

/usr/lib/libreoffice/program/* ixr,
/{usr/,}bin/* ixr,

You can see I use wildcard, I'm just lazy. You can explicitly specify all needed executables' path here. You should notice "/usr/bin/libreoffice" itself is a shell script. So all it launches is confined by rules of "usr.bin.evince"; I think it is same situation for geogebra

I'm not an expert of apparmor, maybe others have better idea.

EDIT 1

Another idea is, if you don't care apparmor's confinement, you can just put evince into complain mode, which will not confine its actions by:

$ sudo aa-complain /usr/bin/evince

in case you don't have aa-complain, you can install it by:

$ sudo apt install -y apparmor-utils

EDIT 2

Ok, since you have concerns of bypassing apparmor, I think you can do this:

1. Continue from my original answer, replace those wildcard with exact binary/script needed by /usr/bin/libreoffice - it is actually a symbolic link to /usr/lib/libreoffice/program/soffice;
2. Reload apparmor to update rules;
3. Do what you want to do in evince, and check shell output(or syslog) to see which executable is blocked, so you can add it into apparmor rules; Take your example of geogebra, you should add "/usr/bin/basename", "/bin/bash", "/usr/share/geogebra/geogebra" in your apparmor rules;
4. Repeat 2~4, until you don't see any problems.