-1

While opening a PDF, I get a permission denied error, while ROOT.

root@brix:~# evince *.pdf
evince: error while loading shared libraries: libz.so.1: failed to map segment from shared object: Permission denied

This started happening after:

mv /usr/local /opt/local
ln -s /opt/local /usr/local

(I did this so I could rsync a single /opt/ folder as a backup)

note: I had a compiled libz.so.1 located in /usr/local/lib (along with libpoppler and friends), I don't think this would be an issue otherwise

1
  • ran as root, to prove it was not a permissions problem. I have numerous compiler toolchains (legacy) as well as custom software packages installed there (software development).
    – Kevin
    Jun 20, 2014 at 21:20

2 Answers 2

2

This is not the way to debug a problem with apparmor at all.

You use sudo aa-logprof to examine the logs for problems. You will then be given an opportunity to review any problems in the logs and modify your aa profile.

It is always a good idea to first back up the origional file (back it up in /root/aa-profiles).

After reviewing the logs, it is always a good idea to then manually review the profile and make sure it makes sense.

See:

https://wiki.ubuntu.com/DebuggingApparmor

http://www.insanitybit.com/2012/05/29/apparmor-how-to/

http://blog.bodhizazen.com/linux/apparmor-privoxy-profile/

1
  • Didn't know of aa-logprof, wish a log in /var/log/ would have indicated apparmor.
    – Kevin
    Jun 21, 2014 at 2:05
0

Its actually AppArmor to blame.

root@brix:~# apparmor_status
apparmor module is loaded.
14 profiles are loaded.
14 profiles are in enforce mode.
/usr/bin/evince

Installing (apt-get install apparmor-utils) and applying the following workaround

root@brix:~# aa-complain /usr/bin/evince
Setting /usr/bin/evince to complain mode.

Running this again

root@brix:/etc# apparmor_status
apparmor module is loaded.
14 profiles are loaded.
11 profiles are in enforce mode.

Allows you to successfully launch Evince. More information https://help.ubuntu.com/community/AppArmor , including proper ways to modify the apparmor profile.

6
  • Putting a profile into complain mode does not solve the problem. Your problem is self made by using a non-standard location. If you really wish to do this, you should debug and fix your apparmor profile, not disable it.
    – Panther
    Jun 20, 2014 at 21:18
  • The link you gave on serverfault is unrleated to Ubuntu, apparmor, or your problem.
    – Panther
    Jun 20, 2014 at 21:22
  • It may be a self-made problem (not ubuntus fault)... but it was entirely non-obvious after careful research, as to what was causing the program to fail execution.. Many other programs (eg: self compiled Subversion), handled the library move without fail.
    – Kevin
    Jun 20, 2014 at 21:23
  • 2
    It is "non-obvious" I agree, still I highly advise you take the time to do a little reading on apparmor rather then disabling it.
    – Panther
    Jun 20, 2014 at 21:36
  • Thank you. As a software engineer, on a development machine, I could care less about security. That being said, I respect the 'right way' and accept your answer. I have better things to do then muck about 'permissions'... so disabling is always an option... UAC on windows? No way.
    – Kevin
    Jun 21, 2014 at 2:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .