Dear Maintainer,

   * What led up to the situation?
     Getting apparmor automatically to the system
   * What exactly did you do (or not do) that was effective (or
     ineffective)?
     apt -u dist-upgrade
   * What was the outcome of this action?
     Nemo, nautilus and co no longer generate thumbnails
   * What outcome did you expect instead?
     Working thumbnail generation

currently in Debian/testing evince-thumbnailer and all thumbnail support in the
GNOME or GTK file managers is broken due to apparmor.

The /var/log/syslog output is as follows:

Nov 29 15:16:49 g6 org.freedesktop.thumbnails.Thumbnailer1[30175]: Error
loading document: Failed to create directory '/tmp/evince-thumbnailer-32317':
Permission denied
Nov 29 15:16:49 g6 kernel: [90299.922771] audit: type=1400
audit(1543501009.168:1365): apparmor="DENIED" operation="mkdir"
profile="/usr/bin/evince-thumbnailer" name="/tmp/evince-thumbnailer-32317/"
pid=32317 comm="evince-thumbnai" requested_mask="c" denied_mask="c" fsuid=0
ouid=0

Please adjust apparmor that thumbnail generation is working again. It reports
access to /tmp directory is denied.

I applied a screenshot of the log output to this e-mail.

Thank you very much for efforts.

Yours sincerely,

Adrian Immanuel Kiess

See also https://bugs.launchpad.net/ubuntu/+source/evince/+bug/1798091

Also, this affects caja as well, but the path that needs to be allowed
is /tmp/.mate_desktop_thumbnail.*

- -- System Information:
Debian Release: bullseye/sid
  APT prefers testing-debug
  APT policy: (500, 'testing-debug'), (500, 'stable-updates'), (500, 'testing'), (500, 'stable'), (130, 'unstable-debug'), (130, 'unstable'), (120, 'experimental-debug'), (120, 'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 4.19.0-5-amd64 (SMP w/8 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/bash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages evince depends on:
ii  dconf-gsettings-backend [gsettings-backend]  0.34.0-2
ii  evince-common                                3.34.1-1
ii  gsettings-desktop-schemas                    3.34.0-2
ii  libatk1.0-0                                  2.34.1-1
ii  libc6                                        2.29-7
ii  libcairo-gobject2                            1.16.0-4
ii  libcairo2                                    1.16.0-4
ii  libevdocument3-4                             3.34.1-1+b1
ii  libevview3-3                                 3.34.1-1+b1
ii  libgdk-pixbuf2.0-0                           2.40.0+dfsg-2
ii  libglib2.0-0                                 2.62.4-1
ii  libgnome-desktop-3-18                        3.34.2-2
ii  libgtk-3-0                                   3.24.13-1
ii  libnautilus-extension1a                      3.34.1-1
ii  libpango-1.0-0                               1.42.4-7
ii  libpangocairo-1.0-0                          1.42.4-7
ii  libsecret-1-0                                0.19.1-1
ii  shared-mime-info                             1.10-1

Versions of packages evince recommends:
ii  dbus-user-session [default-dbus-session-bus]  1.12.16-2
ii  dbus-x11 [dbus-session-bus]                   1.12.16-2

Versions of packages evince suggests:
ii  gvfs             1.42.1-3
ii  nautilus-sendto  3.8.6-3
ii  poppler-data     0.4.9-2
ii  unrar            1:5.6.6-2

- -- no debconf information
-----BEGIN PGP SIGNATURE-----

iHMEARECADMWIQTlAc7j4DAtSNRJJ0z7P4jCVepZ/gUCXjhbyxUcYW50aG9ueUBk
ZXJvYmVydC5uZXQACgkQ+z+IwlXqWf7vQgCfeNJdjrKvsxYJwcQRvP/4hOeoWjkA
n0P90qNdIr1OA1sMeyeAhAqkr3eh
=B5ZU
-----END PGP SIGNATURE-----

None thumbnail are created because of apparmor. So evince-thumbnailer is
unusable.

This bug is present also in Debian 10.9.

Regards.

Dear Maintainer,

A workaround (and an idea for a patch) for this bug should be to add the file /etc/apparmor.d/local/usr.bin.evince
with this content:

owner /tmp/{,.}tumbler-* w,

if the tumbler package is installed.

Regards.

Dear Maintainer,

As an update to this issue, seems like the apparmor profile got updates since 2018 breaking the thumbnail feature.

I'm using this as a workaround on LXDE and should work with other DE.
I'm not an expert on AppArmor but seems to work and follow regular security policies, would you mind take a look?

Thanks in advance for the attention.

diff --git a/etc/apparmor.d/usr.bin.evince.orig b/etc/apparmor.d/usr.bin.evince
index eb0253e..d2c2923 100644
--- a/etc/apparmor.d/usr.bin.evince.orig
+++ b/etc/apparmor.d/usr.bin.evince
@@ -338,6 +338,10 @@
   / r,
   deny /missfont.log w,

+  # Fix thumbnail issue #915024
+  owner @{HOME}/.cache/thumbnails/** rw,
+  owner /tmp/evince-thumbnailer* rw,
+
   # Site-specific additions and overrides. See local/README for details.
   #include <local/usr.bin.evince>
 }