Dear Maintainer,

To reproduce:
* Install a browser, e.g. Firefox Beta, from upstream (instead of the Debian repo).
* When the browser asks you, tell it that yes you want it to become the default browser.
* Start evince and click a link in a PDF file.

Expected behavior:
The link should be opened in the default browser.

Actual behavior:
Nothing happens when I click the link.

Further information:
It has puzzled me for quite some time why my default browser works in all
applications, but not in evince.  Through some help from upstream (unfortunately
I had to bother them with this Debian-specific issue), I realized that I have
AppArmor enabled on my system and that it has a profile for evince.  My default
browser is Firefox Beta, which is not shipped by Debian and hence installed in
my home directory -- and that gets blocked by AppArmor.  The blocking happens
without any notice on the command line.  I just noticed it *does* get logged in
`dmesg`, but (not even knowing that AppArmor got enabled on my system), I did
not think to look there.

I think the default configuration should enable people to choose their default
browser, and should at least tell them why their setup does not work.
Currently, the failure mode for "someone downloads Firefox from the web and
installs it and tells it to become the default browser" is a siltently
half-broken default browser setup, which is not how things should work.


Kind regards,
Ralf

This bug still exists in bullseye, despite the partial fix in #954013.

   Oct 22 15:15:03 joyola kernel: [193012.379454] audit: type=1400 audit(1634886903.112:32): apparmor="DENIED" operation="exec" profile="/usr/bin/evince" name="/usr/bin/xfce4-mime-helper" pid=1348354 comm="exo-open" requested_mask="x" denied_mask="x" fsuid=1000 ouid=0

(Why yes, I *am* running XFCE here!)

Hello,

I'm also affected by this bug. I'm using Firefox from upstream as my
default browser, and Evince refuses to open web URLs in that browser.

In terminal:

Please fix it in bullseye-updates.

Best,
Amr

Hello,

I encounter this bug too (XFCE and Firefox-ESR on Sid), for instance
with the PDF produced from these LaTeX sources:

```

\documentclass[12pt,a4paper]{article}
\usepackage{hyperref}

\begin{document}

The \href{https://debian.org}{Debian project}

\end{document}

```

Once built and opened in Evince, if I click on the link, I get an error
and in the logs:

```

May 15 20:17:14 PHILIPPE-PC-DEBIAN kernel: [26008.845553] audit:
type=1400 audit(1652638634.237:25): apparmor="DENIED" operation="exec"
profile="/usr/bin/evince" name="/usr/bin/xfce4-mime-helper" pid=37094
comm="exo-open" requested_mask="x" denied_mask="x" fsuid=1000 ouid=0

```

For the record, if I disable the AppArmor profile, the logs are:

```

May 15 20:22:21 PHILIPPE-PC-DEBIAN kernel: [26316.589686] audit:
type=1400 audit(1652638941.976:34): apparmor="ALLOWED" operation="exec"
profile="/usr/bin/evince" name="/usr/bin/xfce4-mime-helper" pid=38034
comm="exo-open" requested_mask="x" denied_mask="x" fsuid=1000 ouid=0
target="/usr/bin/evince//null-/usr/bin/xfce4-mime-helper"
May 15 20:22:21 PHILIPPE-PC-DEBIAN kernel: [26316.589975] audit:
type=1400 audit(1652638941.976:35): apparmor="ALLOWED"
operation="file_inherit"
profile="/usr/bin/evince//null-/usr/bin/xfce4-mime-helper"
name="/dev/null" pid=38034 comm="xfce4-mime-help" requested_mask="r"
denied_mask="r" fsuid=1000 ouid=0
May 15 20:22:21 PHILIPPE-PC-DEBIAN kernel: [26316.589983] audit:
type=1400 audit(1652638941.976:36): apparmor="ALLOWED"
operation="file_mmap"
profile="/usr/bin/evince//null-/usr/bin/xfce4-mime-helper"
name="/usr/bin/xfce4-mime-helper" pid=38034 comm="xfce4-mime-help"
requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
May 15 20:22:21 PHILIPPE-PC-DEBIAN kernel: [26316.589994] audit:
type=1400 audit(1652638941.976:37): apparmor="ALLOWED"
operation="file_mmap"
profile="/usr/bin/evince//null-/usr/bin/xfce4-mime-helper"
name="/usr/lib/x86_64-linux-gnu/ld-2.33.so" pid=38034
comm="xfce4-mime-help" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
May 15 20:22:21 PHILIPPE-PC-DEBIAN kernel: [26316.590059] audit:
type=1400 audit(1652638941.976:38): apparmor="ALLOWED" operation="open"
profile="/usr/bin/evince//null-/usr/bin/xfce4-mime-helper"
name="/etc/ld.so.cache" pid=38034 comm="xfce4-mime-help"
requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
May 15 20:22:21 PHILIPPE-PC-DEBIAN kernel: [26316.590070] audit:
type=1400 audit(1652638941.976:39): apparmor="ALLOWED" operation="open"
profile="/usr/bin/evince//null-/usr/bin/xfce4-mime-helper"
name="/usr/lib/x86_64-linux-gnu/libexo-2.so.0.1.0" pid=38034
comm="xfce4-mime-help" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
May 15 20:22:21 PHILIPPE-PC-DEBIAN kernel: [26316.590080] audit:
type=1400 audit(1652638941.976:40): apparmor="ALLOWED"
operation="file_mmap"
profile="/usr/bin/evince//null-/usr/bin/xfce4-mime-helper"
name="/usr/lib/x86_64-linux-gnu/libexo-2.so.0.1.0" pid=38034
comm="xfce4-mime-help" requested_mask="rm" denied_mask="rm" fsuid=1000
ouid=0
May 15 20:22:21 PHILIPPE-PC-DEBIAN kernel: [26316.590099] audit:
type=1400 audit(1652638941.976:41): apparmor="ALLOWED" operation="open"
profile="/usr/bin/evince//null-/usr/bin/xfce4-mime-helper"
name="/usr/lib/x86_64-linux-gnu/libgtk-3.so.0.2404.29" pid=38034
comm="xfce4-mime-help" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
May 15 20:22:21 PHILIPPE-PC-DEBIAN kernel: [26316.590106] audit:
type=1400 audit(1652638941.976:42): apparmor="ALLOWED"
operation="file_mmap"
profile="/usr/bin/evince//null-/usr/bin/xfce4-mime-helper"
name="/usr/lib/x86_64-linux-gnu/libgtk-3.so.0.2404.29" pid=38034
comm="xfce4-mime-help" requested_mask="rm" denied_mask="rm" fsuid=1000
ouid=0
May 15 20:22:21 PHILIPPE-PC-DEBIAN kernel: [26316.590137] audit:
type=1400 audit(1652638941.976:43): apparmor="ALLOWED" operation="open"
profile="/usr/bin/evince//null-/usr/bin/xfce4-mime-helper"
name="/usr/lib/x86_64-linux-gnu/libgdk-3.so.0.2404.29" pid=38034
comm="xfce4-mime-help" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0

```

I managed to fix the error by adding

```

/usr/bin/xfce4-mime-helper Cx -> sanitized_helper,

```

in /etc/apparmor.d/usr.bin.evince (so here :
https://salsa.debian.org/gnome-team/evince/-/blob/debian/master/debian/apparmor-profile#L73),
but I have no idea if this the correct way to fix it.


Philippe.

Hi,

This bug report seems to be about 2 distinct problems:

1. Evince cannot start external applications on XFCE because the
   exo-open abstraction lacks permission to execute
   /usr/bin/xfce4-mime-helper.

   A cursory look at the sources suggests that recent exo-open
   needs to execute xfce4-mime-helper in some cases:
https://sources.debian.org/src/exo/4.16.3-1/exo-open/main.c/?hl=265#L265
   →
https://sources.debian.org/src/exo/4.16.3-1/exo/exo-execute.c/?hl=263#L86
   →
https://sources.debian.org/src/exo/4.16.3-1/exo/exo-execute.c/?hl=263#L263

   This suggests it's a bug in the exo-open abstraction.

   Is this problem fixed by adding the following line to
   /etc/apparmor.d/abstractions/exo-open

      /{,usr/}bin/xfce4-mime-helper rix,

   ?

   If that's enough, I'm happy to submit the fix upstream.

2. The list of web browsers that applications can start is hard-coded
   and does not support, out of the box, browsers installed in
   arbitrary locations.

   This is an AppArmor design problem that affects all desktop apps
   that need to start a browser. I'm not aware of any plan to fix this
   on the short term. Ideally apps would use Portals instead of
   implicitly relying on being allowed to execute arbitrary programs.

   Meanwhile, the best I can suggest is that users add their preferred
   browser to /etc/apparmor.d/abstractions/ubuntu-browsers.

Cheers!