Bug#923345: evince cannot start default browser due to AppArmor

[Ralf Jung]

Package: evince
Version: 3.30.2-3
Severity: normal

Dear Maintainer,

To reproduce:
* Install a browser, e.g. Firefox Beta, from upstream (instead of the Debian repo).
* When the browser asks you, tell it that yes you want it to become the default browser.
* Start evince and click a link in a PDF file.

Expected behavior:
The link should be opened in the default browser.

Actual behavior:
Nothing happens when I click the link.

Further information:
It has puzzled me for quite some time why my default browser works in all
applications, but not in evince.  Through some help from upstream (unfortunately
I had to bother them with this Debian-specific issue), I realized that I have
AppArmor enabled on my system and that it has a profile for evince.  My default
browser is Firefox Beta, which is not shipped by Debian and hence installed in
my home directory -- and that gets blocked by AppArmor.  The blocking happens
without any notice on the command line.  I just noticed it *does* get logged in
`dmesg`, but (not even knowing that AppArmor got enabled on my system), I did
not think to look there.

I think the default configuration should enable people to choose their default
browser, and should at least tell them why their setup does not work.
Currently, the failure mode for "someone downloads Firefox from the web and
installs it and tells it to become the default browser" is a siltently
half-broken default browser setup, which is not how things should work.


Kind regards,
Ralf

-- System Information:
Debian Release: buster/sid
  APT prefers testing
  APT policy: (990, 'testing'), (500, 'unstable-debug'), (500, 'testing-debug'), (100, 'unstable')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 4.19.0-2-amd64 (SMP w/8 CPU cores)
Kernel taint flags: TAINT_USER, TAINT_OOT_MODULE, TAINT_UNSIGNED_MODULE
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages evince depends on:
ii  dconf-gsettings-backend [gsettings-backend]  0.30.1-2
ii  evince-common                                3.30.2-3
ii  gsettings-desktop-schemas                    3.28.1-1
ii  libatk1.0-0                                  2.30.0-2
ii  libc6                                        2.28-7
ii  libcairo-gobject2                            1.16.0-2
ii  libcairo2                                    1.16.0-2
ii  libevdocument3-4                             3.30.2-3
ii  libevview3-3                                 3.30.2-3
ii  libgdk-pixbuf2.0-0                           2.38.0+dfsg-7
ii  libglib2.0-0                                 2.58.3-1
ii  libgnome-desktop-3-17                        3.30.2.1-1
ii  libgtk-3-0                                   3.24.5-1
ii  libnautilus-extension1a                      3.30.5-1
ii  libpango-1.0-0                               1.42.4-6
ii  libpangocairo-1.0-0                          1.42.4-6
ii  libsecret-1-0                                0.18.7-1
ii  shared-mime-info                             1.10-1

Versions of packages evince recommends:
ii  dbus-user-session [default-dbus-session-bus]  1.12.12-1
ii  dbus-x11 [dbus-session-bus]                   1.12.12-1

Versions of packages evince suggests:
ii  gvfs             1.38.1-3
pn  nautilus-sendto  <none>
ii  poppler-data     0.4.9-2
ii  unrar            1:5.6.6-1

-- no debconf information