Bug#954013: evince: Opening external URL failed: blocked by AppArmor: Failed to execute child process /bin/sh

[Boyuan Yang]

Package: evince
Severity: normal
Version: 3.36.0-1
X-Debbugs-CC: jbicha at debian.org bigon at debian.org

Dear Debian evince maintainers,

While reading a PDF file today, I found that clicking the embedded URL will
not work. Evince will give the hint:

Failed to execute child process “/bin/sh” (permission denied)


System journal emits the following information:

audit[6701]: AVC apparmor="DENIED" operation="exec" profile="/usr/bin/evince"
name="/usr/bin/dash" pid=6701 comm="evince" requested_mask="x" denied_mask="x"
fsuid=1000 ouid=0

kernel: audit: type=1400 audit(1584297651.234:41): apparmor="DENIED"
operation="exec" profile="/usr/bin/evince" name="/usr/bin/dash" pid=6701
comm="evince" requested_mask="x" denied_mask="x" fsuid=1000 ouid=


I am not sure why evince want to use Shell to execute external process. Anyway
this must be a regression. Other PDF readers (like okular) does not have this
bug.

-- 
Best,
Boyuan Yang
-------------- next part --------------
A non-text attachment was scrubbed...
Name: Allegheny County Announces Two Additional Confirmed Cases of COVID-19.pdf
Type: application/pdf
Size: 136215 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-gnome-maintainers/attachments/20200315/db18843c/attachment-0001.pdf>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: This is a digitally signed message part
URL: <http://alioth-lists.debian.net/pipermail/pkg-gnome-maintainers/attachments/20200315/db18843c/attachment-0001.sig>