Bug#1015817: firejail: Calibre doesn't start Evince

[John]

Package: firejail
Version: 0.9.58.2-2+deb10u3
Severity: important
Tags: upstream

Dear Maintainer,

When trying to read a pdf book from Calibre, Calibre doesn't open it.

My terminal shows this:
evince: util.c:927: create_empty_file_as_root: Assertion `s.st_uid == 0'
failed.

When run /usr/bin/calibre as have been written at
https://github.com/netblue30/firejail/issues/5222 it opens it.

Also Evince doesn't save metadata - the last read page as an example.

Kind Regards,
John






-- System Information:
Debian Release: 10.12
APT prefers oldstable-updates
APT policy: (500, 'oldstable-updates'), (500, 'oldstable')
Architecture: amd64 (x86_64)

Kernel: Linux 4.19.0-21-amd64 (SMP w/16 CPU cores)
Kernel taint flags: TAINT_PROPRIETARY_MODULE, TAINT_OOT_MODULE, TAINT_UNSIGNED_MODULE
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages firejail depends on:
ii libapparmor1 2.13.2-10
ii libc6 2.28-10+deb10u1

Versions of packages firejail recommends:
ii firejail-profiles 0.9.58.2-2+deb10u3
ii iproute2 4.20.0-2+deb10u1
ii iptables 1.8.2-4
ii xauth 1:1.0.10-1
ii xpra 4.3.4-r0-1
ii xserver-xephyr 2:1.20.4-1+deb10u4
ii xvfb 2:1.20.4-1+deb10u4

firejail suggests no packages.

-- no debconf information

[John Wick]

Dear Maintainer,

When 'ignore noroot' is written to .config/firejail/calibre.local
Evince works from Calibre and Evince remembers metadata(the last open
page) but firejail --list shows only Calibre.

Kind Regards,
John

-------------------------------------------------
This free account was provided by VFEmail.net - report spam to ab...@vfemail.net

ONLY AT VFEmail! - Use our Metadata Mitigator to keep your email out of the NSA's hands!
$24.95 ONETIME Lifetime accounts with Privacy Features!
15GB disk! No bandwidth quotas!
Commercial and Bulk Mail Options!

[Reiner Herrmann]

Control: severity -1 normal
Control: tags -1 unreproducible

Hi John,

On Thu, Jul 21, 2022 at 09:43:13PM +0300, John wrote:
> When trying to read a pdf book from Calibre, Calibre doesn't open it.
>
> My terminal shows this:
> evince: util.c:927: create_empty_file_as_root: Assertion `s.st_uid == 0'
> failed.
>
> When run /usr/bin/calibre as have been written at
> https://github.com/netblue30/firejail/issues/5222 it opens it.

I just tried to reproduce your problem, but for me running calibre with
evince as PDF viewer is working fine.
Can you please try to run a newer firejail version?
E.g. 0.9.64.4-1~bpo10+1 from the oldstable backports, or if you are
meanwhile running stable 0.9.70-2~bpo11+1 from the stable backports?

> Also Evince doesn't save metadata - the last read page as an example.

I think Evince doesn't support this in general. Also when running Evince
without Calibre and outside of firejail, it does not save the last page.
Or am I missing some setting to turn that on?

Kind regards,
Reiner

[John Wick]

Hi Reiner,

It works well with 0.9.64.4-1~bpo10+1.

Yet Evince always opens a pdf book at page 1 while normally it opens
where you have stopped reading it.

From
https://superuser.com/questions/1724959/evince-in-wsl2-doesnt-remember-last-visited-page:
'You are absolutely right that Evince uses GVfs (the Gnome Virtual File
System) to store its bookmarks.'

Kind regards,
John

[Reiner Herrmann]

Hi John,

On Sun, Jan 08, 2023 at 09:28:25PM +0300, John Wick wrote:
> It works well with 0.9.64.4-1~bpo10+1.
>
> Yet Evince always opens a pdf book at page 1 while normally it opens where
> you have stopped reading it.
>
> From https://superuser.com/questions/1724959/evince-in-wsl2-doesnt-remember-last-visited-page:
> 'You are absolutely right that Evince uses GVfs (the Gnome Virtual File
> System) to store its bookmarks.'

thanks for the link. After installing gvfs my evince is now also
remembering the last page.
And I also saw that it was not working in a firejailed calibre.

I figured out that the following lines added to
/etc/firejail/calibre.local will allow evince started from firejailed
calibre to remember the page:

> noblacklist ${HOME}/.local/share/gvfs-metadata
> ignore private-tmp

You can try adding it to your calibre.local as well.
I'm not sure if this should get submitted upstream, as not every
calibre user is using evince as a PDF viewer, or wants to grant it
access to gvfs (which can also contain sensitive data of other
applications).

Kind regards,
Reiner

[John Wick]

Hi Reiner,

Thank you for the solution.

Kind regards,
John