okular: cannot print to pdf #6402

gcb · 2024-07-11T02:38:47Z

gcb
Jul 11, 2024

My system do not have cups, only cupslibs.

most applications (outside of firejail) will show a "print to PDF" option as a "printer".

Same application with default git profiles will not show such printer. Shows an empty printer list.

Not sure what to allow on applications such as okular to enable that PDF printer. I only see alternative-etc for the non-existing dir /etc/cups. Not sure what else to enable. or even what is providing that printer in my system.

Answered by kmk3

Jul 20, 2024

Should be fixed by:

#6408

View full answer

kmk3 · 2024-07-11T03:15:49Z

kmk3
Jul 11, 2024
Collaborator

Basic debugging information is missing; please follow the bug report template:

https://github.com/netblue30/firejail/issues/new?template=bug_report.md

Also, if you run the following command:

firejail --trace=trace.txt /usr/bin/okular $file

And try to print the file, then close okular, what is the content of trace.txt?

1 reply

gcb Jul 13, 2024
Author

Description

^

Steps to Reproduce

Run in bash LC_ALL=C firejail okular (LC_ALL=C to get a consistent
output in English that can be understood by everybody)
"Ctrl+P"

Expected behavior

See the QT default "print to PDF" pseudo-printer.

Actual behavior

there's no printers in the printer drop down.

Behavior without a profile

I see the default QT pseudo printer "Print to PDF"

Additional context

The necessary libs are whitelisted OK on the default profile available here (okular.profile). But the dbus messages are blocked.

Environment

firejail version 0.9.72

Compile time support:
        - always force nonewprivs support is disabled
        - AppArmor support is enabled
        - AppImage support is enabled
        - chroot support is enabled
        - D-BUS proxy support is enabled
        - file transfer support is enabled
        - firetunnel support is disabled
        - IDS support is disabled
        - networking support is enabled
        - output logging is enabled
        - overlayfs support is disabled
        - private-home support is enabled
        - private-cache and tmpfs as user enabled
        - SELinux support is disabled
        - user namespace support is enabled
        - X11 sandboxing support is enabled
Linux 6.9.9-arch1-1 #1 SMP PREEMPT_DYNAMIC Fri, 12 Jul 2024 00:06:53 +0000 x86_64 GNU/Linux

Checklist

The issues is caused by firejail (i.e. running the program by path (e.g. /usr/bin/vlc) "fixes" it).
I can reproduce the issue without custom modifications (e.g. globals.local).
The program has a profile. (If not, request one in https://github.com/netblue30/firejail/issues/1139)
The profile (and redirect profile if exists) hasn't already been fixed upstream.
I have performed a short search for similar issues (to avoid opening a duplicate).

Log

No logs provide any information for dbus access.

glitsj16 · 2024-07-11T03:16:02Z

glitsj16
Jul 11, 2024
Collaborator

You could try to comment options in okular.profile and try to pinpoint what's blocking that "print to PDF" option. That's always a bit time-consuming obviously. I'm not at all familiar with KDE, and I don't know what provides such a PDF printer option either. Based on the profile my first assumptions are we're either missing a command (in private-bin) and/or extra cups-related files from /usr/share are needed. Maybe the below can jump-start the search for the blocking/missing option(s):

$ cat ~/.config/firejail/okular.local
whitelist /usr/share/cups
whitelist /usr/share/ppd

ignore private-bin
ignore private-etc

Once we've established what's needed, we can try to undo the effects of loosening the sandbox with the ignore private-{bin,etc} suggestions.

9 replies

gcb Jul 15, 2024
Author

thanks. So not the case: DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/1000/bus

gcb Jul 15, 2024
Author

i've edited the comment at the start of this thread. It was not dbus. I was doing something wrong between tests.

I still have no idea what enables printing...

gcb Jul 15, 2024
Author

ignore private-bin alone in the .local file does fix printing!

running firejail --debug okular with and witouth it produces almost the same output. the only difference is

without ignore private-bin (and no printing):

Disable /usr/local/sbin
Warning (blacklisting): cannot open /usr/local/sbin/at: Permission denied
Warning (blacklisting): cannot open /usr/local/sbin/busybox: Permission denied
Warning (blacklisting): cannot open /usr/local/sbin/chage: Permission denied
Warning (blacklisting): cannot open /usr/local/sbin/chfn: Permission denied
Warning (blacklisting): cannot open /usr/local/sbin/chsh: Permission denied
Warning (blacklisting): cannot open /usr/local/sbin/crontab: Permission denied
Warning (blacklisting): cannot open /usr/local/sbin/doas: Permission denied
Warning (blacklisting): cannot open /usr/local/sbin/evtest: Permission denied

with ignore private-bin (and printing OK):

Disable /usr/local/sbin
Warning (blacklisting): cannot open /usr/local/sbin/at: Permission denied
Warning (blacklisting): cannot open /usr/local/sbin/busybox: Permission denied
Warning (blacklisting): cannot open /usr/local/sbin/chage: Permission denied
Disable /usr/bin/chage
Warning (blacklisting): cannot open /usr/local/sbin/chfn: Permission denied
Disable /usr/bin/chfn
Warning (blacklisting): cannot open /usr/local/sbin/chsh: Permission denied
Disable /usr/bin/chsh
Warning (blacklisting): cannot open /usr/local/sbin/crontab: Permission denied
Disable /usr/bin/crontab
Warning (blacklisting): cannot open /usr/local/sbin/doas: Permission denied
Disable /usr/bin/doas
Warning (blacklisting): cannot open /usr/local/sbin/evtest: Permission denied
Warning (blacklisting): cannot open /usr/local/sbin/expiry: Permission denied
Disable /usr/bin/expiry

(it shows those extra "Disable ..." lines)

gcb Jul 15, 2024
Author

i don't see any fork or the likes on the source https://github.com/qt/qtbase/blob/ff1ba4f1c9da383b357745c2261de5b0050cdf3c/src/printsupport/kernel/qprintengine_pdf.cpp

glitsj16 Jul 15, 2024
Collaborator

ignore private-bin alone in the .local file does fix printing!

Interesting. So we need to find which executable(s) are missing from the original private-bin for supporting printing in KDE. As requested by @kmk3 above you can run:

firejail --trace=trace.txt /usr/bin/okular $file
And try to print the file, then close okular, what is the content of trace.txt?

If you can provide that trace.txt here that would help us find what we're looking for.

Now I'm wondering if okular (and possibly other KDE apps) needs a shell for printing support... Easily tested with the below:

$ cat ~/.config/firejail/okular.local
include allow-bin-sh.inc
private-bin bash,sh

gcb · 2024-07-16T02:00:51Z

gcb
Jul 16, 2024
Author

The trace was more helpful than debug (apologies, at first I assumed it was just an option to save the same infro from --debug to a file)

So, besides learning okular calls stat on all my home files over and over for no good reason, and that it reads the mime files some hundred times each... the trace showed it needs access to ps2pdf on linux.

this is the file on my .local file now (from my tests I believe it ADDs to the same value in okular.profile)

private-bin ps2pdf

...I guess we can add this on a common-kde.inc file? Is there such file? Anything that prints in KDE will required it for the "to PDF" functionality. But it's also a exploit gateway as it deals with two of the worst file formats :)

the okular.profile one have things which I believe are very out of date

kbuildsycoca4 is several years out of use. I mean even by 'debian-stable' standards that is deprecated. kde5 didn't have this as far as I can tell, and 6 (current) reintroduced as kbuildsycoca6. but grepping for kbuildsycoca in my traces showed nothing. I think it can go.
okular fails with "Error: no suitable /usr/bin/okular executable found" not sure if okular needs to call itself? how does that work, having the same bin of the masked program in private-bin? does it call the unmasked one?
kdeinit4 deprecated like the first one above. not reintroduced in 6.
lpr i couldn't find KDE or QT using it nowadays. I think that is from 4- times. 5 and 6 only use the native method (which i learned here that depends on ps2pdf and have support for cups)
unar,unrar I don't have either so 🤷

4 replies

glitsj16 Jul 16, 2024
Collaborator

this is the file on my .local file now (from my tests I believe it ADDs to the same value in okular.profile)

Correct, private-bin options accumulate (and support gmobbing).

...I guess we can add this on a common-kde.inc file? Is there such file?

We don't have such a file. And even if we did, it would take implementing a new conditional like ?HAS_PRIVATE_BIN: private-bin foo. Until someone implements all of this the best you can do is add private-bin ps2pdf to any profile you want/need to have printing support. Suboptimal, I do realize that, but such is the current situation I'm afraid.

the okular.profile one have things which I believe are very out of date

Thanks for sharing this info. Although I'm not aware of any written statement of how to deal with outdated parts of a profile, the working assumption is to not drop anything until there's proof it breaks a sandbox...

All in all a very nice piece of detective work to find that missing piece :) Can you open a PR to add this to the okular.profile at least?

gcb Jul 16, 2024
Author

Just one more complication... i noticed i can print to pdf from kate without allowing ps2pdf in any way i can detect... sigh.

glitsj16 Jul 16, 2024
Collaborator

Just one more complication... i noticed i can print to pdf from kate without allowing ps2pdf in any way i can detect... sigh.

That's because kate.profile doesn't have private-bin, so the needed binaries are already accessible in its sandbox. Nothing to be done here.

gcb Jul 19, 2024
Author

nono, i was blocking the binaries on kate and it still worked. I asked about on the okular irc, and it seems it is still not fully utilizing the pure-QT solution: https://invent.kde.org/graphics/okular/-/merge_requests/411

I believe most KDE/QT things up to date should not require access to external bin, besides the QT libs.

kmk3 · 2024-07-20T13:58:21Z

kmk3
Jul 20, 2024
Collaborator

Should be fixed by:

profiles: okular: fix "Print to PDF" #6408

0 replies

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

okular: cannot print to pdf #6402

{{title}}

Replies: 4 comments 14 replies

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

Select a reply

okular: cannot print to pdf #6402

gcb Jul 11, 2024

Replies: 4 comments · 14 replies

kmk3 Jul 11, 2024 Collaborator

gcb Jul 13, 2024 Author

Description

Steps to Reproduce

Expected behavior

Actual behavior

Behavior without a profile

Additional context

Environment

Checklist

Log

glitsj16 Jul 11, 2024 Collaborator

gcb Jul 15, 2024 Author

gcb Jul 15, 2024 Author

gcb Jul 15, 2024 Author

gcb Jul 15, 2024 Author

glitsj16 Jul 15, 2024 Collaborator

gcb Jul 16, 2024 Author

glitsj16 Jul 16, 2024 Collaborator

gcb Jul 16, 2024 Author

glitsj16 Jul 16, 2024 Collaborator

gcb Jul 19, 2024 Author

kmk3 Jul 20, 2024 Collaborator

gcb
Jul 11, 2024

Replies: 4 comments 14 replies

kmk3
Jul 11, 2024
Collaborator

gcb Jul 13, 2024
Author

glitsj16
Jul 11, 2024
Collaborator

gcb Jul 15, 2024
Author

gcb Jul 15, 2024
Author

gcb Jul 15, 2024
Author

gcb Jul 15, 2024
Author

glitsj16 Jul 15, 2024
Collaborator

gcb
Jul 16, 2024
Author

glitsj16 Jul 16, 2024
Collaborator

gcb Jul 16, 2024
Author

glitsj16 Jul 16, 2024
Collaborator

gcb Jul 19, 2024
Author

kmk3
Jul 20, 2024
Collaborator