Public bug reported:
## Summary
qpdf fails with a misleading "Permission denied" error when access is blocked
by AppArmor, even though file permissions are correct. This makes diagnosis
very difficult for users.
## Environment
- Ubuntu 26.04 (with AppArmor enabled)
- qpdf installed via apt
- apparmor-utils not installed by default
## Steps to reproduce
1. Have a PDF file with correct read permissions (-rw-rw-r--, owned by current
user)
2. Run: qpdf --empty --pages file.pdf 1-5 -- output.pdf
3. Observe misleading error
## Actual behavior
qpdf: open file.pdf: Permission denied
## Expected behavior
qpdf should report that access was denied by AppArmor (or security policy),
not "Permission denied" — which universally implies a filesystem permissions
issue.
## Root cause
The AppArmor profile for qpdf blocks access to files outside allowed paths.
This is confirmed by:
sudo dmesg | grep -i "apparmor.*qpdf"
# shows: apparmor="DENIED" operation="open" profile="qpdf" ...
## Impact
Users spend significant time debugging file ownership and permissions,
running chmod/chown, checking ACLs — none of which helps.
The actual fix (aa-disable /etc/apparmor.d/qpdf) is only discoverable
via dmesg, which is non-obvious for most users.
## Suggested fix
Either:
1. Relax the AppArmor profile to allow access to user home directories, or
2. Have qpdf (or a wrapper) detect AppArmor denial and report it explicitly, or
3. Include a note in qpdf's error output suggesting to check AppArmor logs
when "Permission denied" occurs despite correct file permissions
** Affects: qpdf (Ubuntu)
Importance: Undecided
Status: New
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2154336
Title:
qpdf reports "Permission denied" instead of AppArmor denial, making
diagnosis extremely difficult
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/qpdf/+bug/2154336/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
