Bug 389576 - Okular snap package cannot access files outside home directory
Summary: Okular snap package cannot access files outside home directory
Status: RESOLVED FIXED
Alias: None
Product: neon
Classification: KDE Neon
Component: Snaps (show other bugs)
Version: unspecified
Platform: unspecified Linux
: NOR normal
Target Milestone: ---
Assignee: Scarlett Moore
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2018-01-28 23:59 UTC by 4aa7f31e
Modified: 2023-10-20 13:44 UTC (History)
6 users (show)

See Also:
Latest Commit:
Version Fixed In:
Sentry Crash Report:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description 4aa7f31e 2018-01-28 23:59:10 UTC
I installed okular on Ubuntu 17.10 via snap (“sudo snap install okular”). The okular snap seems to use “strict” confinement and is thus unable to access files outside the user’s home directory even for reading. However, for a “viewer”-type application like okular, this is very problematic:

– When downloading a file (e.g. PDF) in a browser like Firefox and choosing to open the file (instead of saving it somewhere in the home directory), the browser will typically place the file in /tmp/ and then open it using the default viewer for that file type. Since /tmp/ is outside the user’s home directory, okular is unable to open the file.

– When opening documentation which is installed to system directories (e.g. /usr/share/…) along with its corresponding application, okular is likewise unable to open the documentation files for viewing. For example, the “texdoc” program for the TeX typesetting system looks up the documentation for a specified package (typically in PDF format) and runs the default (PDF) viewer to show the documentation. This fails if the okular snap application is set as the default PDF viewer.

– Any files on mounted file systems, such as external storage (USB drives, SD cards, external hard drives…), network shares, etc., cannot be viewed with okular.

Attempting to open any such files results in a dialog with the following error message: “Could not open file:///path/to/file”. This does not provide any explanation for the reason of the failure.
Comment 1 Albert Astals Cid 2018-01-29 00:15:47 UTC
Where did you download that snap package from?
Comment 2 4aa7f31e 2018-01-29 00:18:15 UTC
(In reply to Albert Astals Cid from comment #1)
> Where did you download that snap package from?

Um, as I said, on Ubuntu 17.10 using “sudo snap install okular”. So from whatever source “snap” uses by default on a standard Ubuntu installation.
Comment 3 Nate Graham 2018-01-29 04:14:10 UTC
Sounds like an issue with how the Snap is packaged. I'd recommend reporting this to Ubuntu.
Comment 4 4aa7f31e 2018-01-29 12:30:21 UTC
I’m sorry, but I was under the impression that the point of snaps was to have “universal” packages, which work on any distribution and are not customized for any particular one. “snap info okular” gives me the following output:


name:      okular
summary:   Universal document viewer
publisher: kde
contact:   https://www.kde.org
description: |
  Okular is a universal document viewer developed by KDE. Okular works on
  multiple platforms, including but not limited to Linux, Windows, Mac OS X,
  \*BSD, etc.
  
  Features:
  
  - Supported Formats: PDF, PS, Tiff, CHM, DjVu, Images, DVI, XPS, ODT, Fiction
  Book, Comic Book, Plucker, EPub, Fax
  - Sidebar with contents, thumbnails, reviews and bookmarks
  - Annotations support
snap-id: SfUqQ280Y4bJ0k64qtBKTTXq5ml46tvQ
commands:
  - okular
tracking:    stable
installed:   16.12.3 (3) 7MB -
refreshed:   2017-03-27 12:56:54 +0200 CEST
channels:                        
  stable:    16.12.3        (3)  7MB -
  candidate: 17.04.3        (5)  8MB -
  beta:      17.04.3        (5)  8MB -
  edge:      master+782a5fe (27) 5MB -


I’ve also checked that the .snap file I got through “snap install okular” is identical to the one which can be downloaded here:
https://uappexplorer.com/snap/ubuntu/okular

The snap package lists “contact: https://www.kde.org”, which is why I opened a bug report here. If this is not an “official” okular snap package, then who is responsible for it?

In this bug: https://bugs.kde.org/show_bug.cgi?id=378130
the reporter was in the same situation (“sudo snap install okular” on Ubuntu) and it seems that there was no problem resolving it at this level.
Comment 5 Nate Graham 2018-01-29 14:04:08 UTC
Yes, but the devil's in the details. Snaps and Flatpaks are indeed supposed to be universal packages, but who packages them? Since this is a packaging but, that piece of information ins important. If we the developers package them, then we're responsible for the packaging. But if Ubuntu (or someone else) packages them, then they're responsible for the packaging.

Bug 378130 was marked as RESOLVED UPSTREAM, you'll notice.
Comment 6 bark mallard 2019-05-15 10:23:30 UTC
I also have this bug.

I installed Okular via snap just a few weeks ago. I am unable to open files that are not under /home.

It is notable that, when I use the Okular > File > Open dialog, I cannot either navigate to other folders or see pdfs in folders other than home.

In particular, the Okular file dialog refuses to enter the /mnt or /media directories. It will go into /tmp, yet when it gets there it cannot see any .pdf file I've put there. In fact, it cannot see any file there.

Nate's contribution implies the problem might be an upstream bug caused by snap failing to manage dependencies. And indeed I did find it necessary to follow the install steps given in Bug 378130 in order to install Okular properly. But fixing the dependencies by the procedure suggested does not fix this particular bug. Okular is still unable to open files that are not in my Home folder.
Comment 7 bark mallard 2019-05-15 10:29:23 UTC
By the way, Okular will neither open a pdf if I navigate to it from my home folder by way of symbolic link to another drive.

Neither will it open a direct symbolic link to a pdf in my /tmp directory, if i put that symbolic link in my /home folder, and attempt to open it there with Okular.
Comment 8 Scarlett Moore 2023-05-17 16:11:17 UTC
Hi, removable-media was added for access to USB drives etc. The only way to achieve what you want for the rest is --classic which gives it access to the whole system thus defeating the purpose of confinement. I am not convinced I want to do that. I will take a look at the firefox snap to see how they handle /tmp as I have another snap having issues here. Thanks for reporting ( sorry for delay, I only recently took over snaps )
Comment 9 Scarlett Moore 2023-10-20 13:44:05 UTC
The latest snap in the snap store 23.08.2 allows for more access to files. All removeable-media ( usb drives, hard-drives etc ) & /usr/share/doc
Access to /tmp is disabled per snapd upstream as snaps have their own /tmp in /tmp/<snap>

Scarlett