Bug#1127935: evince: Additional debugging: userns_create denial affects both Evince and Papers

Package: evince
Version: 48.1-3+deb13u1
Followup-For: Bug #1127935

Dear Maintainer,

Hello,

I investigated this issue further on Debian 13 (Trixie) and found what appears to be the underlying AppArmor denial.

My environment:

* Debian 13 (Trixie)
* AppArmor 4.1.0-1
* Evince 48.1-3+deb13u1
* Papers (Debian package)
* Brave Browser (official Brave APT repository)

Brave was configured as the default browser and worked correctly when launched directly or via:

```
gio open https://www.debian.org
```

However, clicking hyperlinks from both Evince and Papers failed.

The kernel audit log consistently reported:

```
apparmor="DENIED" operation="userns_create" class="namespace"
profile="/usr/bin/evince//sanitized_helper"
comm="brave"
```

and similarly:

```
apparmor="DENIED" operation="userns_create" class="namespace"
profile="/usr/bin/papers//sanitized_helper"
comm="brave"
```

During debugging I found that both Evince and Papers transition into the shared AppArmor profile `sanitized_helper`, defined in:

```
/etc/apparmor.d/abstractions/ubuntu-helpers
```

As a local test, I added the following rule inside `profile sanitized_helper`:

```
userns,
```

Then I reloaded the affected profiles:

```
sudo apparmor_parser -r /etc/apparmor.d/usr.bin.evince
sudo apparmor_parser -r /etc/apparmor.d/usr.bin.papers
```

After that:

* Evince correctly opens hyperlinks in Brave.
* Papers correctly opens hyperlinks in Brave.
* The `userns_create` AppArmor denials disappeared.

This suggests that the underlying issue may be the missing `userns` permission in the shared `sanitized_helper` AppArmor profile when launching Chromium-based browsers.

I hope this additional information is useful. If needed, I can provide additional logs or perform further testing.

Best regards,

Jarosław Ryś







-- System Information:
Debian Release: 13.6
  APT prefers stable-updates
  APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500, 'stable')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 6.12.100+deb13-amd64 (SMP w/12 CPU threads; PREEMPT)
Locale: LANG=pl_PL.UTF-8, LC_CTYPE=pl_PL.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages evince depends on:
ii  dconf-gsettings-backend [gsettings-backend]  0.40.0-5
ii  evince-common                                48.1-3+deb13u1
ii  gsettings-desktop-schemas                    48.0-1
ii  libatk1.0-0t64                               2.56.2-1+deb13u1
ii  libc6                                        2.41-12+deb13u3
ii  libcairo-gobject2                            1.18.4-1+b1
ii  libcairo2                                    1.18.4-1+b1
ii  libevdocument3-4t64                          48.1-3+deb13u1
ii  libevview3-3t64                              48.1-3+deb13u1
ii  libgdk-pixbuf-2.0-0                          2.42.12+dfsg-4+deb13u1
ii  libglib2.0-0t64                              2.84.4-3~deb13u3
ii  libgnome-desktop-3-20t64                     44.3-3
ii  libgtk-3-0t64                                3.24.49-3
ii  libhandy-1-0                                 1.8.3-2
ii  libpango-1.0-0                               1.56.3-1
ii  libpangocairo-1.0-0                          1.56.3-1
ii  libsecret-1-0                                0.21.7-1
ii  shared-mime-info                             2.4-5+b2

Versions of packages evince recommends:
ii  dbus-user-session [default-dbus-session-bus]  1.16.2-2

Versions of packages evince suggests:
ii  gvfs             1.57.2-2+deb13u1
pn  nautilus-sendto  <none>
ii  poppler-data     0.4.12-1

-- no debconf information