linux-kernel - Re: make pdfdocs fails on Debian stable

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <2fb003aa-545c-31a4-1466-8c3c3fc708fb@gmail.com>
Date:   Tue, 4 Jan 2022 22:46:57 +0900
From:   Akira Yokosawa <akiyks@...il.com>
To:     Christoph Hellwig <hch@....de>
Cc:     corbet@....net, linux-doc@...r.kernel.org,
        linux-kernel@...r.kernel.org, mchehab@...nel.org
Subject: Re: make pdfdocs fails on Debian stable

On Tue, 4 Jan 2022 14:19:52 +0100, Christoph Hellwig wrote:
> On Tue, Jan 04, 2022 at 06:31:01PM +0900, Akira Yokosawa wrote:
>> Hi, getting back to the error message, I remember seeing a similar error
>> when I failed to permit PDF output of ImageMagick.
>>
>> What I did back then was this (as root):
>>
>>  # cd /etc/ImageMagick-6  
>>  # sed -i 's+policy domain="coder" rights="none" pattern="PDF"+policy domain="coder" rights="read|write" pattern="PDF"+' policy.xml ; \
>>
>> In case this resolves your issue.
> 
> I've definitively seen permission denied errors earlier in the (rather
> noisy) build log.  But I absolutely do not feel comfortable changing
> global security policies for a kernel build, especially for something
> like ImageMagic that had its fair share of security issues.  Is there any
> way to side step this by using a different tool?
> 

See my pending patch set at:

    https://lore.kernel.org/linux-doc/e01fe9f9-f600-c2fc-c6b3-ef6395655ffe@gmail.com
    [PATCH v2 0/4] docs: sphinx/kfigure.py: Improve conversion to PDF

This uses Inkscape if it is available instead of ImageMagick.
No imagemagick nor librsvg2-bin is required.
As long as if you can trust Inkscape...

Good luck!

        Thanks, Akira