494

The Imagemagick security policy seems to be not allowing me perform this conversion from pdf to png. Converting other extensions seem to be working, just not from pdf. I haven't changed any of the imagemagick settings since I installed it... I am using Arch Linux, if the OS matters.

user@machine $ convert -density 300 -depth 8 -quality 90 input.pdf output.png
convert: attempt to perform an operation not allowed by the security policy `PDF' @ error/constitute.c/IsCoderAuthorized/408.
convert: no images defined `output.png' @ error/convert.c/ConvertImageCommand/3288.
1

12 Answers 12

590

Well, I added

  <policy domain="coder" rights="read | write" pattern="PDF" />

just before </policymap> in /etc/ImageMagick-7/policy.xml and that makes it work again, but not sure about the security implications of that.

15
  • 7
    I believe that the PDF policy was added due to a bug in Ghostscript, which I believe has now been fixed. So it you are using the current Ghostscript, then you should be fine giving this policy read|write rights.
    – fmw42
    Nov 6 '18 at 21:43
  • 55
    I found the line <policy domain="coder" rights="none" pattern="{PS,PS2,PS3,EPS,PDF,XPS}" /> and just uncommented it to make it work.
    – jakob-r
    Dec 7 '18 at 12:18
  • 20
    The security vulnerability that caused distributions to implement the policy is referenced here: kb.cert.org/vuls/id/332928 Jan 8 '19 at 23:58
  • 41
    @jakob-r: I suppose you commented it out... ;-)
    – AstroFloyd
    Jan 14 '19 at 17:09
  • 2
    Make sure ghostscript is updated kb.cert.org/vuls/id/332928 Mar 5 '19 at 9:35
201

This issue is a workaround for a security vulnerability. The vulnerability has been addressed in Ghostscript 9.24 (source), so if you have that or a newer version, you don't need the workaround anymore.

On Ubuntu 19.10 through 21.04 and probably any later versions coming with ImageMagick 6, here's how you fix the issue by removing the workaround:

  1. Make sure you have Ghostscript ≥9.24:

    gs --version
    
  2. If yes, just remove this whole following section from /etc/ImageMagick-6/policy.xml:

    <!-- disable ghostscript format types -->
    <policy domain="coder" rights="none" pattern="PS" />
    <policy domain="coder" rights="none" pattern="PS2" />
    <policy domain="coder" rights="none" pattern="PS3" />
    <policy domain="coder" rights="none" pattern="EPS" />
    <policy domain="coder" rights="none" pattern="PDF" />
    <policy domain="coder" rights="none" pattern="XPS" />
    
7
  • 2
    Only fix that worked for me on Ubuntu 19.04 with gs 9.26.
    – ManuelTS
    Dec 20 '19 at 12:32
  • 47
    sed -i '/disable ghostscript format types/,+6d' /etc/ImageMagick-6/policy.xml worked fine for me. Jul 2 '20 at 15:41
  • 7
    Worked for Ubuntu 20.04
    – Alex K.
    Jul 9 '20 at 0:41
  • 2
    @Christophvh: It means you give ImageMagick full rights back to process files with Ghostscript. This restores the file to what it was before the this temporary workaround had to be introduced for a security issue that has now been fixed.
    – tanius
    Aug 1 '20 at 14:51
  • 1
    Worked on Ubuntu 21.04
    – Max N
    May 12 '21 at 16:32
162

As pointed out in some comments, you need to edit the policies of ImageMagick in /etc/ImageMagick-7/policy.xml. More particularly, in ArchLinux at the time of writing (05/01/2019) the following line is uncommented:

<policy domain="coder" rights="none" pattern="{PS,PS2,PS3,EPS,PDF,XPS}" />

Just wrap it between <!-- and --> to comment it, and pdf conversion should work again.

5
  • 1
    make sure ghostscript is up to date kb.cert.org/vuls/id/332928 Mar 5 '19 at 9:35
  • 22
    What's the point of this functionality? To prevent users from making PDFs? Mar 27 '19 at 1:22
  • 19
    Partially, yes. As ImageMagick is often used by websites to process uploaded files - and PDF is among one of the file formats which can basically contain any executable code - anyone with upload permissions could otherwise perform any task your web user has access to. Same if someone tricks you into personally converting a malicious PDF to any other format.
    – TwoD
    Apr 14 '19 at 10:37
  • 1
    I am outraged if the decision was prevent me from using my software because someone may find a way to cheat with it.
    – Gabriel
    Jun 16 '21 at 20:55
  • @Gabriel It was more about preventing people from feeding malicious PDFs to insufficiently sanitizing image upload fields. (i.e. "Hack their site through the thumbnailer when they never intended to support PDF and Postscript to begin with" situations.)
    – ssokolow
    Oct 8 '21 at 11:30
57

For me on Arch Linux, I had to comment this:

  <policy domain="delegate" rights="none" pattern="gs" />
3
  • On my system, there was two policy.xml files : /etc/ImageMagick-6/policy.xml and /etc/ImageMagick-7/policy.xml. Take care to edit the right one!
    – SylvainB
    Jun 3 '20 at 9:38
  • hanks, true!! ``` lang-js > yay -F /etc/ImageMagick-7/policy.xml etc/ImageMagick-7/policy.xml is owned by extra/imagemagick 7.0.10.30-1 > yay -F /etc/ImageMagick-6/policy.xml etc/ImageMagick-6/policy.xml is owned by extra/libmagick6 6.9.11.30-1 > yay -Rs libmagick6 checking dependencies... error: failed to prepare transaction (could not satisfy dependencies) :: removing libmagick6 breaks dependency 'libmagick6' required by inkscape ```
    – soloturn
    Dec 13 '20 at 0:55
  • Odd. I expected that making this rights="read|write" like other answers suggest would work, but also found that I needed to fully comment this out. For those familiar with xml, would be sweet to adjust your answer to show that "comment this" means to take <foo... /> and make it <!-- <foo... /> -->. Would spare the new user one extra search.
    – Hendy
    Nov 24 '21 at 22:59
38

For me on my archlinux system the line was already uncommented. I had to replace "none" by "read | write " to make it work.

3
24

Works in Ubuntu 20.04

Add this line inside <policymap>

<policy domain="module" rights="read|write" pattern="{PS,PDF,XPS}" />

Comment these lines:

  <!--
  <policy domain="coder" rights="none" pattern="PS" />
  <policy domain="coder" rights="none" pattern="PS2" />
  <policy domain="coder" rights="none" pattern="PS3" />
  <policy domain="coder" rights="none" pattern="EPS" />
  <policy domain="coder" rights="none" pattern="PDF" />
  <policy domain="coder" rights="none" pattern="XPS" />
   -->
1
  • 6
    Adding <policy domain="module" rights="read|write" pattern="{PS,PDF,XPS}" /> wasn't needed for me
    – leezu
    Nov 13 '20 at 4:41
14

On Ubuntu 19.10, I have done this in /etc/ImageMagick-6/policy.xml

uncomment this

<policy domain="module" rights="read | write" pattern="{PS,PDF,XPS}" />

and comment this

<!-- <policy domain="coder" rights="none" pattern="PDF" /> -->

After that, this command work without error

convert -thumbnail x300 -background white -alpha remove sample.pdf sample.png 
0
11

The ImageMagick change was kept after Ghostscript was fixed because applications (especially web applications) often feed arbitrary user-supplied files to ImageMagick, don't always enforce format restrictions properly, and, since Postscript (which PDF uses) is a turing-complete programming language running in a sandbox, there's always the possibility of another hole in the sandbox.

It's much better to leave things configured so ImageMagick refuses to process files that require running a program and, instead, just invoke Ghostscript directly when you intentionally want to permit Postscript rendering.

That would be accomplished by a Ghostscript command like this:

gs -dSAFER -r600 -sDEVICE=pngalpha -o foo.png myfile.pdf

Yes, this is a variation on the GhostScript command ImageMagic calls. (see ImageMagick's delegates.xml. -o is shorthand for -dBATCH -dNOPAUSE -sOutputFile=)

What's important is that ImageMagick stays locked down, you don't needlessly invoke an intermediate program, and you get more control over the rendering parameters. (eg. -r600 is the DPI to render at and changing -sDEVICE=pngalpha allows you to render directly to your desired format)

1
  • Wow, thanks for this really great and safe "workaround" for the issue; deserves more upvotes!
    – eMPee584
    Sep 5 '21 at 21:37
11

I was experiencing this issue with nextcloud which would fail to create thumbnails for pdf files.

However, none of the suggested steps would solve the issue for me.

Eventually I found the reason: The accepted answer did work but I had to also restart php-fpm after editing the policy.xml file:

 sudo systemctl restart php7.2-fpm.service
5
  • LOL. After hours trying almost every solution possible, this was the ultimate. In combination with @Stefan Seidel solution: <policy domain="coder" rights="read | write" pattern="PDF" /> Oct 19 '20 at 21:49
  • restarting php fpm was also needed for me
    – thindery
    Jan 13 '21 at 17:17
  • If you're using plesk the name of the service is plesk-php74-fpm
    – Tofandel
    Feb 2 '21 at 17:40
  • Thanks man, that helped a lot! Sep 27 '21 at 10:58
  • Thanks for this. In my case I had to reboot apache. Sep 30 '21 at 9:59
8

Adding to Stefan Seidel's answer.

Well, at least in Ubuntu 20.04.2 LTS or maybe in other versions you can't really edit the policy.xml file directly in a GUI way. Here is a terminal way to edit it.

  1. Open the policy.xml file in terminal by entering this command -

    sudo nano /etc/ImageMagick-6/policy.xml

  2. Now, directly edit the file in terminal, find <policy domain="coder" rights="none" pattern="PDF" /> and replace none with read|write as shown in the picture. Then press Ctrl+X to exit.

Edit in terminal

2
  • 1
    Remember to ctrl+O to save before you exit
    – tngotran
    Jun 1 '21 at 8:19
  • This worked for me, Ubuntu 21.04. Thanks!
    – rob grune
    Aug 1 '21 at 7:19
7

As a highly active comment by @Richard Kiefer, a simple fix is like this

$ sudo sed -i '/disable ghostscript format types/,+6d' /etc/ImageMagick-6/policy.xml
6

Manjaro April 2021

Just remove uncommented line inside <policymap> in /etc/ImageMagick-7/policy.xml

1
  • Thanks, that did it for me! Sep 3 '21 at 13:28

Not the answer you're looking for? Browse other questions tagged or ask your own question.