From: smcv@debian.org   
      
   Control: reopen 1127935   
      
   On Thu, 19 Feb 2026 at 19:31:18 +0200, Faidon Liambotis wrote:   
   >retitle 1127935 evince: AppArmor profile doesn't allow running bwrap   
   ...   
   >When opening evince, without opening a particular file (just the main   
   >screen) I get 64 of these warnings, one for every recent document:   
   >  ** (evince:49238): WARNING **: 19:21:12.499: Failed to save thumbnail file   
   file:///...: Could not spawn `"bwrap" "--unshare-all" ... --seccomp" "89"   
   "/usr/libexec/glycin-loaders/2+/glycin-image-rs" "--dbus-fd" "87"`: Permission   
   denied (os error 13)   
      
   Yes, this is an example of a general problem with AppArmor: it's easy   
   for an AppArmor profile to be overly sensitive to implementation   
   details, such as whether gdk-pixbuf loads/saves files directly or in a   
   sandboxed helper. This is certainly a bug in the profile, whether RC or   
   not.   
      
   If you want to repurpose this bug report to track that, to be useful for   
   that purpose it will need to be reopened; doing that now.   
      
   >severity 1127935 serious   
      
   I'm not convinced this is a serious Policy violation, but I'll let   
   someone more involved with evince maintenance make that decision.   
      
        smcv   
      
   --- SoupGate-Win32 v1.05   
    * Origin: you cannot sedate... all the things you hate (1:229/2)