6

Problem

On my machine (Ubuntu 18.04), I am able to view man pages normally in the console.

However, I cannot seem to get man --html (man -H) or man --gxditview (man -X) to work.

Might anyone have any inklings as to what is wrong?

Related Posts

Potential Workarounds

I'm guessing that I could use something like man2html in other posts, but if possible, would prefer to know how to fix the "builtin" setup first.

There's also yelp man:cp, suggested from the above-linked post, which looks uber nice, so will probably stick with that for now (but hope that xref's are there...)

Reproduction

I have "minimized" my environment variables using the following command:

$ alias bash-isolate='env -i HOME=$HOME DISPLAY=$DISPLAY SHELL=$SHELL TERM=$TERM USER=$USER PATH=/usr/local/bin:/usr/bin:/bin bash --norc'
$ bash-isolate

# In isolated session
$ env | sort
DISPLAY=:1
HOME=/home/eacousineau
PATH=/usr/local/bin:/usr/bin:/bin
PWD=/home/eacousineau
SHELL=/bin/bash
SHLVL=1
TERM=screen
USER=eacousineau
_=/usr/bin/env

All of my examples will be posted starting from this environment.

Here's showing that man normally works:


$ man cp | head -n 4
CP(1)                                       User Commands                                      CP(1)

NAME
       cp - copy files and directories

However, when I try to call man --html=/usr/bin/firefox or man --gxditview, I get the following:

$ which groff
/usr/bin/groff

$ firefox
# A window opens up fine and dandy.

$ man --html=/usr/bin/firefox cp
Unable to init server: Could not connect: Connection refused
Error: cannot open display: :1
man: couldn't execute any browser from /usr/bin/firefox

$ gxditview
# A window opens up fine and dandy, also.

$ man --gxditview cp
groff: gxditview: Signal 31 (core dumped)
man: command exited with status 1: (cd /usr/share/man && /usr/lib/man-db/zsoelim) | (cd /usr/share/man && /usr/lib/man-db/manconv -f UTF-8:ISO-8859-1 -t UTF-8//IGNORE) | (cd /usr/share/man && preconv -e UTF-8) | (cd /usr/share/man && tbl) | (cd /usr/share/man && groff -mandoc -TX75 -X)

If I run the same commands, but precede them with export MAN_DISABLE_SECCOMP=1, I see no difference in behavior:

$ export MAN_DISABLE_SECCOMP=1
$ env | sort
DISPLAY=:1
HOME=/home/eacousineau
MAN_DISABLE_SECCOMP=1
PATH=/usr/local/bin:/usr/bin:/bin
PWD=/home/eacousineau
SHELL=/bin/bash
SHLVL=1
TERM=screen
USER=eacousineau
_=/usr/bin/env

$ man --html=/usr/bin/firefox cp
# Same as above.
$ man --gxditview cp
# Same as above.

I also tried haphazardly using xhost + and xhost +local:root (and quickly calling xhost - / xhost -local:root and terminating those sessions thereafter), but found the same behavior.

2 Answers 2

Reset to default
4

Fix for Ubuntu 18.04.4 LTS

Running

BROWSER=firefox man --html cp

in one terminal window and

tail -f /var/log/syslog

in another window revealed the following output in my VM:

Jun 20 22:25:00 redacted kernel: [186784.927254] audit: type=1400 audit(1592684700.904:81): apparmor="DENIED" operation="file_inherit" profile="man_groff" name="/tmp/hmanwJkIBp/cp.html" pid=6943 comm="preconv" requested_mask="w" denied_mask="w" fsuid=1000 ouid=1000
Jun 20 22:25:00 redacted kernel: [186784.960191] audit: type=1400 audit(1592684700.936:82): apparmor="DENIED" operation="file_inherit" profile="man_groff" name="/tmp/hmanwJkIBp/cp.html" pid=6944 comm="tbl" requested_mask="w" denied_mask="w" fsuid=1000 ouid=1000
Jun 20 22:25:00 redacted kernel: [186785.004522] audit: type=1400 audit(1592684700.980:83): apparmor="DENIED" operation="file_inherit" profile="man_groff" name="/tmp/groff-regions-GzqhRi" pid=6952 comm="troff" requested_mask="w" denied_mask="w" fsuid=1000 ouid=1000
Jun 20 22:25:01 redacted kernel: [186785.022296] audit: type=1400 audit(1592684700.992:84): apparmor="DENIED" operation="open" profile="man_groff" name="/etc/papersize" pid=6952 comm="troff" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
Jun 20 22:25:01 redacted kernel: [186785.652245] audit: type=1400 audit(1592684701.628:85): apparmor="DENIED" operation="connect" profile="/usr/bin/man" pid=6958 comm="firefox" family="unix" sock_type="stream" protocol=0 requested_mask="send receive connect" denied_mask="send connect" addr=none peer_addr="@/tmp/.X11-unix/X0" peer="unconfined"
Jun 20 22:25:01 redacted kernel: [186785.654920] audit: type=1400 audit(1592684701.632:86): apparmor="DENIED" operation="connect" profile="/usr/bin/man" pid=6961 comm="firefox" family="unix" sock_type="stream" protocol=0 requested_mask="send receive connect" denied_mask="send connect" addr=none peer_addr="@/tmp/.X11-unix/X0" peer="unconfined"

meaning apparmor and the profiles man_groff and /usr/bin/man are somehow involved in the non-functioning command.

Running sudo aa-status | grep man indeed outputs:

   /usr/bin/man
   /usr/lib/connman/scripts/dhclient-script
   man_filter
   man_groff

To disable the man profile and remove the AppArmor definition from the kernel, run

sudo ln -s /etc/apparmor.d/usr.bin.man /etc/apparmor.d/disable/
sudo apparmor_parser -R /etc/apparmor.d/usr.bin.man

and verify the output of sudo aa-status | grep man again. The entries /usr/bin/man, man_filter and man_groff should be gone.

Then run

BROWSER=firefox man --html cp

or

man --html=firefox cp

or

MAN_DISABLE_SECCOMP=1 man --gxditview cp

and enjoy.

Note: I never used AppArmor before and didn't even know it was active in my Ubuntu VM. These links provided me with the information to disable the profile:

  • AppArmor (Ubuntu community documentation)
  • AppArmor (Ubuntu server documentation)
1
  • Sweet, thanks! From skimming /etc/apparmor.d/usr.bin.man, I dunno the full rationale behind the conservative approach (e.g. the attack surface), but your commands worked - and thank you for the thorough detail!
    – Eric Cousineau
    Jun 21, 2020 at 23:29
0

If you don't want to completely disable the default AppArmor profile at /etc/apparmor.d/usr.bin.man, you can either edit to add the needed missing rules, or create an override at /etc/apparmor.d/local/usr.bin.man

Using a combination of aa-notify, aa-logprof and similar tools, as described in this excellent tutorial from Ubuntu, you can find the needed rules:

# Needed by /usr/bin/man main profile:
#include <abstractions/nameservice>
capability sys_admin,

# Needed by man_groff child profile:
#include <abstractions/user-tmp>
/etc/papersize r,

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .