3

Problem

On my machine (Ubuntu 18.04), I am able to view man pages normally in the console.

However, I cannot seem to get man --html (man -H) or man --gxditview (man -X) to work.

Might anyone have any inklings as to what is wrong?

Related Posts

Potential Workarounds

I'm guessing that I could use something like man2html in other posts, but if possible, would prefer to know how to fix the "builtin" setup first.

There's also yelp man:cp, suggested from the above-linked post, which looks uber nice, so will probably stick with that for now (but hope that xref's are there...)

Reproduction

I have "minimized" my environment variables using the following command:

$ alias bash-isolate='env -i HOME=$HOME DISPLAY=$DISPLAY SHELL=$SHELL TERM=$TERM USER=$USER PATH=/usr/local/bin:/usr/bin:/bin bash --norc'
$ bash-isolate

# In isolated session
$ env | sort
DISPLAY=:1
HOME=/home/eacousineau
PATH=/usr/local/bin:/usr/bin:/bin
PWD=/home/eacousineau
SHELL=/bin/bash
SHLVL=1
TERM=screen
USER=eacousineau
_=/usr/bin/env

All of my examples will be posted starting from this environment.

Here's showing that man normally works:


$ man cp | head -n 4
CP(1)                                       User Commands                                      CP(1)

NAME
       cp - copy files and directories

However, when I try to call man --html=/usr/bin/firefox or man --gxditview, I get the following:

$ which groff
/usr/bin/groff

$ firefox
# A window opens up fine and dandy.

$ man --html=/usr/bin/firefox cp
Unable to init server: Could not connect: Connection refused
Error: cannot open display: :1
man: couldn't execute any browser from /usr/bin/firefox

$ gxditview
# A window opens up fine and dandy, also.

$ man --gxditview cp
groff: gxditview: Signal 31 (core dumped)
man: command exited with status 1: (cd /usr/share/man && /usr/lib/man-db/zsoelim) | (cd /usr/share/man && /usr/lib/man-db/manconv -f UTF-8:ISO-8859-1 -t UTF-8//IGNORE) | (cd /usr/share/man && preconv -e UTF-8) | (cd /usr/share/man && tbl) | (cd /usr/share/man && groff -mandoc -TX75 -X)

If I run the same commands, but precede them with export MAN_DISABLE_SECCOMP=1, I see no difference in behavior:

$ export MAN_DISABLE_SECCOMP=1
$ env | sort
DISPLAY=:1
HOME=/home/eacousineau
MAN_DISABLE_SECCOMP=1
PATH=/usr/local/bin:/usr/bin:/bin
PWD=/home/eacousineau
SHELL=/bin/bash
SHLVL=1
TERM=screen
USER=eacousineau
_=/usr/bin/env

$ man --html=/usr/bin/firefox cp
# Same as above.
$ man --gxditview cp
# Same as above.

I also tried haphazardly using xhost + and xhost +local:root (and quickly calling xhost - / xhost -local:root and terminating those sessions thereafter), but found the same behavior.

2

Fix for Ubuntu 18.04.4 LTS

Running

BROWSER=firefox man --html cp

in one terminal window and

tail -f /var/log/syslog

in another window revealed the following output in my VM:

Jun 20 22:25:00 redacted kernel: [186784.927254] audit: type=1400 audit(1592684700.904:81): apparmor="DENIED" operation="file_inherit" profile="man_groff" name="/tmp/hmanwJkIBp/cp.html" pid=6943 comm="preconv" requested_mask="w" denied_mask="w" fsuid=1000 ouid=1000
Jun 20 22:25:00 redacted kernel: [186784.960191] audit: type=1400 audit(1592684700.936:82): apparmor="DENIED" operation="file_inherit" profile="man_groff" name="/tmp/hmanwJkIBp/cp.html" pid=6944 comm="tbl" requested_mask="w" denied_mask="w" fsuid=1000 ouid=1000
Jun 20 22:25:00 redacted kernel: [186785.004522] audit: type=1400 audit(1592684700.980:83): apparmor="DENIED" operation="file_inherit" profile="man_groff" name="/tmp/groff-regions-GzqhRi" pid=6952 comm="troff" requested_mask="w" denied_mask="w" fsuid=1000 ouid=1000
Jun 20 22:25:01 redacted kernel: [186785.022296] audit: type=1400 audit(1592684700.992:84): apparmor="DENIED" operation="open" profile="man_groff" name="/etc/papersize" pid=6952 comm="troff" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
Jun 20 22:25:01 redacted kernel: [186785.652245] audit: type=1400 audit(1592684701.628:85): apparmor="DENIED" operation="connect" profile="/usr/bin/man" pid=6958 comm="firefox" family="unix" sock_type="stream" protocol=0 requested_mask="send receive connect" denied_mask="send connect" addr=none peer_addr="@/tmp/.X11-unix/X0" peer="unconfined"
Jun 20 22:25:01 redacted kernel: [186785.654920] audit: type=1400 audit(1592684701.632:86): apparmor="DENIED" operation="connect" profile="/usr/bin/man" pid=6961 comm="firefox" family="unix" sock_type="stream" protocol=0 requested_mask="send receive connect" denied_mask="send connect" addr=none peer_addr="@/tmp/.X11-unix/X0" peer="unconfined"

meaning apparmor and the profiles man_groff and /usr/bin/man are somehow involved in the non-functioning command.

Running sudo aa-status | grep man indeed outputs:

   /usr/bin/man
   /usr/lib/connman/scripts/dhclient-script
   man_filter
   man_groff

To disable the man profile and remove the AppArmor definition from the kernel, run

sudo ln -s /etc/apparmor.d/usr.bin.man /etc/apparmor.d/disable/
sudo apparmor_parser -R /etc/apparmor.d/usr.bin.man

and verify the output of sudo aa-status | grep man again. The entries /usr/bin/man, man_filter and man_groff should be gone.

Then run

BROWSER=firefox man --html cp

or

man --html=firefox cp

or

MAN_DISABLE_SECCOMP=1 man --gxditview cp

and enjoy.


Note: I never used AppArmor before and didn't even know it was active in my Ubuntu VM. These links provided me with the information to disable the profile:

  • AppArmor (Ubuntu community documentation)
  • AppArmor (Ubuntu server documentation)
  • Sweet, thanks! From skimming /etc/apparmor.d/usr.bin.man, I dunno the full rationale behind the conservative approach (e.g. the attack surface), but your commands worked - and thank you for the thorough detail! – Eric Cousineau Jun 21 '20 at 23:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.