[moin-user] Can't index PDF attachments (bug?)

[Volker Wysk]

Am Montag, 3. Dezember 2018, 16:24:24 CET schrieb Paul Boddie:
> On Monday 3. December 2018 15.34.04 Volker Wysk wrote:
> > Am Montag, 3. Dezember 2018, 15:12:51 CET schrieb Thomas Waldmann:
> > > >> Is there some additional security framework active on that machine,
> > > >> like
> > > >> apparmor or selinux or posix ACLs or ...?
> > > > 
> > > > I'm not sure what you mean by "additional security framework".
> > > 
> > > Well, I gave some examples. Basically anything that may intercept/forbid
> > > file access.
> > 
> > And this thing should block access to the PDF attachments in the Moinmoin
> > database. Doesn't sound very plausible. Unless if Moinmoin would use
> > something like this, and it's a bug...
> 
> I can imagine SELinux causing a problem in a situation like this because it
> seems like Moin is expected to be able to run another program to perform the
> indexing (from my brief perusal of this thread). Anyone who has had to
> configure Web applications for SELinux will confirm that it is easy to miss
> some kind of permission or other that might be needed, either related to
> executing other programs or accessing network or file resources.

Moinmoin isn't part of my Linux distribution. I've installed it from a 
tarball. I doubt that it has been secured by SELinux or AppArmor.

> > > Ubuntu comes with apparmor, while some redhat (fedora?) dists come with
> > > selinux.
> > > 
> > > ACLs can be checked with the respective commands, see man acl.
> > 
> > Okay, thanks for the info. But I can't remember having done anything like
> > that. It's completely new to me.
> > 
> > The missing ability to search in attached PDF files isn't a show stopper
> > for me. I think I'll just leave it this way.
> > 
> > Thanks for your time. :-)
> 
> Which distribution are you using? 

Kubuntu 18.04.1 LTS

> If it is one of the Red Hat family
> (Fedora, CentOS, RHEL), it is entirely possible that SELinux is switched on
> by default and that you won't have made any decision about it. So it is
> worth checking in case you have other problems in future. I cannot comment
> about AppArmor, but that is also worth investigating for certain distros
> (Ubuntu, maybe SuSE).
> 
> I can't give quick answers about this because I run Debian and don't have
> these things enabled, but I hope you will be able to investigate further.

Hmmm... AppArmor *is* installed on my system, and it has active profiles. It 
must be the default for Kubuntu. I've shortly tried to see what is protected 
by it, but I couldn't find out how.

Still, I don't think that it is able to apply to manually installed software.

Bye
Volker