delegate security policy

[pgajdos]

I have

$ convert terminal-distrobox-icon.svg -resize 16x16 terminal-distrobox-icon.png
convert: attempt to perform an operation not allowed by the security policy `inkscape' @ error/delegate.c/ExternalDelegateCommand/387.
$

So I did fx.

  <policy domain="delegate" rights="none" pattern="*"/>
  <policy domain="delegate" rights="read|write" pattern="inkscape"/>

or just

<policy domain="delegate" rights="read|write" pattern="*"/>

but that didn't helped. Only removing the delegate policy line works. What is the current recommendation?

[fmw42]

You should have for svg:decode and using Inkscape if you installed inscape properly.

If that does not work, then modify it to put the full path to Inkscape

[pgajdos]

Hi ho Fred (@fmw42),

thank you for your reply. My intention for now is to relax

<policy domain="delegate" rights="none" pattern="*"/>

to allow inkscape delegate. Makes this sense? Is that possible and how, exactly?

Yes, when I use just

<policy domain="delegate" rights="read|write" pattern="/usr/bin/inkscape"/>

it is better and I can now decode svg images, but I assume I do not restrict other delegates. When I use

  <policy domain="delegate" rights="none" pattern="*"/>
  <policy domain="delegate" rights="read|write" pattern="/usr/bin/inkscape"/>

the command in question fails with the policy error again. Please pardon my ignorance and elaborate on svg:decode, didn't get it.

[fmw42]

You misunderstand

<policy domain="delegate" rights="none" pattern="*"/>

That prevents users from executing any image filters.

And

<policy domain="path" rights="read" pattern="/repository/*" />

I believe means that the glob expression is used to match all paths that start with /repository, where you have to fill in some delegate name as "repository"

[fmw42]

You should have for svg:decode and using Inkscape if you installed inscape properly.

When you run your magick image.svg ... etc
put in -verbose after magick, so magick -verbose image.svg ... etc

What do you get back? That should show what delegate is being used.

Also if you look in delegates.xml file, you should find something like

which shows Inkscape as being used for the command in the svg:decode line of the file.

[pgajdos]

Yep, I feel I didn't get something around. I just wanted to be close to policy-secure.xml as possible, so I wanted to keep

<policy domain="delegate" rights="none" pattern="*"/>

but allow exceptions, e. g. inkscape and others reasonable which would pop up along. If it is not possible, I will just remove this line and be done for now, as I do not have real requirement for this attitude yet. I will perhaps return to it later.

[laighside]

For anyone else looking for the answer to block all delegates except inkscape, this seems to work:

<policy domain="delegate" rights="none" pattern="*"/>
<policy domain="delegate" rights="execute" pattern="inkscape"/>

The rights to enable delegates are execute not read|write

[pgajdos]

Thanks @laighside