Trusted PDF conversion fails on debian and fedora appVMs

When ever I try and convert a PDF to a trusted version the process fails, has anyone experienced similar or know how to resolve?

from the nautilus context menu I get the error

Denied: Qubes.PdfConvert
Denied Qubes.PdfConvert from [any AppVM] to @dispvm

If I use the command line qvm-convert-pdf it’s a little more verbose

$ qvm-convert-pdf <any_pdf>.pdf
Sending file to Disposable VM…

<any_pdf>.pdf…0/?Request refused
<any_pdf>.pdf…fail

error: <any_pdf>.pdf: Failed to receive page count

Total Sanitized Files: 0/1

(where <any_pdf> is any PDF I have tested to date)

Environment

  • Qubes 4.1.1
  • AppVM: Fedora 36
  • AppVM: Debian 11

Hello and welcome to community. What’s the content of your /etc/qubes-rpc/policy/qubes.PdfConvert and what’s your default dispVM?
Also there’s no name of the qube where original pdf resided, looking at what you “pasted” above?

What’s the content of your /etc/qubes-rpc/policy/qubes.PdfConvert

contents are: $anyvm $dispvm allow

what’s your default dispVM?

default dispVM is the detault installed fedora-36-dvm which uses a clone of the fedora-36 template

Also there’s no name of the qube where original pdf resided

Hmm, the forum software filtered it out when I used angle brackets , I’ve updated it but source VM is any VM I have installed

What happens when you change default dvm to, for example, debian-11-dvm? And, what exactly means which uses a clone of the fedora-36 template"? That dvm-template is based on clone of fedora-36?

1 Like

And why didnt I think of that, I see the problem now. In qubes managerglobel settings the default VM was listed as object at 0x....... (sorry I dont have the full message as it disappeared after switching to an actual named dvm). Changing that to fedora-36-dvm (or whonix-ws-dvm) and things are behaving as expected.

Interesting that this was only causing issue with PDF conversion (didn’t have need to try image conversion), regular view/edit in disposableVM was working fine.

And, what exactly means which uses a clone of the fedora-36 template

I cloned the pre-installed fedora-36 template to fedora-36-live and was using the latter for all my templates

1 Like

Great.

Please mark the post solution so it could help other users too.