imagemagick - convert not allowed

Question

I have multiple *.jpeg pictures I like to merge into a single *.pdf file like so:

convert Blatt1.jpg Blatt2.jpg Blatt3.jpg Blatt4.jpg out.pdf

I am prompted with the following exception:

convert: attempt to perform an operation not allowed by the security policy `PDF' @ error/constitute.c/IsCoderAuthorized/408

What causes this problem and how can I fix it? I did some research but couldn't find anything about this particular problem.

Solution 1

ImageMagick has some security policies disabling some rights for security reasons. See why at the bottom of this answer.
You will have to edit a config file to re-enble the action you need.

Open /etc/ImageMagick-6/policy.xml with your favorite text editor, find the line <policy domain="coder" rights="none" pattern="PDF" /> and replace "none" by "read|write"

# Open the file 
sudo nano /etc/ImageMagick-6/policy.xml

# find and edit the line
<policy domain="coder" rights="none" pattern="PDF" />
# to :
<policy domain="coder" rights="read|write" pattern="PDF" />

About ImageMagick security policy
The restricted policy is made to prevent unknown vulnerabilities coming from third party software as Ghostscript used here for PDF files. Be sure to update Ghostscript.

• https://imagemagick.org/script/security-policy.php
• https://snyk.io/vuln/search?type=linux&q=ghostscript

Solution 2

Because of a known bug with security implications, the conversion to pdf is disabled in ImageMagick convert.

I suggest that you work around the problem,

• either
  • Import the pictures into LibreOfffice and save the document.
  • Export as pdf from LibreOffice.
• or

  • install img2pdf from the repository 'universe'

    sudo apt install img2pdf
    

    and run the following command line to create a pdf file with several pictures corresponding to the question or something similar for other cases,

    img2pdf --out out.pdf Blatt1.jpg Blatt2.jpg Blatt3.jpg Blatt4.jpg
    

  • There are details for fine tuning in the manual man img2pdf

Comments

[n00b.exe]

Perfect! Exactly what Iw as looking for! Thanks a lot!

[ssokolow]

Downvoted for suggesting an interactive replacement for a batch command which could easily have been excerpted from a larger script.

[ssokolow]

For anyone who winds up here, I recommend looking at the question this has been marked as a duplicate of. You really don't want to relax ImageMagick's security policy when there are alternatives that are both safer and more lossless than asking ImageMagick to decode JPEGs and then re-encode them as part of making a PDF.

[Sqerstet]

Disabling security limitations is just a bad idea, whether it works or not. ImageMagick thinks there is a security issue. Unless you know exactly what you are doing, the right thing to do here is use other software which is held to be secure by its own authors.

[cmak.fr]

@Sqerstet :have you red the imagemagick documentation about security policy.xml ? No... ImageMagick thinks there is a security issue. Nope, they do not. The restricted policy is made to prevent unknown vulnerabilities coming from third party software as Ghostscript used here for PDF files. If Ghostscript is up to date, then no (known) issue. Have a nice day and please, read, read, read

[Sqerstet]

Upvoted for not recommending people to break default security settings. Another option here: askubuntu.com/a/1210721/304983

[cmak.fr]

@Sqerstet : You confirm what I thought. Your previous comment is not based on information but on a belief. This site is a site of help and information, no place for convictions. If you don't have any information, don't write your beliefs. Thank you for the community.

[Sqerstet]

Since you chose to only read the first sentence, I have deleted it because it changes nothing. You are recommending users to disable settings which were set "for security reasons" (your words), without even explaining the implications. Sorry, but that is irresponsible.

[Lenne]

If I know I'm only going to process my own files, generated by my own scripts, I feel it is safe to disable the blockings. Is there a way to have multiple policies?

[Hermann Schwarz]

Additional info: be sure, you have installed GhostScript >= 9.26. After that you can play around with policy.xml suse.com/support/kb/doc/?id=000019384

[leftaroundabout]

@Sqerstet these default security settings are utterly irrelevant for most users. That's not to say they're useless: for those few users who run ImageMagick in some web service, it is a severe security issue, so the developers were certainly right to disable this just to enforce fixing the issue. But for anybody else who just uses ImageMagick with PDFs they have complete control over, it is much more sensible to re-enable it than to switch to a completely different tool, certainly one as badly suited for the task as LibreOffice. (Though, the only proper solution is to fix GhostScript...)

[Sqerstet]

@leftaroundabout You are almost certainly right but that's not the point. Recommending that people break default security settings is a terrible idea. As you say, the solution is to fix the problem. Or use alternatives, because apparently ImageMagick cannot properly maintain its software. The alternative I recommended was not LibreOffice.