Problem with thumbnailer hardening and debian alternative mechanism
Since the hardening of the thumbnailer creation with bwrap
(well done), most of my thumbnailers stopped working.
The main problem was the unmerged /bin (already fixed, although Ubuntu missed the patch), but still I have problems with application managed under the alternative mechanism of Debian. For example, I use composite
, from imagemagick
, a lot, and in my system I have
/usr/bin/composite -> /etc/alternatives/composite
/etc/alternatives/composite -> /usr/bin/composite-im6.q16
...and the symlink obviously fails when called through bwrap
.
I am not sure about the solution; adding
--ro-bind /etc/alternatives /etc/alternatives
to the bwrap
call seems to fix the problem.
Edited by Jeff Fortin