Limit ImageMagick read/write access to a particular directory

[BlackBeardie]

Hello good people!
I am using the default installation of ImageMagick-6 that ships with Ubuntu 18.04.

Using the policy.xml file, is there a way to limit read/write by ImageMagick to a directory of my choosing?

This policy line blocks all access if enabled and grants access to all directories if disabled by remming it out.

Thank you.

[urban-warrior]

You should be able to deny all paths with a policy that has an access rights of none and a wildcard path of '*'. You can then allow a particular path by following the deny policy with a allow policy, that is rights are enabled and a particular path is enabled. Try it. If you run into any problems, let us know.

[BlackBeardie]

Hi urban-warrior,
Thank you for your reply. The deny everything works fine using the rights = "none". However I then cannot seem to allow access to a specific directory using rights = " read | write "

error:

convert-im6.q16: not authorized @/home/zephyr/lamp_mon/test_inside.txt' @ error/property.c/InterpretImageProperties/3516. convert-im6.q16: no images defined /home/zephyr/lamp_mon/inside_label.gif' @ error/convert.c/ConvertImageCommand/3258.

Please see my attached test sheet for further clarification. Thank you for looking into this.
Best regards,
Zephyr
test_results_imgk_policy.pdf

[urban-warrior]

This works for us:

  <policy domain="path" rights="none" pattern="*" />
  <policy domain="path" rights="all" pattern="/opt/tmp/*" />

returns

$ cd /tmp
$ convert logo: logo.miff
convert: attempt to perform an operation not allowed by the security policy `logo.miff' @ error/blob.c/OpenBlob/3289.

whereas this command writes and reads the image without complaint:

$ convert logo: /opt/tmp/logo.miff
$ identify /opt/tmp/logo.miff
/opt/tmp/logo.miff MIFF 640x480 640x480+0+0 8-bit Palette sRGB 256c 308343B 0.010u 0:00.004

If that doesn't work for you, you may have an older version of ImageMagick that does not support policy ordering.

[BlackBeardie]

Thank you for getting back to me so quickly.
This still did not work for me.


test
zephyr@zephyr-desktop:~$ convert -background lightblue -fill red \

label:@/home/zephyr/test_outside.txt /home/zephyr/outside_label.gif;
result
convert-im6.q16: not authorized `@/home/zephyr/test_outside.txt' @ error/property.c/InterpretImageProperties/3516.

It is probably as you say the version of ImageMagick-6 I have, doesn't support this policy ordering. I will upgrade my version and get back to you.
Thank you for all your help!
Best wishes,

[BlackBeardie]

Hi urban-warrior,
I have decided to stick with ImageMagick-6 because it comes with Ubuntu 18.04 and is available on the debian repository (apt-cache search imagemagick-6)

I managed to secure it by creating a directory in the root with
$ sudo mkdir /lamp_mon
then changing ownership of the directory to the logged on user and his/her groups with
$ chown $USER -R /lamp_mon
I then edited the policy.xml and blocked all other top level directories with
sudo nano /etc/ImageMagick-6/policy.xml
and put in the following

etc .. on every top level directory.

You can block out other top level directories in this way.
The convert command of Imagemagick-6 runs happily in only /lamp_mon which is sufficient for my app.
Thank you very much for all your help! Best wishes, BlackBeardie

[AlexLaforge]

Hi @BlackBeardie , in your comment, we cannot see "what" you have put on every top level directory... It could be useful to me, still having to deal with an ImageMagick version 6 not implementing policy ordering yet. Thank you in advance ! :)