ImageMagick

[Pavel Sanda]

On Tue, May 05, 2026 at 08:01:54PM +0200, Jürgen Spitzmüller wrote:
> Am Dienstag, dem 05.05.2026 um 17:38 +0200 schrieb Pavel Sanda:
> > On what distro and what exact conversion fails for you?
> 
> OpenSuse Tumbleweed.
> 
> PNG to EPS conversion fails here (and probably vice versa).
> 
> > Different distros have different approaches how the deal with IM
> > policies.
> > For some time or pdf/eps/svg convertors were widely banned, then this
> > relaxed little bit. It might be get more strict again, but as far as
> > I could see on debian, they are nowadays rather trying fix large
> > number of CVEs than killing the conversion delegates altogether. In
> > any case it's not entirely new situation and you might need to
> > personally relax IM policies on your computer to
> > have full IM power.
> 
> They provide five different policies. The only one that works for me is
> the "open" policy, descibred as follows:
> 
> "This policy is designed for usage in secure settings like those
> protected by firewalls or within Docker containers."

I see it's similar to debian open policy (I think that's still the default). I would
expect that for server layouts for ubuntu and similar the strict version will be chosen.

Second option is to directly edit /etc/ImageMagick-7/policy.xml (or at similar
location) and allow only the delegates of interest (in lyx's case that's mainly
eps/pdf). That's what I used to do when IM policies were more strict 
(at that time triggered actually by ghostscript vulnerabilities).

Pavel