Ubuntu: Fix Imagemagick "not authorized" exception

Over the last few days we've had a couple of issues with Imagick and processing PDFs on our servers. As it turns out, these issues are caused by automatic security updates. Let's look into the issue and its solution. In Bugsnag, our error reporting service, the following exceptions have been popping up a lot: not authorized `/path/to/some-pdf.pdf` @ error/constitute.c/ReadImage/412 convert: not authorized `/path/to/some-pdf.pdf` @ error/constitute.c/WriteImage/1028 not authorized `/path/to/some-image.png` @ error/convert.c/ConvertImageCommand/3015 unable to create temporary file `/some/path` Permission denied @ error/pdf.c/ReadPDFImage/465 Upon further investigation it looks like most of our sites and applications dealing with PDFs were actually experiencing issues. The weird thing is, some of these applications are quite old and haven't been updated or even touched for months, whilst others are recent and running the latest versions of packages and OS. I don't care about your problems, just give me the fix! A recent ImageMagick security update adds some extra policies regarding PDFs (or more specifcally: Ghostscript). We can actually see the diff for this update right here. Luckily, we can edit the policy.xml file ourselves and loosen up security for working with PDFs. In /etc/ImageMagick-6/policy.xml (or /etc/ImageMagick/policy.xml) find the following line <policy domain="coder" rights="none" pattern="PDF" /> and change it to allow reading and writing by the PDF coder in ImageMagick: <policy domain="coder" rights="read|write" pattern="PDF" /> Finally, don't forget to restart your PHP-FPM and optionally queue workers: sudo service php7.2-fpm restart If you're experiencing issues with other file types or manipulations, you might need to change some of the other policies as well. The policy.xml file contains some good documentation in the comments. You can read more about the security policy file on ImageMagick's website.