Bug#418788: texlive-base-bin: dvips fails with \includegraphics outside current directory

[Frank Küster <frank@debian.org>]

retitle 418788 dvips: Needs better docs on including files with absolute pathnames
thanks

Norbert Preining <preining@logic.at> wrote:

> Hi Eric, hi all!
>
> On Mit, 11 Apr 2007, Eric Cooper wrote:
>> ("cat.eps" is from /usr/share/doc/texlive-doc/latex/rotating/
>> if "/tmp/cat.eps" is replaced by just "cat.eps", it works OK.
>> The dvips from tetex-bin handled pathnames just fine in this situation.)
>> 
>>     \documentclass{article}
>>     \usepackage[dvips]{graphics}
>>     \begin{document}
>>     \includegraphics{/tmp/cat.eps}
>>     \end{document}
>
> I cannot reproduce this with TeX Live 2007. Someone else have a TeX Live
> 2005 lying around?

Yes, the problem is there in TL 2005.  But it's really just a
documentation bug.

First thing is: 

How to learn which file to look in (it is
/etc/texmf/[texlive/]dvips/config.ps).  "info dvips" brings you there,
finally.  If you know for what to search (namely "absolute", not
"outside"), then it's the third hit.  But maybe Eric can give us a hint
how he would have found it more easily.

Second:  The comment says

% z1 is "secure", i.e., inhibits execution of `shell commands` in
% \specials.  Dvips allows this by default.
z1

But that is not the whole story.  z1 also disables absolute pathnames.
Furthermore, you've got to know that the alternative is "z0".

It can also be changed on the commandline, here the info manual says:

,----
| `-R'
|      Run securely.  `-R2' disables both shell command execution in
|      `\special' (via ``', *note Dynamic creation of graphics::) and
|      config files (via the `E' option, *note Configuration file
|      commands::) and opening of any absolute filenames.  `-R1', the
|      default, forbids shell escapes but allows absolute filenames.
|      `-R0' allows both.
`----

And that's the whole thing that has changed between TL 2007 (and
probably teTeX) on the one hand and TL 2005 on the other:  In TL 2007,
zN and -RN correspond to each other, so -R1 and z1 allow absolute
pathnames.  In TL 2007, z1 also forbids pathnames (sorry I didn't check
-R1 there, and the chroot is already gone).

Regards, Frank
-- 
Dr. Frank Küster
Single Molecule Spectroscopy, Protein Folding @ Inst. f. Biochemie, Univ. Zürich
Debian Developer (teTeX/TeXLive)