ImageMagick "not authorized PDF": policy.xml in CI
ImageMagick's policy.xml disables PDF, PS, and EPS coders by default, so convert in.pdf out.png fails with "attempt to perform an operation not authorized".
After CVE-2018-16509 (a Ghostscript RCE), distros ship ImageMagick with PDF/PostScript handling disabled in policy.xml. This is the single most common ImageMagick failure in CI when rendering PDFs.
What it does
ImageMagick delegates PDF/PS rasterization to Ghostscript. Because that path had a remote code execution vulnerability, policy.xml ships a <policy domain="coder" rights="none" pattern="PDF" /> (and PS/EPS) line that blocks it. Removing or relaxing that line re-enables PDF conversion.
Common usage
# the failing command
convert in.pdf out.png
# convert: attempt to perform an operation not authorized ... 'PDF'
# fix: drop the PDF (and PS/EPS) deny lines in CI
POLICY=$(find /etc/ImageMagick-* -name policy.xml)
sed -i '/rights="none" pattern="PDF"/d;/rights="none" pattern="PS"/d;/rights="none" pattern="EPS"/d' "$POLICY"
# or comment them out / set rights="read|write"Options / Policy lines
| policy.xml line | Effect |
|---|---|
| <policy domain="coder" rights="none" pattern="PDF"/> | Blocks reading/writing PDF (the default that fails) |
| rights="read|write" pattern="PDF" | Allows PDF conversion again |
| pattern="{PS,PS2,PS3,EPS,PDF,XPS}" | Some distros group all PostScript-family coders |
| Path v6 | /etc/ImageMagick-6/policy.xml |
| Path v7 | /etc/ImageMagick-7/policy.xml |
In CI
Prefer rendering PDFs with a dedicated tool (pdftoppm from poppler or gs directly) instead of relaxing ImageMagick's security policy. If you must use ImageMagick, scope the policy change to the CI image and only allow the coders you need. Ensure Ghostscript is installed, since ImageMagick shells out to it.
Common errors in CI
The exact error is "convert: attempt to perform an operation not authorized ... 'in.pdf' @ error/constitute.c". After editing the policy, "no decode delegate ... 'PDF'" or "FailedToExecuteCommand 'gs'" means Ghostscript is missing; apt-get install -y ghostscript. Editing the wrong major-version policy.xml (v6 vs v7) is why a sed fix sometimes appears to do nothing.