This is really stupid, but it would appear that the apparmor profiles for /usr/bin/gs in Ubuntu only allow reading and writing a limited set of extensions defined in /etc/apparmor.d/tunables/gs .
Should we be making this change in our build scripts? It seems preferable to requiring users to mess with the apparmor profiles. -- David Kastrup
