ImageMagick convert security policy

Try to convert a file with ImageMagick convert, and:

convert-im6.q16: attempt to perform an operation not allowed by the security policy `PDF' @ error/constitute.c/IsCoderAuthorized/421.
convert-im6.q16: no images defined `i.png' @ error/convert.c/ConvertImageCommand/3229.

WTF? There is some security policy that stops it processing PDFs in specific ways.

https://imagemagick.org/script/security-policy.php

It’s a configuration file, so it’s in /etc

$ find /etc/ -name policy.xml
/etc/ImageMagick-6/policy.xml

And let’s have a look for PDF:

$ grep -i pdf /etc/ImageMagick-6/policy.xml 
<!-- <policy domain="module" rights="none" pattern="{PS,PDF,XPS}" /> -->
<policy domain="coder" rights="none" pattern="PDF" />

What’s that all about? Well, what else can appear in the “rights=” place?

$ grep -i rights /etc/ImageMagick-6/policy.xml 

Rights include none, read, write, execute and all. Use | to combine them

OK, well I want to convert from PDF to else, so what if I make that ‘read’?

Note that the first PDF line is commented out anyway. It ought to have no effect — except I don’t know what the defaults are. Maybe ‘none’ is the default. What if I change ‘none’ on the first line (module) to ‘read’? (And uncomment it.)

Nope.

OK, re-comment it. Try second line (coder).

$ convert 1.pdf 1.png
convert-im6.q16: profile 'icc': 'RGB ': RGB color space not permitted on grayscale PNG `1.png' @ warning/png.c/MagickPNGWarningHandler/1668

Well, it’s a new message. And sounds like just a technical snafu. What if I make it ‘all’:

 <policy domain="coder" rights="all" pattern="PDF" />

Yes, that works. Whose great idea the annoying default is, I do not know.