Acrobat Distiller and PostScript file operators

[Mark_Kuehn]

As per the Acrobat Distiller API Reference, I'm attempting to launch Distiller to enable the distillation of a PostScript file that is user the restricted operators.

I am using a Mac with Acrobat Distiller 2020. I have set the plist AllowPSFileOps to True. On every launch of the distiller, the plist entry is changed to False, and the distillation of a PostScript file that uses file operators fails.

I need guidance on how to make this work.

[ls_rbls]

How is the Distiller invoked, via GUI or command terminal? Does it make any difference if you run it with elevated privilege as Administrator?

And in which directory path is the Distiller executable installed?

Also, are you using as a reference the Acrobat Plist Preference Reference? 

It may be possible that this preference is not lockable or it depends on another Plist dependency that also needs to be changed (or created) to retain the value of "true" for the AllowPSFileOps .

[BarlaeDC]

Hi,

Which version of OSX are you using as there may be additional rights that you need to give to distiller, such as  Full Disk Access or Files and Folders.

[Mark_Kuehn]

I'm using macOS Mojave (10.14.6). I've tried enabling full disk access, to no available.

The distiller's install path is "/Applications/Adobe Acrobat 2020/Acrobat Distiller.app", the default path.

I've modified the "~/Library/Preferences/com.adobe.distiller2020.plist" to have the boolean entry "AllowPSFileOps" to be "YES". I've tried locking the plist.

I've invoked the distiller from both the GUI and command line. When invoke via the command line, I've tried:

• Just the path to the executable "/Applications/Adobe Acrobat 2020/Acrobat Distiller.app/Contents/MacOS/Distiller"
• The executable with the -F option  "/Applications/Adobe Acrobat 2020/Acrobat Distiller.app/Contents/MacOS/Distiller" -F
• The executable with the -f option  "/Applications/Adobe Acrobat 2020/Acrobat Distiller.app/Contents/MacOS/Distiller" -f
• The executable with the unix -allowfileops option  "/Applications/Adobe Acrobat 2020/Acrobat Distiller.app/Contents/MacOS/Distiller" -allowfileops

I've enabled the root user, modified its com.adobe.distiller2020.plist, and tried all of the above steps. 

Nothing above, for either a regular user or for root works, to allow the successful distillation of a file that contains PostScript code using file operators.

Any other ideas?

-Mark

[ls_rbls]

If this is happening with every PDF that you're trying to distill then I am running out of ideas already. I will need to dig some more info.

However, if this happening with one or just a few sets of PDFs, then it may be possible that some of those PDFs are password protected, digitally signed (or certified), and enforcing editing restrictions.

[Mark_Kuehn]

PostScript input files without the any PostScript file type operators distill fine.

I'm try to determine why the plist perference AllowPSFileOps does not work or the "proper" method to invoke the distiller to enable the this boolean preference's function.

The PostScript input files do not have any special pdfmark functions included in them to signal to the Distiller to enable password protecting, digital signing, or editing restrictions.

[Test Screen Name]

Maybe relevant https://community.adobe.com/t5/acrobat-sdk/allowpsfileops-mac-os-sierra-acrobat-dc/m-p/9081791

[Test Screen Name]

And don't run it as root.

[Mark_Kuehn]

Thanks for the reference, but I had saw that post previously, and confirmed that it does not work for me. When I invoke Distiller from the terminal:

    "/Applications/Adobe Acrobat 2020/Acrobat Distiller.app/Contents/MacOS/Distiller" -F filename.ps

The distiller launches, but it does not process the document "filename.ps". It just get a "normal" distiller launch. If I drag and drop "filesname.ps" on to the distiller window, it processes. However the processing stops with errors. The message in the log file indicate that the PostScript file operations remain the issue:

    %%[ ProductName: Acrobat Distiller 20.0 ]%%
    %%[ Error: ioerror; OffendingCommand: file ]%%

-Mark

[ls_rbls]

You might've come accross this link before:

• https://helpx.adobe.com/ca/acrobat/using/creating-pdfs-acrobat-distiller.html

See specifically the section about watch folders. There's an interesting explanation bout how to clear the watch folder, how configure the Distiller if you have more than one watch folder, and the setting up the recommended language level.

[Test Screen Name]

lb_rbls, that isn't relevant. This is about PostScript file operators. I think I need to give some background.

PostScript is a programming language, used to draw pages. Distiller reads PostScript files and turns them to PDF. PostScript can read files, and this is sometimes used, for example, to read in EPS files and put them many times on one page. It can even write files and get a list of files. Clearly this is a security risk. So, Distiller, starting with Acrobat 8, blocks these file accesses. (PostScript is a collection of operators, hence "file operators"). Adobe gave an option to unblock, and allow file operators in PostScript.

But the original poster here is struggling to get the Mac Distiller to use these options, so he cannot distill his PostScript files. I have done some tests, and I can't make it work either.

[ls_rbls]

Ok. I see and thank you for clarifying as usual.

Then in that case these next links may be more relevant: 

• https://helpx.adobe.com/x-productkb/global/troubleshoot-postscript-errors.html

• https://opensource.adobe.com/dc-acrobat-sdk-docs/acrobatsdk/pdfs/acrobatsdk_distiller.pdf

But just out of curiousity, since I don't have a macOS computer to test, are you guys able to print the file(s) normally to a printer?

[ls_rbls]

I forgot to include this reference:

https://www.adobe.com/content/dam/acom/en/devnet/acrobat/pdfs/pdfmark_reference.pdf

[Mark_Kuehn]

Yes, the PostScript files print fine.

This is because the PostScript RIPs implement the 'file' operators. The Distiller can also support the 'file' operators, but since because the 'file' operators could be abused, Adobe changed the default behavior of Distiller to not support these operators.

Adobe did allow a method to enable support for 'file' operators, but that doesn't seem to be working as documented. Hence, my reason for this entire thread.

-Mark

[ls_rbls]

So I was reading through some of the links that I found, if it would it make any difference to set the Adobe PDF printer as the default printing device instead of the actual physical printing device in that computer.

Based on the input / output error that Distiller is throwing when you use the operator -F  and the offending command being "file" (not an " image " or anything else),  I thought  that maybe customizing a profile via GUI using the  Printing Preferences may be a useful workaround.

In the pdfmark reference you'll see that the settings that can be set via Printing Preferences, can be customize via command line.

There's also a few switches of interest in one of the links above.

But these are just ideas. I will try on my MS Windows box and post back if I can find something relevant.

[Mark_Kuehn]

Alas, that will not work for my application. The PostScript is being emitted from third party and delivered to me to process and print (kind of like an imaging service bureau in the by gone days of prepress film and print plate imaging businesses). Therefore, there is no option to use a PDF printer.

I think I need someone from Adobe to weigh in to share the correct process to get this to work. The developers of Acrobat Distiller obviously anticipated the need, and created the -F option (Windows) and the AllowPSFileOps plist entry (Macintosh) to enable this.

-Mark

[ls_rbls]

Would you mind sharing the name of third-party application?

[jdaw1]

I asked a similar question in http://community.adobe.com/t5/acrobat/distiller-enabling-file-functionality/m-p/11925183

The Postscript `run` command used to execute a file (see PLRM3 p653 in §8.2). Could you replace each instance of a `run` command with the whole file? That might be easy for instances such as `(filename.eps) run`, but will require careful reading if the filename is generated by non-trivial code.

[Test Screen Name]

It's also impossible if the run command is used in a procedure, condition or loop. (One of the common "brick walls" for automated processing of PostScript). An alternative technique would be to add each of the to-be-embedded files to the source code as members of a dictionary with each file defined with the SubFileDecode filter, and have run refer to the dictionary items. The limitation here is the fact that all files have to be preloaded into memory; on Windows there's a 2GB address space limit. 

Also some PostScript code actually does expect to read and write files, not just execute them. 

[Mark_Kuehn]

The application emitting the PostScript is an older version of OpenText Exstream (HP  Exstream v 7.0.605). This particular instance uses PostScript 'file' operators to support running totals across multiple pages using PostScript code. It is indeed creating, writing, reading, and deleting an actual RIP based file.

[Mark_Kuehn]

It has been awhile, but I've made a smidgen of progress. I recently gained access to Mac with Acrobat Distiller 10 instance on it. On this machine I modified the plist "~/Library/Preferences/com.adobe.distiller10.plist" to include the following entry:

      AllowPSFileOps  Boolean YES

This does allow a PostScript output document with a 'file' operator in the PostScript code to successfully distill and creates the PDF output.

The Mac Acrobat Distiller 2020 still refuses to honor this, so that remains a problem. Does anyone know of a resource in Adobe that I could escalate this to? 

[ls_rbls]

@Mark_Kuehn 

Thank you very much for updating this thread.