How do I fix the ImageMagick PDF security policy error?

Find policy.xml with magick -list policy, then remove or relax the coder line for the PDF pattern. Setting rights to read allows PDF input while still blocking PDF output.

Where is ImageMagick policy.xml located?

Run magick -list policy to print the path. It is usually /etc/ImageMagick-7/policy.xml or /etc/ImageMagick-6/policy.xml, with a per-user override possible at ~/.config/ImageMagick/policy.xml.

Is it safe to disable the ImageMagick PDF policy?

On your own machine with your own files, yes. On a server that processes PDFs uploaded by untrusted users, no — the policy exists because of Ghostscript vulnerabilities that allow command execution from a crafted PDF. Use pdftoppm instead.

attempt to perform an operation not allowed by the security policy `PDF'

Your ImageMagick command is fine — policy.xml blocks PDF, PS and EPS by default. How to find the file, which lines to change, and when you should not change them.

You ran something like magick input.pdf output.png and got:

convert: attempt to perform an operation not allowed by the security policy `PDF'
@ error/constitute.c/ReadImage/412

Your command is correct. ImageMagick is refusing on purpose.

Why this happens

ImageMagick delegates PDF, PostScript and EPS decoding to Ghostscript. In 2018 a series of Ghostscript vulnerabilities allowed a crafted PDF to execute arbitrary commands on the host. Because ImageMagick is very often used to process files uploaded by untrusted users, distributions responded by shipping a policy.xml that disables those formats outright.

So this is not a bug and not a misconfiguration — it is the default on Debian, Ubuntu, RHEL, Fedora, Alpine and most Docker images.

Find the policy file

magick -list policy

Or on ImageMagick 6:

convert -list policy

The output begins with the path. Common locations:

/etc/ImageMagick-7/policy.xml
/etc/ImageMagick-6/policy.xml
/usr/local/etc/ImageMagick-7/policy.xml (Homebrew)
~/.config/ImageMagick/policy.xml (per-user override)

The lines to change

Near the bottom of the file you will find:

<policy domain="coder" rights="none" pattern="PS" />
<policy domain="coder" rights="none" pattern="PS2" />
<policy domain="coder" rights="none" pattern="PS3" />
<policy domain="coder" rights="none" pattern="EPS" />
<policy domain="coder" rights="none" pattern="PDF" />
<policy domain="coder" rights="none" pattern="XPS" />

Comment out or delete the ones you need. To allow reading PDFs only, change the rights instead of removing the line:

<policy domain="coder" rights="read" pattern="PDF" />

That permits pdf → png while still refusing to write PDF, which is a reasonable middle ground.

Verify

magick -list policy | grep -i pdf
magick -density 150 input.pdf page.png

A per-user override, without touching the system file

If you cannot edit /etc, ImageMagick also reads a policy from your home directory:

mkdir -p ~/.config/ImageMagick
cat > ~/.config/ImageMagick/policy.xml <<'EOF'
<policymap>
  <policy domain="coder" rights="read|write" pattern="PDF" />
  <policy domain="coder" rights="read|write" pattern="EPS" />
  <policy domain="coder" rights="read|write" pattern="PS" />
</policymap>
EOF

You can also point at a specific file for one run with the MAGICK_CONFIGURE_PATH environment variable.

In Docker

RUN apt-get update && apt-get install -y imagemagick ghostscript \
 && sed -i 's/rights="none" pattern="PDF"/rights="read|write" pattern="PDF"/' \
      /etc/ImageMagick-6/policy.xml

When you should leave the policy alone

This matters. If your server rasterises PDFs that strangers upload, that policy is doing real work. Disabling it re-opens the exact attack surface it was added for. In that situation, keep the policy and use a narrower tool for the job:

pdftoppm -png -r 150 input.pdf page    # poppler-utils

pdftoppm does one thing, has a much smaller attack surface than Ghostscript, and is usually faster. If you must use Ghostscript on untrusted input, run it in a container or sandbox with no network and a read-only filesystem, and keep it patched.

On your own laptop, converting your own PDFs, editing the policy is fine.