FS#64971 - Error printing to network printer from CUPS

Attached to Project: Arch Linux
Opened by Nigel Kukard (nkukard) - Friday, 27 December 2019, 12:26 GMT
Last edited by Andreas Radke (AndyRTR) - Saturday, 28 December 2019, 16:51 GMT
Task Type Bug Report
Category Packages: Extra
Status Closed
Assigned To Andreas Radke (AndyRTR)
Architecture All
Severity Medium
Priority Normal
Reported Version
Due in Version Undecided
Due Date Undecided
Percent Complete 100%
Votes 0
Private No

Details

Description:

There may be a permission issue when printing to a network printer using CUPS.

Using Cups version:
cups 2.3.1-1

Steps to reproduce:
- Clean install of Arch with kde + CUPS installed
- Network printer is discovered using Avahi/DNSSD
- Try to print to it fails


Details:

The ipp backend file in /usr/lib/cups/backend/ is 0700...
-rwx------ 1 root root 79712 Dec 15 20:23 ipp

When printing the below error is visible in the logs...
E [27/Dec/2019:11:41:39 +0000] [Job 17] Could not start IPP Backend (/usr/lib/cups/backend/ipp): 13 Permission denied

When I thew up some audit rules I'm seeing execution of binaries using the cups:cups user/group...
Dec 27 12:02:40 nkukard-desktop3.local audit[168806]: SYSCALL arch=c000003e syscall=59 success=no exit=-13 a0=7ffea4a66b00 a1=7ffea4a65090 a2=7ffea4a69068 a3=7ffea4a62852 items=1 ppid=168 793 pid=168806 auid=4294967295 uid=209 gid=209 euid=209 suid=209 fsuid=209 egid=209 sgid=209 fsgid=209 tty=(none) ses=4294967295 comm="implicitclass" exe="/usr/lib/cups/backend/implicitcl ass" key="nktest"
This task depends upon

Closed by  Andreas Radke (AndyRTR)
Saturday, 28 December 2019, 16:51 GMT
Reason for closing:  Not a bug
Comment by Andreas Radke (AndyRTR) - Friday, 27 December 2019, 12:53 GMT
I guess your user isn't in a group allowed to create the temporary queue:

SystemGroup sys root wheel

You should probably setup some static cups server queue and print from client to that server queue and not directly to the IPP found printer.
Comment by Nigel Kukard (nkukard) - Friday, 27 December 2019, 13:08 GMT
Creating a local printer works (thanks), the reason I didn't do that initially was because there is a number of label printers where the settings do not display in printer options if I do that.

Changing the ownership of /usr/lib/cups/backend/ipp to root:cups with 0750 also works. However I'm unsure of the implications of doing that.

Is there a reason why some of the backends are 0755 and the others are 0700?
Comment by Andreas Radke (AndyRTR) - Saturday, 28 December 2019, 12:57 GMT
https://github.com/apple/cups/blob/master/backend/Makefile

Maybe follow the link there and check for historic changes to the Makefile.

I guess we can close this on "not a bug".
Comment by Nigel Kukard (nkukard) - Saturday, 28 December 2019, 13:48 GMT
Agreed.

It seems the purpose for running ipp as root is for Kerberos authentication.

Loading...