HPMUD udev rule should not set libsane_matched

[apetrov87]

I use both an HP printer and an Epson scanner on my Linux machine. The HPLIP package installs "/lib/udev/rules.d/56-hpmud.rules" and the Epson software installs "99-iscan.rules".
The hpmud rules run first and include this line:
ATTR{idVendor}=="03f0", ATTR{idProduct}=="????", OWNER="root", GROUP="lp", MODE="0664", ENV{sane_hpaio}="yes", ENV{libsane_matched}="yes", ENV{hp_test}="yes", ENV{ID_HPLIP}="1"
And the iscan rules have:
ENV{libsane_matched}=="yes", MODE="664", GROUP="scanner"

As a result, when I plug in the HP printer, the hpmud rules set libsane_matched, and then the iscan rules see the libsane_matched and set the group of /dev/bus/usb/###/### to "scanner". I cannot print until I manually change the group to "lp".

I have worked around this by creating an override rule for my specific printer model, in "/etc/udev/rules.d/A0-hp-printer-rules" (note that the file name must sort after 99-iscan):
ACTION=="add", SUBSYSTEM=="usb", ATTR{idVendor}=="03f0", ATTR{idProduct}=="8011", MODE="0664", GROUP="lp"

A better solution would be to not blindly set libsane_matched for all HP products. In fact, we probably don't need to set it at all. Its only use in the hpmud rules file is to disable USB autosuspend, so let's give it a unique name like "hpmud_noautosuspend".

[Johannes Meixner (jsmeix)]

Only FYI:

I think using GROUP="scanner" by default cannot work well nowadays.

I think nowadays GROUP="lp" should be set by default both for
printers and scanners.

I think in 99-iscan.rules EPSON should also use GROUP="lp".

I think using GROUP="lp" by EPSON would also make their
all-in-one devices "just work".

Reasoning:

For all-in-one devices (i.e. printer + scanner)
the group must be "lp" so that the CUPS usb backend
which runs as user "lp" (who is member of the group "lp")
can send printing data to the printer unit.

It is sufficiently secure and reasonable easy to use by default
the same group "lp" for printers and scanners because
both kind of devices usually require physical user access
(to get the printed paper or to place a paper on the scanner)
so that both kind of devices should usually require the same
kind of security.

I think the SANE upstream default is still GROUP="scanner"
but as explained above I think nowadays this does no longer
work well and should be replaced by GROUP="lp" (even for
plain scanners to keep it simple).

Note that I only talk about the defaults.

Expert users who like separated permission settings for
plain scanners versus plain printers versus all-in-one devices
can modify the defaults as they need in their particular case.

[Johannes Meixner (jsmeix)]

FWIW:

Setting libsane_matched results that an ACL is set by udev
via udev-acl in a standard udev rules file "*udev-acl.rules"
so that the user who has locally logged in gets rw access
for the printer/scanner/whatever device via a special ACL.
This way the user has locally logged in does not need to
be member of a group like 'lp' or 'scanner' or whatever.

Additionally GROUP="lp" and MODE="0664" is needed
at least for printers so that the CUPS usb backend
has rw access for the device.

In short:
libsane_matched for normal user access,
GROUP="lp" + MODE="0664" for CUPS access

[apetrov87 (apetrov87)]

Not every system has the "*udev-acl.rules". My Gentoo setup doesn't, that's why I thought setting libsane_matched was unnecessary.