inode_permission error for cupsd on /dev/tty

[Loïc Minier]

Hi,

From dmesg:
[ 895.934627] audit(1192432526.054:4): type=1503 operation="inode_permission" requested_mask="a" denied_mask="a" name="/dev/tty" pid=12476 profile="/usr/sbin/cupsd"

I guess cupsd lacks some apparmor permissions to write to the tty.

I now have version 1.3.2-1ubuntu6 of the package, but can't really tell whether the new or the previous version or the upgrade caused the message, so if you just fixed such a problem in ubuntu6, please close this report.

Bye,

[aot2002 (jasonbronson)]

i too am recieving this issue

any luck?

[Alexander Hunziker (alex-hunziker)]

confirming this. cupsd crashes all the time. i'm not sure when it started, but it definitely didn't happen when gutsy was first released. maybe an error in some backport/proposed updates?

[Craig Maloney (craig-decafbad)]

Noticed this too. Not sure what it means, as it printed fine.

Security Events
=-=-=-=-=-=-=-=
Jan 24 07:44:20 lister kernel: [64816.981749] audit(1201178660.653:4): type=1503 operation="inode_permission" requested_mask="rw" denied_mask="rw" name="/dev/tty" pid=853 profile="/usr/sbin/cupsd"
Jan 24 07:44:20 lister kernel: [64817.024061] audit(1201178660.697:5): type=1503 operation="inode_permission" requested_mask="rw" denied_mask="rw" name="/dev/tty" pid=856 profile="/usr/sbin/cupsd"
Jan 24 07:45:44 lister kernel: [64900.646971] audit(1201178744.386:6): type=1503 operation="inode_permission" requested_mask="rw" denied_mask="rw" name="/dev/tty" pid=898 profile="/usr/sbin/cupsd"
Jan 24 07:45:44 lister kernel: [64900.692477] audit(1201178744.430:7): type=1503 operation="inode_permission" requested_mask="rw" denied_mask="rw" name="/dev/tty" pid=901 profile="/usr/sbin/cupsd"

[Alexander Hunziker (alex-hunziker)]

I tried disabling apparmor, but that doesn't solve the problem. If I restart cupsys, then I can print a few documents, and then it crashes again and requires a restart.

[Merike Sell (merikes)]

I'm having the same problem. Using 1.3.2-1ubuntu7.5.
I have those lines in dmesg, one or two per job it seems:
[ 1231.168000] audit(1202396248.480:6): type=1503 operation="inode_permission" requested_mask="a" denied_mask="a" name="/dev/tty" pid=6458 profile="/usr/sbin/cupsd"
[ 1243.948000] audit(1202396261.481:7): type=1503 operation="inode_permission" requested_mask="rw" denied_mask="rw" name="/dev/tty" pid=6476 profile="/usr/sbin/cupsd"
CUPS doesn't print at all, not after restarting it as well. It simply displays that the jobs have completed even though they haven't even started.
The problem was't there for me two weeks ago Sunday. Maybe I had those lines in the log, I don't know, but I didn't have any problems with printing.

[January (january-weiner)]

Confirmed.

Hey, people, this is bloody serious! It's 3am here, I *MUST* print some documents for tomorrow morning, and I find my printers suddenly not working! Not even printing as root work! WTF is apparmor? How do I get rid of this thing?

(Incidentally, when I was googling for "get rid of apparmor ubuntu" I found several links about how to get rid of Ubuntu... is google trying to tell me something :-) ?)

[January (january-weiner)]

Great. So I won't print the docs.

I tried to remove / disable apparmor. I removed the module by doing an rmmod apparmor. Printing still does not work, although all messages from cups say that it's OK and that job has been send, no errors whatsoever, jobs shown as completed.

I also tried aa-complain, but that did not help, either, except that the messages from apparmor are not displayed. I also included the abstractions/samba into /etc/apparmor.d/cups-whatever-whatever, as suggested somewhere.

Possibly then, my problem is not related to apparmor directly, but to cups. Whatever, it worked just few days ago when I last needed to print smth at home.

cheers,
j.

[Chris Kälin (ck1)]

Confirmed for epson stylos colour 600 on my dad's Gutsy. Only the first time I plugged in the USB, I was able to select the first option in KDE's printer configuration. Did not work anyway. After that the 1st option (local printer) was greyed out, also after reboot etc. Still the printer can be configured by choosing the right driver. But anyway I'm running into the same problem:

operation="inode_permission" requested_mask="a" denied_mask="a" name="/dev/tty" pid=5149 profile="/usr/sbin/cupsd"

if I want to print something.

The printer worked flawlessly on Feisty. Sorry, but I have my reasons I have changed my whole home machines into Fedora. A little more to configure, but a lot more stability in drivers and hardware support.

[Buks Hanekom (bukshanekom)]

I think I have the same problem.
I am using Hardy Alpha 4 (Linux 2.6.24-8-generic #1 SMP Thu Feb 14 20:40:45 UTC 2008 GNU/Linux)
I have been trying to print to a HP LaserJet 1018 which is shared on a windows XP machine via Samba.
This did not work, so I plugged it directly into my laptop (kubuntu hardy Alpha 4).
It was detected, and little printer appeared in the tray which said that the printer was installed and ready to use. Ha, it did NOT work!
After some googling, I found this post on the kubuntu forum (http://kubuntuforums.net/forums/index.php?topic=10654.0;topicseen)
I followed the instructions to the letter and the printer reset itself when I entered the command to update the firmware.
I then added the printer using KMenu -> System -> Printing. I was able to print from open office.
I then moved the printer back to the windoze PC and tried to setup the printer again via the add printer wizard through samba.
When I click on the printer test button I get this in the kernel.log file, which seems the same as reported earlier in this post:

==> /var/log/kern.log <==
Feb 18 23:46:10 buks kernel: [38441.820449] audit(1203371170.946:141): operation="inode_permission" request_mask="::r" denied_mask="::r" name="/var/run/samba/gencache.tdb" pid=18277 profile="/usr/sbin/cupsd" namespace="default"
Feb 18 23:46:10 buks kernel: [38441.830251] audit(1203371170.958:142): operation="inode_permission" request_mask="::r" denied_mask="::r" name="/var/run/samba/gencache.tdb" pid=18277 profile="/usr/sbin/cupsd" namespace="default"
Feb 18 23:46:10 buks kernel: [38441.832097] audit(1203371170.958:143): operation="inode_permission" request_mask="::r" denied_mask="::r" name="/var/run/samba/gencache.tdb" pid=18277 profile="/usr/sbin/cupsd" namespace="default"
Feb 18 23:46:11 buks kernel: [38441.886584] audit(1203371171.014:144): operation="inode_permission" request_mask="::r" denied_mask="::r" name="/var/run/samba/gencache.tdb" pid=18277 profile="/usr/sbin/cupsd" namespace="default"
Feb 18 23:46:11 buks kernel: [38441.887012] audit(1203371171.014:145): operation="inode_permission" request_mask="::r" denied_mask="::r" name="/var/run/samba/gencache.tdb" pid=18277 profile="/usr/sbin/cupsd" namespace="default"
Feb 18 23:46:11 buks kernel: [38441.887907] audit(1203371171.014:146): operation="inode_permission" request_mask="::r" denied_mask="::r" name="/var/run/samba/gencache.tdb" pid=18277 profile="/usr/sbin/cupsd" namespace="default"
Feb 18 23:46:11 buks kernel: [38441.891499] audit(1203371171.018:147): operation="inode_permission" request_mask="::rw" denied_mask="::rw" name="/dev/tty" pid=18284 profile="/usr/sbin/cupsd" namespace="default"
Feb 18 23:46:11 buks kernel: [38441.901246] audit(1203371171.030:148): operation="inode_permission" request_mask="::r" denied_mask="::r" name="/var/run/samba/gencache.tdb" pid=18277 profile="/usr/sbin/cupsd" namespace="default"
Feb 18 23:46:11 buks kernel: [38441.901994] audit(1203371171.030:149): operation="inode_permission" request_mask="::r" denied_mask="::r" name="/var/run/samba/gencache.tdb" pid=18277 profile="/usr/sbin/cupsd" namespace="default"
Feb 18 23:46:11 buks kernel: [38441.904585] audit(1203371171.034:150): oper...

[Peter Peltonen (peter-peltonen)]

I think I have the same problem: with HP 710C parallel port printer which used to work ok but when I now try to print something nothing happens. The only error msg I can find is in 'dmesg':

[ 51.118333] audit(1203613684.366:3): type=1503 operation="inode_permission" requested_mask="a" denied_mask="a" name="/dev/tty" pid=5313 profile="/usr/sbin/cupsd"

lpinfo sees the port:

root@sinisusi:~# lpinfo -v
network socket
network beh
direct hpfax
direct hp
network http
network ipp
network lpd
direct parallel:/dev/lp0
file cups-pdf:/
direct scsi
network smb

lpq reports that everything is okay:

root@sinisusi:~# lpq
hp710gray is ready
no entries

CUPS access log claims everything printed just fine:

localhost - - [21/Feb/2008:19:29:46 +0200] "POST / HTTP/1.1" 200 416 CUPS-Get-Classes successful-ok
localhost - - [21/Feb/2008:19:29:46 +0200] "POST /printers/hp710gray HTTP/1.1" 200 347 Print-Job successful-ok

CUPS error log also seems to say that the document printed fine:

D [21/Feb/2008:19:29:46 +0200] cupsdAcceptClient: 11 from localhost:631 (IPv4)
D [21/Feb/2008:19:29:46 +0200] cupsdReadClient: 11 POST / HTTP/1.1
D [21/Feb/2008:19:29:46 +0200] cupsdAuthorize: No authentication data provided.
D [21/Feb/2008:19:29:46 +0200] CUPS-Get-Printers
D [21/Feb/2008:19:29:46 +0200] cupsdProcessIPPRequest: 11 status_code=0 (successful-ok)
D [21/Feb/2008:19:29:46 +0200] cupsdReadClient: 11 POST / HTTP/1.1
D [21/Feb/2008:19:29:46 +0200] cupsdAuthorize: No authentication data provided.
D [21/Feb/2008:19:29:46 +0200] CUPS-Get-Classes
D [21/Feb/2008:19:29:46 +0200] cupsdProcessIPPRequest: 11 status_code=0 (successful-ok)
D [21/Feb/2008:19:29:46 +0200] cupsdReadClient: 11 POST / HTTP/1.1
D [21/Feb/2008:19:29:46 +0200] cupsdAuthorize: No authentication data provided.
D [21/Feb/2008:19:29:46 +0200] CUPS-Get-Default
D [21/Feb/2008:19:29:46 +0200] cupsdProcessIPPRequest: 11 status_code=0 (successful-ok)
D [21/Feb/2008:19:29:46 +0200] cupsdCloseClient: 11
D [21/Feb/2008:19:29:46 +0200] cupsdAcceptClient: 11 from localhost:631 (IPv4)
D [21/Feb/2008:19:29:46 +0200] cupsdReadClient: 11 POST /printers/hp710gray HTTP/1.1
D [21/Feb/2008:19:29:46 +0200] cupsdAuthorize: No authentication data provided.
D [21/Feb/2008:19:29:46 +0200] Print-Job ipp://localhost/printers/hp710gray
D [21/Feb/2008:19:29:46 +0200] print_job: auto-typing file...
D [21/Feb/2008:19:29:46 +0200] add_job: requesting-user-name="root"
I [21/Feb/2008:19:29:46 +0200] [Job 163] Adding start banner page "none".
D [21/Feb/2008:19:29:46 +0200] Discarding unused job-created event...
I [21/Feb/2008:19:29:46 +0200] [Job 163] Adding job file of type text/plain.
I [21/Feb/2008:19:29:46 +0200] [Job 163] Adding end banner page "none".
I [21/Feb/2008:19:29:46 +0200] [Job 163] Queued on "hp710gray" by "root".
D [21/Feb/2008:19:29:46 +0200] [Job 163] hold_until = 0
D [21/Feb/2008:19:29:46 +0200] [Job 163] Sending job to queue tagged as raw...
D [21/Feb/2008:19:29:46 +0200] Discarding unused printer-state-changed event...
D [21/Feb/2008:19:29:46 +0200] [Job 163] job-sheets=none,none
D [21/Feb/2008:19:29:46 +0200] [Job 163] banner_page = 0
D [21/Feb/2008:19:29:46 +0200] [Job 163] argv[0]="hp710gray"
D [21/Feb/2008:19:29:46 ...

[Henning Moll (drscott)]

Here's how i solved the problem on my system...

The cups error log (http://localhost:631/admin/log/error_log) reported
> ... (/usr/lib/cups/filter/foomatic-rip) stopped with status 1!
> ... Job stopped due to filter errors.

So i enabled logging of debug information via /etc/foomatic/filter.conf
After the next print attempt, the file /tmp/foomatic-rip.log had interesting news:
>...
>sh: gs: command not found
>renderer return value: 127
>...

Pardon? A short check via dpkg shows, that package ghostscript - which contains /usr/bin/gs - was installed. But there was really no /usr/bin/gs.
Well, a 'sudo apt-get install --reinstall ghostscript' solved the problem. I don't know what happend, why ghostscript was not properly installed. The apparmor log entry also disappeared.
Now, please do not just execute the above apt-get command: Can you please verify if you suffer from exactly the same problem _before_ unning the command?

[Merike Sell (merikes)]

In my case I also looked at CUPS log and it seemed to think that my document printed successfully even though it did not. For this time removing the printer from CUPS and then re-adding made the problem go away.

[Peter Peltonen (peter-peltonen)]

My gs binary isn't missing:

peter@sinisusi:~$ ls -lah /usr/bin/gs
-rwxr-xr-x 1 root root 4.3K 2008-01-08 23:20 /usr/bin/gs

I enabled debugging from /etc/foomatic/filter.conf, restarted cupsys, but no /tmp/foomatic-rip.log was created?

I reinstalled ghostscript anyway, did cupsys restart amd: printer still does not work and the apparmor entry still appears.

But by following Merike's comment I got the problem solved: Removing the printer and adding it again from CUPS web admin tool made the printer work again! The apparmor entry still appears though, but I guess that's no problem as long as my printer prints...

I still cannot access "Printers" through "System settings" (it crashes), but I guess that is a KDE problem not related to this problem.

[Magnus Helander (mhelander)]

Same here,
Gutsy 7.10 / 2.6.22-14 / Gnome 2.20.1 on a HP Photosmart 3300 series using default driver.

I can print (well... actually my kids can print) drawings from tuxpaint, but not PDF from Evince 2.20.1.

Feb 27 22:40:17 magnuslinux kernel: [ 1736.580000] audit(1204148417.545:15): type=1503 operation="inode_permission" requested_mask="rw" denied_mask="rw" name="/dev/tty" pid=24811 profile="/usr/sbin/cupsd"

/magnus

[Marc Quinton (mquinton)]

same for me, with ubuntu-gutsy, regular updates ; I reinstalled ghostscript, restarted cupsys and now it works fine. Sorry for debuging. Did made an apt-get --reinstall to quickly.

Henning, thanks for the trick.

[Marc Quinton (mquinton)]

I need give some more information : after ghostscript reinstallation, I still have the bug ; so now, I have found an other way to do the work :
 - switch off printer
 - shutdown cups : sudo /etc/init.d/cupsys stop
 - shutdown armor : sudo /etc/init.d/apparmor stop
 - restart cups : sudo /etc/init.d/cupsys start
 - switch on your printer
 - do some printing task

here is the dmesg (seems to be OK) :

root@ubuntu-gutsy:~# dmesg | tail -20
...
[ 190.816000] ppdev0: unregistered pardevice
[ 292.160000] ppdev0: registered pardevice
[ 292.536000] ppdev0: registered pardevice
[ 327.404000] ppdev0: unregistered pardevice

[Marc Quinton (mquinton)]

an interresting link : http://www.ubuntu.com/getubuntu/releasenotes/710

Printing with AppArmor

Ubuntu 7.10 introduces an additional security layer called AppArmor, whose support for CUPS printing is not yet complete. This will result in printing failures in certain corner cases described below. The workaround in each of these cases is to disable the AppArmor CUPS profile by running sudo aa-complain cupsd. AppArmor support may be re-enabled by running sudo aa-enforce cupsd.

    * Printing to bluetooth printers does not work with AppArmor enabled. Bug #147800 : https://launchpad.net/bugs/147800
    * Many third-party printer drivers (especially from printer manufacturers) do not work. Bug #152537 : https://launchpad.net/bugs/152537

seems to be duplicate with theses bugs ...

[Till Kamppeter (till-kamppeter)]

Buks Hanekom, can you check again with Hardy? There your problem with the smb CUPS backend (access to Windows print server) should be fixed. If not, post your /etc/apparmor.d/usr.sbin.cupsd file.

[Till Kamppeter (till-kamppeter)]

The problems with the smb backend and AppArmor should be fixed with gutsy-updates and hardy. Therefore I am closing this bug. Please reopen if someone has still AppArmor-induced problems with printing.

The /dev/tty messages do not break any printing functionality AFAIK.

[Aaron D. Campbell (aaroncampbell)]

I could not print after an upgrade to Kubuntu Hardy. I DID have the gs binary in /usr/bin, and was able to fix the problem using the solution at island linux: http://islandlinux.org/howto/upgrading-ubuntu-breaks-printer-cupsys

My dmesg output looked like this:

[ 806.888916] audit(1209429752.862:4): type=1503 operation="inode_permission" requested_mask="Ux::" denied_mask="Ux::" name="/usr/local/Brother/Printer/mfc9440cn/cupswrapper/brlpdwrapper_mfc9440cn" pid=6151 profile="/usr/sbin/cupsd" namespace="default"
[ 812.035287] audit(1209429758.009:5): type=1503 operation="inode_permission" requested_mask="Ux::" denied_mask="Ux::" name="/usr/local/Brother/Printer/mfc9440cn/cupswrapper/brlpdwrapper_mfc9440cn" pid=6151 profile="/usr/sbin/cupsd" namespace="default"
[ 882.047534] audit(1209429828.034:6): type=1503 operation="inode_permission" requested_mask="Ux::" denied_mask="Ux::" name="/usr/local/Brother/Printer/mfc9440cn/cupswrapper/brlpdwrapper_mfc9440cn" pid=6151 profile="/usr/sbin/cupsd" namespace="default"
[ 903.291457] audit(1209429849.281:7): type=1503 operation="inode_permission" requested_mask="Ux::" denied_mask="Ux::" name="/usr/local/Brother/Printer/mfc9440cn/cupswrapper/brlpdwrapper_mfc9440cn" pid=6151 profile="/usr/sbin/cupsd" namespace="default"
[ 936.094182] audit(1209429882.089:8): type=1503 operation="inode_permission" requested_mask="Ux::" denied_mask="Ux::" name="/usr/local/Brother/Printer/mfc9440cn/cupswrapper/brlpdwrapper_mfc9440cn" pid=6151 profile="/usr/sbin/cupsd" namespace="default"
[ 938.615397] audit(1209429884.614:9): type=1503 operation="inode_permission" requested_mask="Ux::" denied_mask="Ux::" name="/usr/local/Brother/Printer/mfc9440cn/cupswrapper/brlpdwrapper_mfc9440cn" pid=6151 profile="/usr/sbin/cupsd" namespace="default"

My CUPS error_log looked like this:

E [28/Apr/2008:18:05:19 -0700] Unable to execute /usr/local/Brother/Printer/mfc9440cn/cupswrapper/brlpdwrapper_mfc9440cn: Permission denied
E [28/Apr/2008:18:05:19 -0700] [Job 654] Unable to start filter "/usr/local/Brother/Printer/mfc9440cn/cupswrapper/brlpdwrapper_mfc9440cn" - Permission denied.
E [28/Apr/2008:18:06:19 -0700] Unable to execute /usr/local/Brother/Printer/mfc9440cn/cupswrapper/brlpdwrapper_mfc9440cn: Permission denied
E [28/Apr/2008:18:06:19 -0700] [Job 654] Unable to start filter "/usr/local/Brother/Printer/mfc9440cn/cupswrapper/brlpdwrapper_mfc9440cn" - Permission denied.
E [28/Apr/2008:18:07:29 -0700] Unable to execute /usr/local/Brother/Printer/mfc9440cn/cupswrapper/brlpdwrapper_mfc9440cn: Permission denied
E [28/Apr/2008:18:07:29 -0700] [Job 654] Unable to start filter "/usr/local/Brother/Printer/mfc9440cn/cupswrapper/brlpdwrapper_mfc9440cn" - Permission denied.
E [28/Apr/2008:18:08:29 -0700] Unable to execute /usr/local/Brother/Printer/mfc9440cn/cupswrapper/brlpdwrapper_mfc9440cn: Permission denied
E [28/Apr/2008:18:08:29 -0700] [Job 654] Unable to start filter "/usr/local/Brother/Printer/mfc9440cn/cupswrapper/brlpdwrapper_mfc9440cn" - Permission denied.
E [28/Apr/2008:18:09:39 -0700] Unable to execute /usr/local/Brother/Printer/mfc9440cn/cupswrapper/brlpdwrapper_mfc9440cn: Permission denied
E [28/Apr/2008:18:09:39 -0700] [Job 6...

[Till Kamppeter (till-kamppeter)]

The problem is that we have opened up /opt/ for third-party drivers but no /usr/local/. pitti, should we also open up /usr/local/ in an SRU for CUPS?

[Martin Pitt (pitti)]

First, this should become a new bug report. It has nothing to do with the issues discussed here previously.

Till, yes, we should probably allow "/usr/local/** rix", too.

[Zebra-Rake (faheyd)]

Still broke ubuntu
uname -mros
Linux 2.6.24-16-386 i686 GNU/Linux

[1477560.340585] usblp1: USB Bidirectional printer dev 17 if 1 alt 0 proto 2 vid 0x04B8 pid 0x0807
[1477560.364391] scsi9 : SCSI emulation for USB Mass Storage devices
[1477560.365643] usb-storage: device found at 17
[1477560.365648] usb-storage: waiting for device to settle before scanning
[1477565.359301] usb-storage: device scan complete
[1477565.360695] scsi 9:0:0:0: Direct-Access EPSON Stylus Storage 1.00 PQ: 0 ANSI: 2
[1477565.369209] sd 9:0:0:0: [sdc] Attached SCSI removable disk
[1477565.369255] sd 9:0:0:0: Attached scsi generic sg4 type 0
[1477694.986179] audit(1214247713.166:4): type=1503 operation="inode_permission" requested_mask="a::" denied_mask="a::" name="/dev/tty" pid=19334 profile="/usr/sbin/cupsd" namespace="default"
[1477857.015243] usb 5-3.1: USB disconnect, address 16
[1477857.015374] usblp0: removed
[1477861.048354] usb 5-3.1: new high speed USB device using ehci_hcd and address 18
[1477861.160601] usb 5-3.1: configuration #1 chosen from 1 choice
[1477861.170934] usblp0: USB Bidirectional printer dev 18 if 0 alt 0 proto 2 vid 0x03F0 pid 0x4117
[1477877.075221] audit(1214247895.450:5): type=1503 operation="inode_permission" requested_mask="a::" denied_mask="a::" name="/dev/tty" pid=19518 profile="/usr/sbin/cupsd" namespace="default"
[1477957.346912] audit(1214247975.806:6): type=1503 operation="inode_permission" requested_mask="a::" denied_mask="a::" name="/dev/tty" pid=19743 profile="/usr/sbin/cupsd" namespace="default"
[1478089.304915] usblp0: removed
[1478089.487633] audit(1214248108.086:7): type=1503 operation="inode_permission" requested_mask="::rw" denied_mask="::rw" name="/dev/tty" pid=19855 profile="/usr/sbin/cupsd" namespace="default"
[1478481.449141] audit(1214248500.466:8): type=1503 operation="inode_permission" requested_mask="a::" denied_mask="a::" name="/dev/tty" pid=20224 profile="/usr/sbin/cupsd" namespace="default"
[1478628.941002] usb 5-3.1: USB disconnect, address 18
[1478631.950359] usb 5-3.1: new high speed USB device using ehci_hcd and address 19
[1478632.043353] usb 5-3.1: configuration #1 chosen from 1 choice
[1478632.051181] usblp0: USB Bidirectional printer dev 19 if 0 alt 0 proto 2 vid 0x03F0 pid 0x4117
[1478721.021599] audit(1214248740.294:9): type=1503 operation="inode_permission" requested_mask="a::" denied_mask="a::" name="/dev/tty" pid=20512 profile="/usr/sbin/cupsd" namespace="default"
[1478779.078786] audit(1214248798.414:10): type=1503 operation="inode_permission" requested_mask="a::" denied_mask="a::" name="/dev/tty" pid=20621 profile="/usr/sbin/cupsd" namespace="default"
[1478916.618161] audit(1214248936.098:11): type=1503 operation="inode_permission" requested_mask="a::" denied_mask="a::" name="/dev/tty" pid=20838 profile="/usr/sbin/cupsd" namespace="default"
[1478968.902243] audit(1214248988.438:12): type=1503 operation="inode_permission" requested_mask="a::" denied_mask="a::" name="/dev/tty" pid=20958 profile="/usr/sbin/cupsd" namespace="default"
[1479164.655551] audit(1214249184.402:13): type=1503 operation="inode_permission" requested_mask="a::" denied_mask="a::" name="/dev/tty" pid=21191 profile="/usr/sb...

[Zebra-Rake (faheyd)]

This is still a 7 month old and annoying bug and is still stopping me from printing on my server through my network. Please fix it.
[ 54.796391] audit(1216356491.854:2): type=1503 operation="inode_permission" requested_mask="a::" denied_mask="a::" name="/dev/tty" pid=4980 profile="/usr/sbin/cupsd" namespace ="default"

uname -r 2.6.24-19-386 on Ubuntu.

[Martin Pitt (pitti)]

Zebra-Rake [2008-07-18 4:57 -0000]:
> This is still a 7 month old and annoying bug and is still stopping me from printing on my server through my network. Please fix it.
> [ 54.796391] audit(1216356491.854:2): type=1503 operation="inode_permission" requested_mask="a::" denied_mask="a::" name="/dev/tty" pid=4980 profile="/usr/sbin/cupsd" namespace ="default"

No, this won't stop you from using printing. It is purely a cosmetical
bug. If printing doesn't work for you, then for an entirely different
reason.

[Christian Stöveken (excogitation)]

the "cosmetical issue" still persists in Jaunty / 2.6.28-11-generic

[ 436.263117] type=1503 audit(1237485644.521:11): operation="inode_permission" requested_mask="::rw" denied_mask="::rw" fsuid=7 name="/dev/tty" pid=6852 profile="/usr/sbin/cupsd"
[ 881.696138] type=1503 audit(1237486089.957:12): operation="inode_permission" requested_mask="::rw" denied_mask="::rw" fsuid=7 name="/dev/tty" pid=7310 profile="/usr/sbin/cupsd"
[ 881.703131] type=1503 audit(1237486089.961:13): operation="inode_permission" requested_mask="::rw" denied_mask="::rw" fsuid=7 name="/dev/tty" pid=7312 profile="/usr/sbin/cupsd"
[ 881.786840] type=1503 audit(1237486090.045:14): operation="inode_permission" requested_mask="::rw" denied_mask="::rw" fsuid=7 name="/dev/tty" pid=7313 profile="/usr/sbin/cupsd"

[Stefano Prenna (stefanoprenna)]

I can confirm the same issue on Jaunty / 2.6.28-12-generic

[ 2382.703190] type=1503 audit(1242755787.857:15): operation="inode_permission" requested_mask="w::" denied_mask="w::" fsuid=0 name="/dev/ttyUSB0" pid=21252 profile="/usr/sbin/cupsd"

[Noel Burton-Krahn (noel-burton-krahn)]

I had a similiar problem. My cupsys failed to print. The problem is the foomatic filter couldn't load the perl IO::Handle module, because my apparmor doesn't include /usr/local/lib/perl

    /etc/apparmor.d/abstractions/perl

I moved the apparmor config out of the way and cups works fine:

sudo mv /etc/apparmor.d/usr.sbin.cupsd /etc/apparmor/usr.sbin.cupsd-disabled
sudo /etc/init.d/apparmor restart
sudo /etc/init.d/cupsys restart

Software versions:

Ubuntu 8.04.2
cupsys 1.3.7-1ubuntu3.5
apparmor 2.1+1075-0ubuntu9.2

[Aaron Roydhouse (aaron-roydhouse)]

This problem screwed up all my Ubuntu printing as well. I originally fixed my problem with my printers this addition to /etc/apparmor.d/usr.sbin.cupsd

  # FIXME: no policy ATM for hplip and Brother drivers
  /usr/bin/hpijs Ux,
  /usr/Brother/** Ux,

And that has worked fine with Jaunty 9.04 for almost a year, then suddenly now the same problem reoccurred and the filter can't run any more, even with the additions above.

In the meantime I have to switch apparmor to complain only to work around this:

  sudo aa-complain cupsd

Aaron.

[Aaron Roydhouse (aaron-roydhouse)]

It is really quite unhelpful that manufacturers like HP and Brother who do the good work of actually publishing and distributing Linux drivers for their printers then get them regularly broken in Ubuntu by its apparmor CUPS policy. It would be great if HP/Brother and Ubuntu could work together on a more end-user-friendly approach.

[Loïc Minier (lool)]

Please file a separate bug report with the exact issue you're seeing; the bug I filed was about cupsd trying to access /dev/tty. It didn't prevent me from printing, it just caused weird logs.