cupsys cannot create error_log

[P]

Level dapper 2006-04-25

Since /var/log/cups is :

# ll -d /var/log/cups/
drwxr-xr-x 2 root root 4096 Apr 25 11:50 /var/log/cups/

cups cannot create the mandatory error_log file !

workaround: either change /var/log/cups to enable cups to create files
or create /var/log/cups/error_log and change rights in /etc/init.d/cupsys script at startup.

# ll -d /var/log/cups/*
-rw-r--r-- 1 cupsys lp 57098 Apr 25 11:56 /var/log/cups/access_log
-rw-r--r-- 1 cupsys lp 20202 Apr 25 11:56 /var/log/cups/error_log
-rw-r--r-- 1 cupsys lp 396 Apr 25 11:45 /var/log/cups/page_log

when error_log is available, lots of usefull errors are available.

[P (p92)]

I think this is really mandatory to debug cupsys.

[Patrice Vetsel (vetsel-patrice)]

Wich version of cupsys do you have ?
do you make a fresh install of dapper beta ?!

[P (p92)]

$ dpkg -l 'cupsys*'
Souhait=inconnU/Installé/suppRimé/Purgé/H=à garder
| État=Non/Installé/fichier-Config/dépaqUeté/échec-conFig/H=semi-installé
|/ Err?=(aucune)/H=à garder/besoin Réinstallation/X=les deux (État,Err: majuscule=mauvais)
||/ Nom Version Description
+++-=============================-=============================-==========================================================================
ii cupsys 1.1.99.rc2-0ubuntu2 Common UNIX Printing System(tm) - server
ii cupsys-bsd 1.1.99.rc2-0ubuntu2 Common UNIX Printing System(tm) - BSD commands
ii cupsys-client 1.1.99.rc2-0ubuntu2 Common UNIX Printing System(tm) - client programs (SysV)
pn cupsys-driver-gimpprint <néant> (aucune description n'est disponible)
pn cupsys-driver-gimpprint-data <néant> (aucune description n'est disponible)
pc cupsys-driver-gutenprint 5.0.0~rc2-0ubuntu3 printer drivers for CUPS
un cupsys-pstoraster <néant> (aucune description n'est disponible)
un cupsys-pt <néant> (aucune description n'est disponible)

no it is not a beta install, it is a breezy upgrade to dapper dating 1 month ago and then upgraded regularly. Anyway I removed --purge then reinstall cupsys already this morning. And always get the same error, the error_log cannot be created.

In /etc/init.d/cupsys, I see the 2 other logs are created but error_log creation is missing :
# create the logs file since cupsd can't
        if [ ! -e /var/log/cups/access_log ]; then
             touch /var/log/cups/access_log
             chmod 640 /var/log/cups/access_log
             chown cupsys:lpadmin /var/log/cups/access_log
        fi
        if [ ! -e /var/log/cups/page_log ]; then
             touch /var/log/cups/page_log
             chmod 640 /var/log/cups/page_log
             chown cupsys:lpadmin /var/log/cups/page_log
        fi
       start-stop-daemon --start --quiet --oknodo --pidfile "$PIDFILE" --exec $DAEMON

[Martin Pitt (pitti)]

Sweet, I fixed that this morning, even before seeing this bug report. :) Will be uploaded soon.

[Martin Pitt (pitti)]

 cupsys (1.1.99.rc3-0ubuntu1) dapper; urgency=low
 .
   * New upstream bug fix release 1.2RC3, UVF exception approved by Matt
     Zimmerman.
   * Add debian/patches/56_revert_svn_5438.dpatch: Revert upstream svn commit
     5438 (fixed handling of products/manufacturers with spaces in the name)
     for now since it causes regressions in gnome-cups-add. Will be reactivated
     later when the issue is sorted out with upstream.
   * Update patches for new upstream release.
   * Remove debian/patches/20_httpGetHostname_crash.dpatch, fixed upstream.
   * Add debian/patches/14_dont_force_ssl.dpatch: Upstream now requires
     encryption by default for accessing /admin/, but our GUI frontends do not
     yet cope with that. Disable SSL requirement for now to revert to the old
     behaviour.
   * debian/patches/08_cupsd.conf.conf.d.dpatch:
     - Set "BrowseAddress @LOCAL"; without this, sending browsing information
       does not work (Browsing still has to be enabled). Since enable_browsing
       now works for exporting printers, too, this Closes: LP#17981
     - Add some comments to point out that the Port and Browsing settings are
       moved to /etc/cups/cups.d/.
   * debian/cupsys.postrm: Clean up passwd.md5 on purge.
   * debian/cupsys.init.d: Pre-create error_log, too, and clean up code a bit.
     Closes: LP#41267
   * debian/cupsys.postinst: If upgrading from Breezy, adapt the inclusion of
     external browsing configuration in cupsd.conf to retain the correct
     setting for modified cupsd.conf files.
   * debian/cupsys.config:
     - Fix handling of cupsd-browsing.conf -> cups.d/browse.conf transition for
       breezy->dapper upgrades.
     - Fix browse.conf parsing to set the correct debconf default value, so
       that the browse setting is not reset to 'off' on upgrades.
       Closes: LP#38704
   * Add debian/patches/57_svn_5461.dpatch:
     - Properly HTML-quote the printer name so that names containing e. g. '+'
       work properly in the web interface.
     - Upstream svn commit 5461.
     - Closes: LP#37018

[P (p92)]

I'm afraid this is not fixed - the attached patch will really fix log file creation issue :)

$l_toto should be written ${l}_toto

I suggest ALL file creation done in /etc/init.d scripts be checked for such syntax error !

[P (p92)]

fix for the variable substitution syntax error

[P (p92)]

please apply fix attached :)

[Martin Pitt (pitti)]

Whoops, my bad. Thank you!

[davew (dpwnospam)]

I think that there may also be an issue with the cupsys logrotate script. The script in 1.1.99.rc3-0ubuntu1 creates the log files with owner root and group lp. Since cupsysd runs as user cupsys, it doesn't have access to the log file.

etc/logrotate.d/cupsys:
/var/log/cups/*log {
        daily
        missingok
        rotate 7
        sharedscripts
        postrotate
                if [ -e /var/run/cups/cupsd.pid ]; then
                        invoke-rc.d --quiet cupsys force-reload > /dev/null
                        sleep 10
                fi
        endscript
        compress
        notifempty
        create 640 root lp
}

[P (p92)]

ho, I completly agree too! That's why I found the log files to change owner and group after a day ...

logs are created cupsys:lpadmin and then change to root:lp

[Rui Matos (tiagomatos)]

This problem isn't fully solved.

[Patrice Vetsel (vetsel-patrice)]

I close this bug because there is no more bugs.
Cupsys can create logs.
Cupsys can read logs because is in lp group
Do a clean install or upgrade and delete logs files with root.

Please reopen if you have more information at hand.

[Martin Pitt (pitti)]

Reopening, I fixed it locally, but didn't upload yet (Flight-7 freeze)

[Martin Pitt (pitti)]

 cupsys (1.1.99.rc3-0ubuntu2) dapper; urgency=low
 .
   * debian/cupsys.init.d: Fix log creation for real. Closes: LP#41267
   * debian/cupsys.logrotate: Create files as cupsys:lpadmin, not root:lp.
     (Also part of LP#41267)

[adam.hawthorne (adam-hawthorne)]

This is still not fixed. On a fresh install of feisty, I still see the following in syslog:

Jul 10 07:35:04 zadok cupsd: Unable to open log file "/var/log/cups/error_log" - Permission denied

Here is the listing for that directory:

[ahawtho@zadok tmp]$ ll /var/log/cups
total 60
drwxr-xr-x 2 root root 4096 2007-07-10 07:35 ./
drwxr-xr-x 9 root root 4096 2007-07-10 07:37 ../
-rw-r----- 1 cupsys lpadmin 0 2007-07-06 07:37 access_log
-rw-r--r-- 1 cupsys lp 207 2007-07-05 11:59 access_log.1.gz
-rw-r--r-- 1 cupsys lp 137 2007-07-04 19:10 access_log.2.gz
-rw-r--r-- 1 cupsys lp 134 2007-07-03 08:13 access_log.3.gz
-rw-r----- 1 cupsys lpadmin 144 2007-06-29 13:28 access_log.4.gz
-rw-r----- 1 cupsys lpadmin 124 2007-06-25 00:53 access_log.5.gz
-rw-r----- 1 cupsys lpadmin 843 2007-07-10 07:35 error_log
-rw-r----- 1 cupsys lpadmin 358 2007-07-09 07:35 error_log.1.gz
-rw-r----- 1 cupsys lpadmin 364 2007-07-08 07:35 error_log.2.gz
-rw-r----- 1 cupsys lpadmin 357 2007-07-07 07:35 error_log.3.gz
-rw-r----- 1 cupsys lpadmin 585 2007-07-06 13:16 error_log.4.gz
-rw-r--r-- 1 cupsys lpadmin 484 2007-07-05 11:59 error_log.5.gz
-rw-r----- 1 cupsys lpadmin 110 2007-06-30 22:01 error_log.6.gz
-rw-r----- 1 cupsys lpadmin 95 2007-06-27 09:00 error_log.7.gz
-rw-r----- 1 cupsys lpadmin 0 2007-06-21 23:44 page_log

and cupsd is running as user 'lp':

[ahawtho@zadok tmp]$ ps auxw | grep cupsd
lp 10308 0.0 0.0 4704 1816 ? SNs 07:35 0:00 /usr/sbin/cupsd
ahawtho 11000 0.0 0.0 2888 776 pts/3 S+ 09:10 0:00 grep cupsd

According to /proc/10308, it also is running with group lpadmin:

[ahawtho@zadok tmp]$ ll -d /proc/10308
dr-xr-xr-x 5 lp lpadmin 0 2007-07-10 08:44 /proc/10308/

/etc/cups/cupsd.conf has the lines:

User lp
...
Group lpadmin

But /etc/init.d/cupsys has seemingly conflicting permissions (look for ####):

case "$1" in
  start)
 log_begin_msg "Starting $DESC: $NAME"
        #### Here, we have root:lpadmin, with 3775
 chown root:lpadmin /usr/share/ppd/custom 2>/dev/null || true
 chmod 3775 /usr/share/ppd/custom 2>/dev/null || true
 mkdir -p `dirname "$PIDFILE"`
        #### Here we have cupsys:lp (not lpadmin), but the directory shows lp:lpadmin
 chown cupsys:lp `dirname "$PIDFILE"`

 # create the logs file since cupsd can't
 for l in access_log page_log error_log; do
     [ -e /var/log/cups/$l ] || touch /var/log/cups/$l
     chmod 640 /var/log/cups/$l
            #### Here we have cupsys:lpadmin, with permissions 640, but since cupsd is run as user 'lp', not 'cupsys', these files are not writable
     chown cupsys:lpadmin /var/log/cups/$l
 done

 if [ "$LOAD_LP_MODULE" = "yes" -a -f /usr/lib/cups/backend/parallel \
             -a -f /proc/devices -a -f /proc/modules \
      -a -x /sbin/modprobe ]; then
   modprobe -q lp || true
   modprobe -q ppdev || true # for ISO-1284 device name detection
 fi

 start-stop-daemon --start --quiet --oknodo --pidfile "$PIDFILE" --exec $DAEMON

 # Correct the permissions after starting the CUPS daemon
 for l in access_log page_log error_log; do
     chmod 640 /var/log/cups/$l || true
            #### Here again, cupsys:lpadmin, but cupsd is lp:lpadmi...

[Martin Pitt (pitti)]

It is finally fixed in gutsy now, with the replacement of the derooting patches with an AppArmor profile.