apparmor preventing cupsd from being able to print to LPD printers

[Ali Sheikh]

Binary package hint: apparmor

Since upgrading to intrepid, I can no longer print to LPD printers on the network. I have narrowed this problem down to apparmor handcuffing the cups daemon too much.

If I remove /etc/apparmor.d/usr.sbin.cupsd and then restart cupsd and apparmor, I can print.

If I re-instate /etc/apparmor.d/usr.sbin.cupsd and then restart appamor and cupds I can no longer print.

I originally reported this here: https://bugs.launchpad.net/ubuntu/intrepid/+source/cups/+bug/254022/comments/19 but was told to open a new bug report.

[Ali Sheikh (asheikh)]

Assigning to Martin Pitt, as requested. Let me know if there is any more information I can provide, or experiments I can do to help debug this.

Further, here are the symptoms that I see from cupsd when I try to print (with the /etc/apparmor.d/usr.sbin.cupsd in place): Upon requesting a test-page from the printer properties panel, I get an error dialog box with the following message:

Print Error
There was a problem sending document 'Test Page' (job 12)
to the printer. The printer called `pd201` has been disabled.
[Diagnose] [OK]

Further, the printer state in cups switches to "Stopped -- Unable to locate printer 'printserver.example.com'!

Also note that this seems only to effect lpd printing so far. I am able to print to my samba shared server at home.

[Martin Pitt (pitti)]

Nov 10 16:22:12 crazy88 kernel: [63322.841254] type=1503 audit(1226352132.329:10): operation="inode_permission" requested_mask="r::" denied_mask="r::" fsuid=0 name="/etc/resolvconf/run/resolv.conf" pid=4507 profile="/usr/sbin/cupsd"

Ah, apparently you have resolvconf installed. I don't see any other AppArmor policy violations, so this is a duplicate of bug 286080. A fix is currently being tested in intrepid-proposed. Can you please restore the cups AppArmor profile, install apparmor from intrepid-proposed, and re-test? Please give feedback in bug 286080 then.

Thank you!

[Ali Sheikh (asheikh)]

Indeed, the fix from 286080 solves this problem.