apparmor prevents cups-pdf from printing to ~/PDF

[shuvam]

Binary package hint: apparmor

My cups-pdf cannot print to my ~/PDF if apparmor is active. Doing "service apparmor stop"
allows printing-to-PDF to happen.

I suspect this is because my /home/username is a symlink to /warehouse/home/username.
(My laptop's /warehouse is a separate partition). Whether this is caused because I have
a symlink in the path, or because there is a file-system-boundary traversal by the
symlink, I don't know.

I found that adding two lines to /etc/apparmor.d/usr.sbin.cupsd solved the problem:

 /warehouse/home/shuvam/PDF/ rw,
  /warehouse/home/shuvam/PDF/* rw,
  @{HOME}/PDF/ rw,
  @{HOME}/PDF/* rw,

The two @{HOME} lines were already present --- I just added the /warehouse/home/...
lines. It is therefore clear that something additional needs to be done about apparmor
configuration for cups-pdf if there is a symlink or a file-system-traversal in the path
of the ~/PDF.

I don't know whether this is an apparmor bug or a cups-pdf bug.

ProblemType: Bug
ApparmorStatusOutput:
 Error: command /usr/sbin/apparmor_status failed with exit code 4: You do not have enough privilege to read the profile set.
 apparmor module is loaded.
Architecture: i386
Date: Sun Feb 7 20:23:17 2010
DistroRelease: Ubuntu 9.10
InstallationMedia: Ubuntu 9.10 "Karmic Koala" - Release i386 (20091028.5)
NonfreeKernelModules: vmnet vmci vmmon
Package: apparmor 2.3.1+1403-0ubuntu27.3
ProcEnviron:
 PATH=(custom, user)
 LANG=en_IN
 SHELL=/bin/bash
ProcVersionSignature: Ubuntu 2.6.31-14.48-generic
SourcePackage: apparmor
Uname: Linux 2.6.31-14-generic i686

[Jamie Strandboge (jdstrand)]

Thank you for the time to report this bug and helping to make Ubuntu better. We appreciate the difficulties you are facing, but this bug has already been reported. Please review https://wiki.ubuntu.com/DebuggingApparmor#Adjusting%20Tunables as well as the information and solution in bug #447292.