apparmor /var/lib/ghostscript/fonts/Fontmap

Bug #623586 reported by Thomas on 2010-08-24
12
This bug affects 1 person
Affects Status Importance Assigned to Milestone
apparmor (Ubuntu)
High
Jamie Strandboge
Lucid
Undecided
Unassigned

Bug Description

Binary package hint: cups

I set up my Canon BJC-7000 Parallel Printer... but when I try to print there is nothing.. no errormessages in cups protocol and nothing on my printer...

But in /var/log/messages I could find this:

Aug 24 22:04:46 PC kernel: [14145.790388] type=1400 audit(1282680286.209:15): apparmor="DENIED" operation="open" parent=23132 profile="/usr/sbin/cupsd" name="/var/lib/ghostscript/fonts/cidfmap" pid=23133 comm="gs" requested_mask="r" denied_mask="r" fsuid=7 ouid=0
Aug 24 22:04:46 PC kernel: [14145.805484] type=1400 audit(1282680286.225:16): apparmor="DENIED" operation="open" parent=23132 profile="/usr/sbin/cupsd" name="/var/lib/ghostscript/fonts/Fontmap" pid=23133 comm="gs" requested_mask="r" denied_mask="r" fsuid=7 ouid=0
Aug 24 22:04:46 PC kernel: [14145.877277] type=1400 audit(1282680286.297:17): apparmor="DENIED" operation="open" parent=23135 profile="/usr/sbin/cupsd" name="/var/lib/ghostscript/fonts/cidfmap" pid=23137 comm="gs" requested_mask="r" denied_mask="r" fsuid=7 ouid=0
Aug 24 22:04:46 PC kernel: [14145.892279] type=1400 audit(1282680286.309:18): apparmor="DENIED" operation="open" parent=23135 profile="/usr/sbin/cupsd" name="/var/lib/ghostscript/fonts/Fontmap" pid=23137 comm="gs" requested_mask="r" denied_mask="r" fsuid=7 ouid=0
Aug 24 22:06:16 PC kernel: [14235.672226] type=1400 audit(1282680376.093:19): apparmor="DENIED" operation="open" parent=23215 profile="/usr/sbin/cupsd" name="/var/lib/ghostscript/fonts/cidfmap" pid=23216 comm="gs" requested_mask="r" denied_mask="r" fsuid=7 ouid=0
Aug 24 22:06:16 PC kernel: [14235.690299] type=1400 audit(1282680376.109:20): apparmor="DENIED" operation="open" parent=23215 profile="/usr/sbin/cupsd" name="/var/lib/ghostscript/fonts/Fontmap" pid=23216 comm="gs" requested_mask="r" denied_mask="r" fsuid=7 ouid=0
Aug 24 22:06:16 PC kernel: [14235.746661] type=1400 audit(1282680376.165:21): apparmor="DENIED" operation="open" parent=23217 profile="/usr/sbin/cupsd" name="/var/lib/ghostscript/fonts/cidfmap" pid=23219 comm="gs" requested_mask="r" denied_mask="r" fsuid=7 ouid=0
Aug 24 22:06:16 PC kernel: [14235.766810] type=1400 audit(1282680376.185:22): apparmor="DENIED" operation="open" parent=23217 profile="/usr/sbin/cupsd" name="/var/lib/ghostscript/fonts/Fontmap" pid=23219 comm="gs" requested_mask="r" denied_mask="r" fsuid=7 ouid=0
Aug 24 22:09:01 PC kernel: [14400.792169] type=1400 audit(1282680541.209:23): apparmor="DENIED" operation="open" parent=23424 profile="/usr/sbin/cupsd" name="/var/lib/ghostscript/fonts/cidfmap" pid=23425 comm="gs" requested_mask="r" denied_mask="r" fsuid=7 ouid=0
Aug 24 22:09:01 PC kernel: [14400.807397] type=1400 audit(1282680541.225:24): apparmor="DENIED" operation="open" parent=23424 profile="/usr/sbin/cupsd" name="/var/lib/ghostscript/fonts/Fontmap" pid=23425 comm="gs" requested_mask="r" denied_mask="r" fsuid=7 ouid=0
Aug 24 22:09:01 PC kernel: [14400.853995] type=1400 audit(1282680541.273:25): apparmor="DENIED" operation="open" parent=23426 profile="/usr/sbin/cupsd" name="/var/lib/ghostscript/fonts/cidfmap" pid=23428 comm="gs" requested_mask="r" denied_mask="r" fsuid=7 ouid=0
Aug 24 22:09:01 PC kernel: [14400.869560] type=1400 audit(1282680541.289:26): apparmor="DENIED" operation="open" parent=23426 profile="/usr/sbin/cupsd" name="/var/lib/ghostscript/fonts/Fontmap" pid=23428 comm="gs" requested_mask="r" denied_mask="r" fsuid=7 ouid=0

ProblemType: Bug
DistroRelease: Ubuntu 10.10
Package: cups 1.4.4-3
ProcVersionSignature: Ubuntu 2.6.35-17.23-generic 2.6.35.2
Uname: Linux 2.6.35-17-generic i686
NonfreeKernelModules: nvidia
Architecture: i386
Date: Tue Aug 24 22:11:51 2010
InstallationMedia: Ubuntu 10.10 "Maverick Meerkat" - Alpha i386 (20100803.1)
Lpstat: device for Canon-BJC-7000: parallel:/dev/lp0
MachineType: OEM OEM
Papersize: a4
PpdFiles: Canon-BJC-7000: Canon BJC-7000 Foomatic/bjc800
ProcCmdLine: BOOT_IMAGE=/boot/vmlinuz-2.6.35-17-generic root=UUID=f1339a99-4238-447a-8262-40a42660939b ro quiet splash
ProcEnviron:
 LANG=de_DE.utf8
 SHELL=/bin/bash
SourcePackage: cups
dmi.bios.date: 05/05/2009
dmi.bios.vendor: Phoenix Technologies, LTD
dmi.bios.version: 6.00 PG
dmi.board.name: G31MX Series
dmi.board.vendor: Foxconn
dmi.chassis.type: 3
dmi.chassis.vendor: OEM
dmi.chassis.version: OEM
dmi.modalias: dmi:bvnPhoenixTechnologies,LTD:bvr6.00PG:bd05/05/2009:svnOEM:pnOEM:pvrOEM:rvnFoxconn:rnG31MXSeries:rvr:cvnOEM:ct3:cvrOEM:
dmi.product.name: OEM
dmi.product.version: OEM
dmi.sys.vendor: OEM

Related branches

Thomas (t.c) wrote :
Till Kamppeter (till-kamppeter) wrote :

Can you attach the file(s) which you tried to print? Thanks.

Changed in cups (Ubuntu):
importance: Undecided → Medium
milestone: none → ubuntu-10.10
status: New → Confirmed
status: Confirmed → Incomplete
Till Kamppeter (till-kamppeter) wrote :

The file

/etc/apparmor.d/abstractions/fonts

needs the line

/var/lib/ghostscript/** r,

added, as Ghostscript can access fonts also through this directory.

Probably this problem only occured now because we recently dropped use of Defoma by Ghostscript (bug 584597). So for Maverick we need this line added, so that Ghostscript can access all fonts when running under AppArmor-protected CUPS.

affects: cups (Ubuntu) → apparmor (Ubuntu)
Changed in apparmor (Ubuntu):
status: Incomplete → Triaged
importance: Medium → High
Changed in apparmor (Ubuntu):
assignee: nobody → Jamie Strandboge (jdstrand)
Changed in apparmor (Ubuntu):
status: Triaged → In Progress
Changed in apparmor (Ubuntu):
status: In Progress → Fix Committed
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package apparmor - 2.5.1~pre1393-0ubuntu6

---------------
apparmor (2.5.1~pre1393-0ubuntu6) maverick; urgency=low

  * debian/profiles/chromium-browser: updated to have the proper path to
    local/
  * debian/patches/0011-lp514356+573344+593413.patch: browser abstraction
    updates for /net, kmozillahelper and gnome-appearance-properties
    (LP: #593413, LP: #514356, LP: #573344)
  * debian/patches/0012-lp625041.patch: add sensible-browser (LP: #625041)
  * debian/patches/0013-lp623586.patch: allow access to ghostscript fonts when
    not using defoma (LP: #623586)
 -- Jamie Strandboge <email address hidden> Fri, 03 Sep 2010 07:39:31 -0500

Changed in apparmor (Ubuntu):
status: Fix Committed → Fix Released

Accepted apparmor into lucid-proposed, the package will build now and be available in a few hours. Please test and give feedback here. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you in advance!

Changed in apparmor (Ubuntu Lucid):
status: New → Fix Committed
tags: added: verification-needed
Jamie Strandboge (jdstrand) wrote :

Lucid not affected. Update fonts abstraction to include new ghostscript path. Upgrading to 2.5.1-0ubuntu0.10.04.1 in lucid-proposed showed no regressions.

tags: added: verification-done
removed: verification-needed
Launchpad Janitor (janitor) wrote :
Download full text (10.1 KiB)

This bug was fixed in the package apparmor - 2.5.1-0ubuntu0.10.04.1

---------------
apparmor (2.5.1-0ubuntu0.10.04.1) lucid-proposed; urgency=low

  * Backport 2.5.1-0ubuntu0.10.10.1 from maverick for userspace tools to work
    with newer kernels (LP: #660077)
    NOTE: user-tmp now uses 'owner' match, so non-default profiles will have
    to be adjusted when 2 separately confined applications that both use the
    user-tmp abstraction depend on being able to cooperatively share files
    with each other in /tmp or /var/tmp.
  * remove the following patches (features not appropriate for SRU):
    - 0002-add-chromium-browser.patch
    - 0003-local-includes.patch
    - 0004-ubuntu-abstractions-updates.patch
  * debian/rules (this makes it the same as what was shipped in 10.04 LTS
    release):
    - don't ship aa-update-browser and its man page (requires
      0004-ubuntu-abstractions-updates.patch)
    - don't ship apparmor.d/local/ (requires 0003-local-includes.patch)
    - don't use dh_apparmor (not in Ubuntu 10.04 LTS)
    - don't ship chromium profile
  * remove debian/profiles/chromium-browser
  * remove debian/aa-update-browser*
  * debian/apparmor-profiles.postinst: revert to that in lucid release
    (requires dh_apparmor and 0002-add-chromium-browser.patch)
  * remove debian/apparmor-profiles.postrm: doesn't make sense without
    0002-add-chromium-browser.patch
  * debian/control:
    - revert Build-Depends on debhelper (>= 5)
    - revert Standards-Version to 3.8.4
    - revert Vcs-Bzr
    - use Conflicts/Replaces version that was in Ubuntu 10.04 LTS
  * debian/patches/0011-lucid-compat-dbus.patch: move /var/lib/dbus/machine-id
    back into dbus, since profiles on 10.04 LTS expect it there
  * debian/patches/0012-lucid-compat-kde.patch: add kde4-config to kde
    abstraction, since the firefox profile on Ubuntu 10.04 LTS expects it to
    be there

apparmor (2.5.1-0ubuntu0.10.10.2) maverick-proposed; urgency=low

  * New upstream release (LP: #660077)
    - The following patches were refreshed:
      + 0001-fix-release.patch
      + 0003-local-includes.patch
      + 0004-ubuntu-abstractions-updates.patch
      + 0008-lp648900.patch: renamed as 0005-lp648900.patch
    - The following patches were dropped (included upstream):
      + 0005-lp601583.patch
      + 0006-network-interface-enumeration.patch
      + 0007-gnome-updates.patch
  * debian/patches/0006-testsuite-fixes.patch: testsuite fixes from head
    of 2.5 branch. These are needed for QRT and SRU testing (LP: #652211)
  * debian/patches/0007-honor-cflags.patch: have the parser makefile honor
    CFLAGS environment variable. Brings back missing symbols for the retracer
  * debian/patches/0008-lp652674.patch: fix warnings for messages without
    denied or requested masks (LP: #652674)
  * debian/apparmor.init: fix path to aa-status (LP: #654841)
  * debian/apport/source_apparmor.py: apport hook should use
    root_command_hook() for running apparmor_status (LP: #655529)
  * debian/apport/source_apparmor.py: use ProcKernelCmdline and don't clobber
    cmdline details (LP: #657091)
  * debian/{rules,control}: move apache2 abstractions into the base package
    so we can put ...

Changed in apparmor (Ubuntu Lucid):
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers