Print jobs hang in the print queue due to permission issues

[Bowmore]

Binary package hint: cups-pdf

Package: cups-pdf 2.5.0-15

Error in script: /var/lib/dpkg/info/cups-pdf.postinst
This script sets permissions that cause the printing problem.

cups-pdf.postinst lines 10-12
------------------------------------
# Sanitize ownerships and permissions.
chmod 0700 /usr/lib/cups/backend
chmod 0700 /usr/lib/cups/backend/cups-pdf

Package cups-pdf must not change permissions for /usr/lib/cups/backend

Solution:
Remove line 11
chmod 0700 /usr/lib/cups/backend

Workaround:
Resetting permissions with
sudo chmod a+rx /usr/lib/cups/backend
resolves the printing problem.

[Bowmore (bowmore)]

This print queue problem is caused by the attempt to solve another problem reported in
https://bugs.launchpad.net/ubuntu/+source/cups/+bug/580837

[Bowmore (bowmore)]

Reason for hanging jobs: /usr/lib/cups/backend/smb failed

[Martin-Éric Racine (q-funk)]

2.5.0-16 was uploaded to Maverick to fix this and it would need to be pushed to Lucid and Karmic as well.

[Bowmore (bowmore)]

During the period running cupd-pdf ver 2.5.0-15 plus the manual revert of the /usr/lib/cups/backend to 755 everything worked fine. Today's attempt to print a pdf failed with the cause /usr/lib/cups/backend/cupd-pdf failed! Note that my previous attempt to print a pdf was on June 15th an then worked fine.

Package installed:
cupd-pdf ver 2.5.0-16

Whether this is due to a bug in cups-pdf ver 2.5.0-16 or some other update in Maverick is hard to say but the new cups-pdf package is suspected to cause this.

Everything works fine in Lucid with package cups-pdf ver 2.5.0-12.

[Bowmore (bowmore)]

Sorry, cupd-pdf should be cups-pdf above.

[Till Kamppeter (till-kamppeter)]

Bug 596611 is similar but not caused by cups-pdf.

[Bowmore (bowmore)]

> Bug 596611 is similar but not caused by cups-pdf.
I'll keep an eye on that one, though the only case that doesn't work here is cups-pdf printing.

Some investigations:
Reverted back to cups-pdf 2.5.0-15 and chmod 0755 /usr/lib/cups/backend/cups-pdf. This time this doesn't work, i.e now receiving /usr/lib/cups/backend/cups-pdf failed. Thus, it doesn't seem to be the upgrade itself from 2.5.0-15 to 2.5.0-16 that causes the failure now.

Notable is that /var/spool/cups-pdf/SPOOL doesn't exist.

$ ls -dl /var/spool/cups-pdf/ANONYMOUS
drwxrwxrwt 2 root lpadmin 4096 2010-06-08 10:58 /var/spool/cups-pdf/ANONYMOUS

Extract from syslog:
Jun 28 19:18:48 maverick kernel: [ 1046.369979] audit_printk_skb: 8824 callbacks suppressed
Jun 28 19:18:48 maverick kernel: [ 1046.369986] type=1400 audit(1277745528.723:8872): operation="getattr" pid=2962 parent=1288 profile="/usr/lib/cups/backend/cups-pdf" name="/var/log/cups/" pid=2962 comm="cups-pdf" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
Jun 28 19:18:48 maverick kernel: [ 1046.370016] type=1400 audit(1277745528.723:8873): operation="getattr" pid=2962 parent=1288 profile="/usr/lib/cups/backend/cups-pdf" name="/var/log/cups/" pid=2962 comm="cups-pdf" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
Jun 28 19:18:48 maverick kernel: [ 1046.370060] type=1400 audit(1277745528.723:8874): operation="getattr" pid=2962 parent=1288 profile="/usr/lib/cups/backend/cups-pdf" name="/var/log/" pid=2962 comm="cups-pdf" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
Jun 28 19:18:48 maverick kernel: [ 1046.370094] type=1400 audit(1277745528.723:8875): operation="getattr" pid=2962 parent=1288 profile="/usr/lib/cups/backend/cups-pdf" name="/var/" pid=2962 comm="cups-pdf" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
Jun 28 19:18:48 maverick kernel: [ 1046.370124] type=1400 audit(1277745528.723:8876): operation="getattr" pid=2962 parent=1288 profile="/usr/lib/cups/backend/cups-pdf" name="/" pid=2962 comm="cups-pdf" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
Jun 28 19:18:48 maverick kernel: [ 1046.370157] type=1400 audit(1277745528.723:8877): operation="getattr" pid=2962 parent=1288 profile="/usr/lib/cups/backend/cups-pdf" name="/" pid=2962 comm="cups-pdf" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
Jun 28 19:18:48 maverick kernel: [ 1046.370190] type=1400 audit(1277745528.723:8878): operation="getattr" pid=2962 parent=1288 profile="/usr/lib/cups/backend/cups-pdf" name="/" pid=2962 comm="cups-pdf" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
Jun 28 19:18:48 maverick kernel: [ 1046.370228] type=1400 audit(1277745528.723:8879): operation="getattr" pid=2962 parent=1288 profile="/usr/lib/cups/backend/cups-pdf" name="/" pid=2962 comm="cups-pdf" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
Jun 28 19:18:48 maverick kernel: [ 1046.370260] type=1400 audit(1277745528.723:8880): operation="getattr" pid=2962 parent=1288 profile="/usr/lib/cups/backend/cups-pdf" name="/" pid=2962 comm="cups-pdf" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
Jun 28 19:18:48 maverick kernel: [ 1046.370293] type=1400 audit(1277745528.723:8881): operation="getattr" pid=2962 parent=1288 profile="/usr/lib/cups/back...

[Bowmore (bowmore)]

In my case it looks like a Maverick linux kernel issue!

Cups-pdf 2.5.0-15 (incl fix) and 2.5.0-15 both work with kernels up to version 2.6.35-5.6. However, when booting current kernel 2.6.35-6.8 cups-pdf no longer works.

The missing /var/spool/cups-pdf/SPOOL is created for previous kernel versions.

[Bowmore (bowmore)]

Should be "Cups-pdf 2.5.0-15 (incl fix) and 2.5.0-16 both work ..." above.

[Martin-Éric Racine (q-funk)]

Sounds like the Linux kernel security model has changed again, which probably broke our AppArmor profile once more.

[Bowmore (bowmore)]

Yes, there are some AppArmor changes i the change log for linux (2.6.35-6.7) maverick.

[ John Johansen ]

  * SAUCE: AppArmor: -- mainline 2010-06-23
  * SAUCE: AppArmor 2.4 compatibility patch
  * SAUCE: fs: block hardlinks to non-accessible sources AppArmor portion

[Bowmore (bowmore)]

A workaround until profile /usr/lib/cups/backend/cups-pdf is fixed
$ sudo aa-complain /usr/sbin/cupsd

Reset to normal again when profile fixed
$ sudo aa-enforce /usr/sbin/cupsd

[Paulo J. S. Silva (pjssilva)]

I am also affected by this bug. Hence the fix does not work for all.

This is a "fresh" (in the sense that it was not upgraded) install of Lucid.

I also tried to install manually Maverick's package but it did not solve the problem. I have also tried to create a new user to test and I could not print using this new user either.

The workaround suggested Bowmore works.

[Martin-Éric Racine (q-funk)]

Thank you for taking the time to report this bug. Could you please test this against the current version of "cups-pdf" found in my Personal Package Archive (PPA) at https://launchpad.net/~q-funk/+archive/ppa and confirm whether the issue still applies?

[Launchpad Janitor (janitor)]

[Expired for cups-pdf (Ubuntu) because there has been no activity for 60 days.]