Comment 1 for bug 1675503

From the denials, it seems like adding this to the cups profile:

  unix peer=(label=/usr/lib/cups/backend/cups-pdf),

and this to cups-pdf:

  /etc/cups/ppd/*.ppd r,
  /var/log/cups/cups-pdf-*_log rw,
  unix peer=(label=/usr/sbin/cupsd),

should fix the issue (untested).