cups missing write permission (for sendmessage operation) in apparmor

[Ömer Fadıl USTA]

After updating recent version of cups (2.3.3op1-3ubuntu1) :
I have started to get errors about its missing permissions on journal

audit[29527]: AVC apparmor="DENIED" operation="sendmsg" profile="/usr/sbin/cupsd" name="/run/systemd/notify" pid=29527 comm="cupsd" requested_mask="w" denied_mask="w" fsuid=0 ouid=0
kernel: audit: type=1400 audit(1608880333.084:56): apparmor="DENIED" operation="sendmsg" profile="/usr/sbin/cupsd" name="/run/systemd/notify" pid=29527 comm="cupsd" requested_mask="w" denied_mask="w" fsuid=0 ouid=0
---
ProblemType: Bug
ApportVersion: 2.20.11-0ubuntu55
Architecture: amd64
CasperMD5CheckResult: skip
CupsErrorLog: E [25/Dec/2020:10:11:15 +0300] [CGI] ippfind (PID 12144) stopped with status 1!
CurrentDesktop: ubuntu:GNOME
DistroRelease: Ubuntu 21.04
InstallationDate: Installed on 2020-12-25 (0 days ago)
InstallationMedia: Ubuntu 21.04 "Hirsute Hippo" - Alpha amd64 (20201224)
KernLog:

Lpstat: Error: command ['lpstat', '-v'] failed with exit code 1: lpstat: No destinations added.
MachineType: LENOVO INVALID
NonfreeKernelModules: nvidia_modeset nvidia
Package: cups 2.3.3op1-3ubuntu1
PackageArchitecture: amd64
Papersize: a4
ProcCmdline: BOOT_IMAGE=/@/boot/vmlinuz-5.8.0-34-generic root=UUID=b42aef37-b541-43bb-bef8-2dcb8f34df09 ro rootflags=subvol=@ quiet splash vt.handoff=7
ProcKernelCmdLine: BOOT_IMAGE=/@/boot/vmlinuz-5.8.0-34-generic root=UUID=b42aef37-b541-43bb-bef8-2dcb8f34df09 ro rootflags=subvol=@ quiet splash vt.handoff=7
ProcVersionSignature: Ubuntu 5.8.0-34.37+21.04.1-generic 5.8.18
Tags: hirsute package-from-proposed
Uname: Linux 5.8.0-34-generic x86_64
UpgradeStatus: No upgrade log present (probably fresh install)
UserGroups: adm cdrom dip lpadmin lxd plugdev sambashare sudo
_MarkForUpload: True
dmi.bios.date: 01/11/2019
dmi.bios.release: 1.45
dmi.bios.vendor: LENOVO
dmi.bios.version: 4KCN45WW
dmi.board.asset.tag: NO Asset Tag
dmi.board.name: VIUU4
dmi.board.vendor: LENOVO
dmi.board.version: NO DPK
dmi.chassis.asset.tag: NO Asset Tag
dmi.chassis.type: 10
dmi.chassis.vendor: LENOVO
dmi.chassis.version: INVALID
dmi.ec.firmware.release: 1.45
dmi.modalias: dmi:bvnLENOVO:bvr4KCN45WW:bd01/11/2019:br1.45:efr1.45:svnLENOVO:pnINVALID:pvrINVALID:rvnLENOVO:rnVIUU4:rvrNODPK:cvnLENOVO:ct10:cvrINVALID:
dmi.product.family: IDEAPAD
dmi.product.name: INVALID
dmi.product.sku: LENOVO_BI_IDEAPAD4K_BU_idea_FM_
dmi.product.version: INVALID
dmi.sys.vendor: LENOVO

[lotuspsychje (lotuspsychje)]

Thank you for taking the time to report this bug and helping to make Ubuntu better. Please execute the following command only once, as it will automatically gather debugging information, in a terminal:
apport-collect 1909297

When reporting bugs in the future please use apport by using 'ubuntu-bug' and the name of the package affected. You can learn more about this functionality at https://wiki.ubuntu.com/ReportingBugs.

[Ömer Fadıl USTA (omerusta)]

apport information

[Ömer Fadıl USTA (omerusta)]

apport information

[Ömer Fadıl USTA (omerusta)]

apport information

[Ömer Fadıl USTA (omerusta)]

apport information

[Ömer Fadıl USTA (omerusta)]

apport information

[Ömer Fadıl USTA (omerusta)]

apport information

[Ömer Fadıl USTA (omerusta)]

apport information

[Ömer Fadıl USTA (omerusta)]

apport information

[Ömer Fadıl USTA (omerusta)]

apport information

[Ömer Fadıl USTA (omerusta)]

apport information

[Ömer Fadıl USTA (omerusta)]

apport information

[Ömer Fadıl USTA (omerusta)]

apport information

[Ömer Fadıl USTA (omerusta)]

apport information

[Ömer Fadıl USTA (omerusta)]

apport information

[Ömer Fadıl USTA (omerusta)]

apport information

[Ömer Fadıl USTA (omerusta)]

apport information

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[rew (r-e-wolff)]

Soo.... any progress about this in 6 months?

[rew (r-e-wolff)]

Hi,

I got fed up and figured out how to configure apparmor to allow it.

I added

# *** Added by rew.
  /run/systemd/notify rw,

near line 108 of /etc/apparmor.d/usr.sbin.cupsd

That solves it.

[Christian Göbel (christiangoebel)]

@r-e-wolff Thank you!
I had a similar issue - and could solve my issue by editing the apparmor profile.

The missing permission in apparmor was preventing the complete start of the CUPS Scheduler (on Ubuntu 22.04) .

systemctl status cups:
"Starting CUPS Scheduler" was visible, but the cups service never got to the status "Started", (The starting job never completely finished).

Therefore, every minute systemd tried to start the cups scheduler again and again (in an endless loop).
Printing actually worked, but whenever systemd tried starting cups scheduler the running printing job was aborted. :-/

The apparmor file for cupsd:_
/etc/apparmor.d/usr.sbin.cupsd

The following line was added to solve my issue:
/run/systemd/notify rw,

Additional notes: This was an dist-upgrade from Ubuntu 20.04 (not sure it this is relevant)

Edit: Now I realized that I did edit the apparmor profile for cups, myself, several months ago. When dis-upgrading to 22.04, I decided to keep the old apparmor profile - so my problem was likely caused by keeping the old (ubuntu 20.04) profile.
 Sorry for the noise.