Ubuntu

My Lexmark x2650 printer stopped working after upgrading to 11.10: Idle - File "/usr/local/lexmark/lxk08/bin/printdriver" has insecure permissions (0100775/uid=0/gid=2).

Reported by zsolt.ruszinyák on 2011-12-26
30
This bug affects 6 people
Affects Status Importance Assigned to Milestone
AppArmor
Undecided
Unassigned
cups (Ubuntu)
Undecided
Unassigned

Bug Description

I used Ubuntu 9.04 for a long time and the driver available on the manufacturer's site: http://support.lexmark.com/index?page=content&id=DR860&actp=search&viewlocale=en_US&segment=SUPPORT&productCode=LEXMARK_X2650&locale=EN&userlocale=EN_US&searchid=1324929199490 worked perfectly! after installing the newest Ubuntu, I can't even finish the installation process of the driver, the Setup says "no connection", even though there is connection to the printer, because it appears in the list of printers when introduced to the USB.

from what I have learnt on the web, recent changes in Cups and AppArmor caused that the connection to a printer with 3rd party driver is often blocked. but this is too high a game for me to solve here...

have tried in another machine too, the same result, which means that THIS PRINTER JUST STOPPED WORKING IN LINUX at all. That is sad. I have to go back to older Ubuntu's just for the printer!!!!!!!!!

This is insane.

See my debugging results.

ProblemType: Bug
DistroRelease: Ubuntu 11.10
Package: cups 1.5.0-8ubuntu5
ProcVersionSignature: Ubuntu 3.0.0-13.22-generic 3.0.6
Uname: Linux 3.0.0-13-generic i686
ApportVersion: 1.23-0ubuntu4
Architecture: i386
Date: Mon Dec 26 20:43:21 2011
InstallationMedia: Ubuntu 11.10 "Oneiric Ocelot" - Beta i386 (20110921.2)
Lpstat: device for 2600-Series: usb://Lexmark/2600%20Series?serial=3001960G9644833&interface=1
MachineType: ASUSTeK Computer INC. 1000H
Papersize: letter
PpdFiles: 2600-Series: Lexmark 2600 Series, 1.0
ProcEnviron:
 PATH=(custom, no user)
 LANG=en_US.UTF-8
 SHELL=/bin/bash
ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-3.0.0-13-generic root=UUID=2e7845e1-2b31-4fe5-95bc-334f43798f52 ro quiet splash vt.handoff=7
SourcePackage: cups
UpgradeStatus: No upgrade log present (probably fresh install)
dmi.bios.date: 08/01/2008
dmi.bios.vendor: American Megatrends Inc.
dmi.bios.version: 1005
dmi.board.asset.tag: To Be Filled By O.E.M.
dmi.board.name: 1000H
dmi.board.vendor: ASUSTeK Computer INC.
dmi.board.version: x.xx
dmi.chassis.asset.tag: 0x00000000
dmi.chassis.type: 10
dmi.chassis.vendor: ASUSTek Computer INC.
dmi.chassis.version: x.x
dmi.modalias: dmi:bvnAmericanMegatrendsInc.:bvr1005:bd08/01/2008:svnASUSTeKComputerINC.:pn1000H:pvrx.x:rvnASUSTeKComputerINC.:rn1000H:rvrx.xx:cvnASUSTekComputerINC.:ct10:cvrx.x:
dmi.product.name: 1000H
dmi.product.version: x.x
dmi.sys.vendor: ASUSTeK Computer INC.

Download full text (4.4 KiB)

Try running: sudo aa-logprof

This will walk through almost all the apparmor denied messages and give you a chance to allow or deny the accesses so future runs of the programs can work as you expect. Due to an unfortunate bug, not _all_ apparmor denied messages are handled, so you may need to do some hands-on profile editing.

Iterate the "sudo aa-logprof" and "sudo service cups restart" (at least I think that's the newfangled upstart command) until aa-logprof does ask you any more questions. Then look through dmesg output for the messages that might have slipped through the tools and add "w" permissions for the listed files as appropriate.

-----Original Message-----
From: zsolt.ruszinyák <email address hidden>
Sender: <email address hidden>
Date: Mon, 26 Dec 2011 20:11:26
To: <email address hidden>
Reply-To: Bug 908864 <email address hidden>
Subject: [apparmor] [Bug 908864] Re: My Lexmark x2650 printer stopped
 working after upgrading to 11.10: Idle -
 File "/usr/local/lexmark/lxk08/bin/printdriver" has
 insecure permissions (0100775/uid=0/gid=2).

** Attachment added: "troubleshoot.txt"
   https://bugs.launchpad.net/bugs/908864/+attachment/2647679/+files/troubleshoot.txt

** Also affects: apparmor
   Importance: Undecided
       Status: New

--
You received this bug notification because you are a member of AppArmor
Developers, which is the registrant for AppArmor.
https://bugs.launchpad.net/bugs/908864

Title:
  My Lexmark x2650 printer stopped working after upgrading to 11.10:
  Idle - File "/usr/local/lexmark/lxk08/bin/printdriver" has insecure
  permissions (0100775/uid=0/gid=2).

Status in AppArmor Linux application security framework:
  New
Status in “cups” package in Ubuntu:
  New

Bug description:
  I used Ubuntu 9.04 for a long time and the driver available on the
  manufacturer's site:
  http://support.lexmark.com/index?page=content&id=DR860&actp=search&viewlocale=en_US&segment=SUPPORT&productCode=LEXMARK_X2650&locale=EN&userlocale=EN_US&searchid=1324929199490
  worked perfectly! after installing the newest Ubuntu, I can't even
  finish the installation process of the driver, the Setup says "no
  connection", even though there is connection to the printer, because
  it appears in the list of printers when introduced to the USB.

  from what I have learnt on the web, recent changes in Cups and
  AppArmor caused that the connection to a printer with 3rd party driver
  is often blocked. but this is too high a game for me to solve here...

  have tried in another machine too, the same result, which means that
  THIS PRINTER JUST STOPPED WORKING IN LINUX at all. That is sad. I have
  to go back to older Ubuntu's just for the printer!!!!!!!!!

  This is insane.

  See my debugging results.

  ProblemType: Bug
  DistroRelease: Ubuntu 11.10
  Package: cups 1.5.0-8ubuntu5
  ProcVersionSignature: Ubuntu 3.0.0-13.22-generic 3.0.6
  Uname: Linux 3.0.0-13-generic i686
  ApportVersion: 1.23-0ubuntu4
  Architecture: i386
  Date: Mon Dec 26 20:43:21 2011
  InstallationMedia: Ubuntu 11.10 "Oneiric Ocelot" - Beta i386 (20110921.2)
  Lpstat: device for 2600-Series: usb://Lexmark/2600%20Series?serial=3001...

Read more...

thanks for the tip. well, no luck, repeating the commands gives no result, all the time the same messages:

zsolt@zsolt-1000H:~$ sudo aa-logprof
Reading log entries from /var/log/syslog.
Updating AppArmor profiles in /etc/apparmor.d.
zsolt@zsolt-1000H:~$ sudo service cups restart
cups start/running, process 4564
zsolt@zsolt-1000H:~$

I did it some 50 times consecutively, am I doing something wrong?

> and give you a chance to allow or deny the accesses so future runs of the programs can work as you expect

where is it supposed to give me chances? onscreen?

I was full of hope when trying out this article, but no luck either: http://islandlinux.org/howto/upgrading-ubuntu-breaks-printer-cupsys

Seth Arnold (seth-arnold) wrote :
Download full text (4.4 KiB)

You're running the tools correctly; aa-logprof would ask you questions if there were denied accesses. Check dmesg output to see if there are some apparmor rejections not being picked up by the tools -- if there aren't any, then probably apparmor is happy and the problem lies elsewhere.
-----Original Message-----
From: zsolt.ruszinyák <email address hidden>
Sender: <email address hidden>
Date: Tue, 27 Dec 2011 18:52:45
To: <email address hidden>
Reply-To: Bug 908864 <email address hidden>
Subject: [apparmor] [Bug 908864] Re: My Lexmark x2650 printer stopped
 working after upgrading to 11.10: Idle -
 File "/usr/local/lexmark/lxk08/bin/printdriver" has
 insecure permissions (0100775/uid=0/gid=2).

thanks for the tip. well, no luck, repeating the commands gives no
result, all the time the same messages:

zsolt@zsolt-1000H:~$ sudo aa-logprof
Reading log entries from /var/log/syslog.
Updating AppArmor profiles in /etc/apparmor.d.
zsolt@zsolt-1000H:~$ sudo service cups restart
cups start/running, process 4564
zsolt@zsolt-1000H:~$

I did it some 50 times consecutively, am I doing something wrong?

> and give you a chance to allow or deny the accesses so future runs of
the programs can work as you expect

where is it supposed to give me chances? onscreen?

--
You received this bug notification because you are a member of AppArmor
Developers, which is the registrant for AppArmor.
https://bugs.launchpad.net/bugs/908864

Title:
  My Lexmark x2650 printer stopped working after upgrading to 11.10:
  Idle - File "/usr/local/lexmark/lxk08/bin/printdriver" has insecure
  permissions (0100775/uid=0/gid=2).

Status in AppArmor Linux application security framework:
  New
Status in “cups” package in Ubuntu:
  New

Bug description:
  I used Ubuntu 9.04 for a long time and the driver available on the
  manufacturer's site:
  http://support.lexmark.com/index?page=content&id=DR860&actp=search&viewlocale=en_US&segment=SUPPORT&productCode=LEXMARK_X2650&locale=EN&userlocale=EN_US&searchid=1324929199490
  worked perfectly! after installing the newest Ubuntu, I can't even
  finish the installation process of the driver, the Setup says "no
  connection", even though there is connection to the printer, because
  it appears in the list of printers when introduced to the USB.

  from what I have learnt on the web, recent changes in Cups and
  AppArmor caused that the connection to a printer with 3rd party driver
  is often blocked. but this is too high a game for me to solve here...

  have tried in another machine too, the same result, which means that
  THIS PRINTER JUST STOPPED WORKING IN LINUX at all. That is sad. I have
  to go back to older Ubuntu's just for the printer!!!!!!!!!

  This is insane.

  See my debugging results.

  ProblemType: Bug
  DistroRelease: Ubuntu 11.10
  Package: cups 1.5.0-8ubuntu5
  ProcVersionSignature: Ubuntu 3.0.0-13.22-generic 3.0.6
  Uname: Linux 3.0.0-13-generic i686
  ApportVersion: 1.23-0ubuntu4
  Architecture: i386
  Date: Mon Dec 26 20:43:21 2011
  InstallationMedia: Ubuntu 11.10 "Oneiric Ocelot" - Beta i386 (20110921.2)
  Lpstat: device for 2600-Series: usb://Lexmark/2600%20Series?serial=300196...

Read more...

John Johansen (jjohansen) wrote :

If logprof finds a denied message it understands it should prompt you with a message giving you the chance to allow it. Since this is not happening, it is not finding a message it understands.

I took a look in your currentdmesg and bootdmesg attachments and didn't see any apparmor messages, so I am inclined to believe this is not being caused by apparmor. There are a couple ways to test this

1. Remove the apparmor cups profile
    sudo apparmor_parser -R /etc/apparmor.d/usr.sbin.cupsd
  and then restart cups
   sudo restart cups

2. Remove all apparmor profiles
  sudo /etc/init.d/apparmor stop

and then restart cups
  sudo restart cups

3. If neither of those work, you can completely disable apparmor from boot by adding
  apparmor=0
on the grub command line for the kernel you boot.

Any one of these should establish whether apparmor is the cause, #1 leaves some apparmor protection in place #2, and #3 should completely disable apparmor but #3 makes sure it has never run from boot so that there can not be any residual effects.

If cups is still failing after these we will need to start hunting down none apparmor sources of the problem. If it starts working we will need to start looking into why apparmor is not logging why it denying access to something.

Hello,

I'd say there are some unknown (obsolete?) options in your cups config
file. Quoting from troubleshoot.txt:

'E [26/Dec/2011:20:38:19 +0100] Unknown directive JobPrivateAccess on
line 88.',
'E [26/Dec/2011:20:38:19 +0100] Unknown directive JobPrivateValues on
line 89.',
'E [26/Dec/2011:20:38:19 +0100] Unknown directive
SubscriptionPrivateAccess on line 90.',
'E [26/Dec/2011:20:38:19 +0100] Unknown directive
SubscriptionPrivateValues on line 91.',

My first idea was to remove those options, however google brings up
several things related to Lexmark printers if you search for the error
messages (for example google for "Unknown directive JobPrivateAccess".
Please check if one of the google results is helpful in your case.

Then you have one error message left:

'E [26/Dec/2011:20:38:19 +0100] 2600-Series: File
"/usr/local/lexmark/lxk08/bin/printdriver" has insecure permissions
(0100775/uid=0/gid=2).',

I'd _guess_ this file has too permissive directory permissions -
group write permissions on a file in a .../bin/ directory aren't the
best idea IMHO.
What are the permissions on this file? Check with
    ls -l "/usr/local/lexmark/lxk08/bin/printdriver"
Maybe running
    sudo chmod 755 "/usr/local/lexmark/lxk08/bin/printdriver"
is already enough. You should store the old permissions (as printed by
the "ls" command above) somewhere in case you want to undo the chmod.)

Be warned that I'm using openSUSE ;-) and that my CUPS knownledge is
limited.

I doubt AppArmor is involved in your problem.

BTW: http://ubuntuforums.org/archive/index.php/t-1368410.html seems to
describe a similar problem.

Regards,

Christian Boltz
--
> Status?
NEW
[Ihno Krumreich and Stephan Kulow on
 https://bugzilla.novell.com/show_bug.cgi?id=159223]

@John Johansen:

I have tried all u suggested and the problem will indeed not be in Apparmor. In ur suggestion #3 I pressed "e" on the bootloader screen, then navigated to the bottom and added the line "apparmor=0". was that the right way to do that?

@Christian Boltz:

>My first idea was to remove those options

I have a stupid question: where from should I remove those lines? e.g. what is the path to that cups config file? my googling (as u suggested) turned up some results, but nothing useful, all I have found was just changing permissions for different folders to and fro... none of which works.

it occurs to me that once when I tried out some tutorial the red exclamation mark on the printer's icon in system-config-printer vanished, but when I tried to print a test page it gave me another problem, something like "no connection to the printer"... maybe not important at all, because I don't know exactly what I did...

to be clear, I can't even finish the installation process of the driver, after installing the driver's files, the installer prompts me to connect the printer and press "next", but when I do so, it says the printer is not connected and I can't get to the next step. but all the driver files appear to be installed at that point, though.

I am going to try out the recent versions of Ubuntu on USB to see in which one did the problem start, will it help?

John Johansen (jjohansen) wrote :

It depends what you mean by adding apparmor=0 at the bottom, you need to add it to the line containing the linux kernel command options, it will look something like this

  linux /boot/vmlinuz-3.2.0-6-generic root=UUID=b6d5798b-bfb5-4889-9e2d-92395a82bf18 ro crashkernel=384M-2G:64M,2G-:128M quiet splash vt.handoff=7

you add apparmor=0 to the end of the line, eg.
  linux /boot/vmlinuz-3.2.0-6-generic root=UUID=b6d5798b-bfb5-4889-9e2d-92395a82bf18 ro crashkernel=384M-2G:64M,2G-:128M quiet splash vt.handoff=7 apparmor=0

and then boot.

As for trying Ubuntu on USB, yes this can help track down where the problem is, so it is worth trying. In fact it is worth trying a clean 11.10 too, as the problem may be in some difference caused by upgrading.

Good morning.. I have the same problem with a Lexmark X2500 printer, which worked perfectly with ubuntu 11.04 through the same driver. After a clean install of the new Ubuntu release, my printer stopped working with message 'File "/usr/local/lexmark/lxk08/bin/printdriver" has insecure permissions (0100775/uid=0/gid=2)'. I changed permissions on the folder '/usr/local/lexmark/lxk08/bin', then everything seems to go on right way, but unfortunately all printer jobs get interrupted...
This is the output of the command "system-config-printer --debug": I tried to print test page three times and at the end I undid the three jobs... I hope this could help...

Of course nothing comes out of the printer neither the blank paper...

Launchpad Janitor (janitor) wrote :

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in cups (Ubuntu):
status: New → Confirmed

@Nyjk Kyjn

>I changed permissions on the folder '/usr/local/lexmark/lxk08/bin', then everything seems to go on right way

could you explain how exactly did you change the permissions? with which command or so...

I tried Ubuntu 11.04 and I can confirm that my printer works there too and in any previous Ubuntu release. so, the
problem happened sometime between CUPS 1.4.6 and 1.5.0!

my behaviour is 99% the same as Nyjk's, but for me the red exclamation mark next to the printer's icon never vanishes, but that one time when I managed to remove it, the subsequent message was something like "no connection to the printer", so this is the only difference between our cases.

@John Johansen

I disabled apparmor at startup as you suggested in comment #10, so it is not apparmor that causes this. do you agree to remove it from the affected projects?

Download full text (4.6 KiB)

Probably the command to use is:

sudo chmod 755 /usr/local/lexmark/lxk08/bin/printdriver

I hope this solves the problem!

-----Original Message-----
From: zsolt.ruszinyák <email address hidden>
Sender: <email address hidden>
Date: Sun, 08 Jan 2012 06:18:58
To: <email address hidden>
Reply-To: Bug 908864 <email address hidden>
Subject: [apparmor] [Bug 908864] Re: My Lexmark x2650 printer stopped
 working after upgrading to 11.10: Idle -
 File "/usr/local/lexmark/lxk08/bin/printdriver" has
 insecure permissions (0100775/uid=0/gid=2).

@Nyjk Kyjn

>I changed permissions on the folder '/usr/local/lexmark/lxk08/bin',
then everything seems to go on right way

could you explain how exactly did you change the permissions? with which
command or so...

I tried Ubuntu 11.04 and I can confirm that my printer works there too and in any previous Ubuntu release. so, the
problem happened sometime between CUPS 1.4.6 and 1.5.0!

my behaviour is 99% the same as Nyjk's, but for me the red exclamation
mark next to the printer's icon never vanishes, but that one time when I
managed to remove it, the subsequent message was something like "no
connection to the printer", so this is the only difference between our
cases.

@John Johansen

I disabled apparmor at startup as you suggested in comment #10, so it is
not apparmor that causes this. do you agree to remove it from the
affected projects?

--
You received this bug notification because you are a member of AppArmor
Developers, which is the registrant for AppArmor.
https://bugs.launchpad.net/bugs/908864

Title:
  My Lexmark x2650 printer stopped working after upgrading to 11.10:
  Idle - File "/usr/local/lexmark/lxk08/bin/printdriver" has insecure
  permissions (0100775/uid=0/gid=2).

Status in AppArmor Linux application security framework:
  New
Status in “cups” package in Ubuntu:
  Confirmed

Bug description:
  I used Ubuntu 9.04 for a long time and the driver available on the
  manufacturer's site:
  http://support.lexmark.com/index?page=content&id=DR860&actp=search&viewlocale=en_US&segment=SUPPORT&productCode=LEXMARK_X2650&locale=EN&userlocale=EN_US&searchid=1324929199490
  worked perfectly! after installing the newest Ubuntu, I can't even
  finish the installation process of the driver, the Setup says "no
  connection", even though there is connection to the printer, because
  it appears in the list of printers when introduced to the USB.

  from what I have learnt on the web, recent changes in Cups and
  AppArmor caused that the connection to a printer with 3rd party driver
  is often blocked. but this is too high a game for me to solve here...

  have tried in another machine too, the same result, which means that
  THIS PRINTER JUST STOPPED WORKING IN LINUX at all. That is sad. I have
  to go back to older Ubuntu's just for the printer!!!!!!!!!

  This is insane.

  See my debugging results.

  ProblemType: Bug
  DistroRelease: Ubuntu 11.10
  Package: cups 1.5.0-8ubuntu5
  ProcVersionSignature: Ubuntu 3.0.0-13.22-generic 3.0.6
  Uname: Linux 3.0.0-13-generic i686
  ApportVersion: 1.23-0ubuntu4
  Architecture: i386
  Date: Mon Dec 26 20:43:21 2011
  InstallationMe...

Read more...

CUPS 1.5.0 has a new security policy for filters and backends not allowing group write permissions. See

http://www.cups.org/documentation.php/doc-1.5/whatsnew.html

----------
Scheduler

4. Filter security; Filters and backends must now have group write permissions disabled.
----------

So you will need to run

sudo chmod 755 /usr/local/lexmark/lxk08/bin/printdriver

for CUPS to accept the Lexmark driver in Oneiric.

Please also report this to Lexmark so that they update their driver to work with CUPS 1.5.0 and later.

Closing as this is a problem of a third-party driver.

Changed in apparmor:
status: New → Invalid
Changed in cups (Ubuntu):
status: Confirmed → Invalid

Hey Till,

On Mon, Jan 09, 2012 at 09:36:54AM -0000, Till Kamppeter wrote:
> CUPS 1.5.0 has a new security policy for filters and backends not
> allowing group write permissions. See
>
> http://www.cups.org/documentation.php/doc-1.5/whatsnew.html
>
> ----------
> Scheduler
>
> 4. Filter security; Filters and backends must now have group write permissions disabled.
> ----------
>
> So you will need to run
>
> sudo chmod 755 /usr/local/lexmark/lxk08/bin/printdriver
>
> for CUPS to accept the Lexmark driver in Oneiric.
>
> Please also report this to Lexmark so that they update their driver to
> work with CUPS 1.5.0 and later.

Is this also a result of the change to the default umask to be 0002 in
Ubuntu https://blueprints.launchpad.net/ubuntu/+spec/umask-to-0002 in
oneiric?

--
Steve Beattie
<email address hidden>
http://NxNW.org/~steve/

This is independent, I even did not know about the umask change.

has anyone written to Lexmark?

Changed in cups (Ubuntu):
assignee: nobody → Fellipe (fellipe-emilson)
assignee: Fellipe (fellipe-emilson) → nobody
To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.