For what it's worth, this is still happening with noble.
Since the shipped /etc/apparmor.d/usr.sbin.cups-browsed fortunately
specifies "#include <local/usr.sbin.cups-browsed>", this can be worked
around without causing further headaches by adding the following to
/etc/apparmor.d/local/usr.sbin.cups-browsed (create that file if for
some reason it doesn't exist):
/etc/gnutls/config r,
and reloading the profiles via
systemctl reload apparmor
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to cups in Ubuntu.
https://bugs.launchpad.net/bugs/2028459
Title:
cups apparmor: read access to /etc/gnutls/config
Status in cups package in Ubuntu:
Confirmed
Bug description:
The gnutls library has an optional configuration file in
/etc/gnutls/config. This file is not shipped by the Ubuntu packaging,
but it can be created by an user wanting to configure certain aspects
of gnutls.
When the file exists, gnutls functions might trigger an access to it,
and this is happening with cups in my system:
jul 23 14:44:35 nsnx2 kernel: audit: type=1400
audit(1690134275.356:574): apparmor="DENIED" operation="open"
class="file" profile="/usr/sbin/cupsd" name="/etc/gnutls/config"
pid=11222 comm="cupsd" requested_mask="r" denied_mask="r" fsuid=0
ouid=0
jul 23 14:44:35 nsnx2 kernel: audit: type=1400
audit(1690134275.376:576): apparmor="DENIED" operation="open"
class="file" profile="/usr/sbin/cups-browsed"
name="/etc/gnutls/config" pid=11224 comm="cups-browsed"
requested_mask="r" denied_mask="r" fsuid=121 ouid=0
$ l /etc/gnutls/config
-rw-r--r-- 1 root root 38 jun 15 18:44 /etc/gnutls/config
$ apt-cache policy cups
cups:
Installed: 2.4.2-3ubuntu2.2
Candidate: 2.4.2-3ubuntu2.2
Version table:
2.4.2-3ubuntu2.3 100
100 http://br.archive.ubuntu.com/ubuntu lunar-proposed/main amd64
Packages
*** 2.4.2-3ubuntu2.2 500
500 http://br.archive.ubuntu.com/ubuntu lunar-updates/main amd64
Packages
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/cups/+bug/2028459/+subscriptions
--
Mailing list: https://launchpad.net/~touch-packages
Post to : touch-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~touch-packages
More help : https://help.launchpad.net/ListHelp
