This is still reproducible on Ubuntu 26.04.1 LTS with cups-daemon
2.4.16-1ubuntu1.3 (apparmor 5.0.2-0ubuntu1~26.04.1). The denial appears
every time cupsd starts:
apparmor="DENIED" operation="open" class="file"
profile="/usr/sbin/cupsd" name="/etc/paperspecs" pid=156707 comm="cupsd"
requested_mask="r" denied_mask="r" fsuid=0 ouid=0
I believe this answers the question from the 2026-04-27 comment about
why the fix doesn't seem to work. The rule from 2.4.12-0ubuntu3 ("Add
rule for accessing /etc/paperspecs") landed in the wrong profile.
/etc/apparmor.d/usr.sbin.cupsd defines two top-level profiles:
- /usr/sbin/cupsd (line 7): this is the profile in the denial. It only has
/etc/papersize r, (line 75).
- /usr/lib/cups/backend/cups-pdf (line 183): the new /etc/paperspecs r, rule is
at line 209, next to the cups-pdf profile's own /etc/papersize r,.
cupsd itself reads /etc/paperspecs through libpaper2, so the rule also
needs to be in the /usr/sbin/cupsd block, e.g. next to line 75:
/etc/papersize r,
/etc/paperspecs r,
Adding /etc/paperspecs r, to /etc/apparmor.d/local/usr.sbin.cupsd
confirms it: the include is inside the cupsd block, and the denial no
longer appears. Could this be fixed in resolute and the current
development series?
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2125520
Title:
apparmor denies access to /etc/paperspecs
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/cups/+bug/2125520/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
