[Pkg-cups-devel] Bug#506181: Bug#506181: Various backends have the wrong permissions

Martin Pitt mpitt at debian.org
Wed Nov 19 11:50:47 UTC 2008


Hello Chanoch,

Chanoch (Ken) Bloom [2008-11-18 23:23 -0600]:
> After spending some time learning what the
> rootbackends-worldreadable.dpatch in expermental does, and learning what
> the code behind it does, I understand the problem.

Please note that this patch has never been in unstable/testing, and I
don't plan to upload it there before Lenny's release.

The patch previously broke the backends which were supposed to run as
root, such as lpd and ipp, but it never broke usb. It is fully fixed
in experimental now.

So rootbackends-worldreadable.dpatch is entirely unrelated to your
problem, especially since you reported it against the unstable/lenny
version.

> crw-rw---- 1 root lp        6,  0 2008-11-18 08:10 /dev/lp0
> crw-rw---- 1 root dialout   4, 64 2008-11-18 08:09 /dev/ttyS0
> crw-rw---- 1 root dialout   4, 65 2008-11-18 08:09 /dev/ttyS1
> crw-rw---- 1 root dialout   4, 66 2008-11-18 08:09 /dev/ttyS2
> crw-rw---- 1 root dialout   4, 67 2008-11-18 08:09 /dev/ttyS3
> crw-rw---- 1 root lp      180,  0 2008-11-18 08:09 /dev/usb/lp0

That looks normal.

> CUPS default permissions for running filters (including the backends) is
> to run in group lpadmin.

No, it's "lp", not "lpadmin". Filters are always run as lp, backends
installed with permissions 0755 are run as lp, and backends with
permissions 0700 (or 0744 in experimental) are run as root.

> If I change the group that filters run in (adding the line "Group lp"
> in /etc/cups/cupsd.conf) then I can make the usb and parallel backends
> work. (But I can't make usb and parallel work at the same time as serial
> because they require different groups to run)

I do see the issue with the serial backends. For that we probably need
to make the serial backend run as root.

Did you previously have a different "Group" statement in cupsd.conf?
On a standard Debian system, the backends *are* run as lp, thus usb
and parallel printers work. Therefore I downgrade this to important,
since it does not affect all Debian users.

Let's do a test whether backend permissions are wedged up for you.
Please do this as root:

  echo -e '!/bin/sh\nid > /tmp/cups-backend.txt' > /usr/lib/cups/backend/test
  chmod 755 /usr/lib/cups/backend/test
  lpinfo -v

Then please give me the output of "cat /tmp/cups-backend.txt". It
should say user/group lp, but maybe it is "lpadmin" for you for some
reason. Also, what does "id lp" give for you?

Afterwards, please remove the test backend again:

  rm /usr/lib/cups/backend/test

Thanks,

Martin

-- 
Martin Pitt                        | http://www.piware.de
Ubuntu Developer (www.ubuntu.com)  | Debian Developer  (www.debian.org)
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 197 bytes
Desc: Digital signature
Url : http://lists.alioth.debian.org/pipermail/pkg-cups-devel/attachments/20081119/a0566670/attachment.pgp 


More information about the Pkg-cups-devel mailing list