desktop-packages team mailing list archive

Thread
Date
[Bug 1454463] [NEW] CUPS not allowed to mknod to /var/log by apparmor

To: desktop-packages@xxxxxxxxxxxxxxxxxxx
From: Greg Bell <gbell_spamless@xxxxxxxxx>
Date: Wed, 13 May 2015 00:10:03 -0000
Reply-to: Bug 1454463 <1454463@xxxxxxxxxxxxxxxxxx>
Sender: bounces@xxxxxxxxxxxxx
Public bug reported:

I have a two-machine network, both running 14.04.1 but mostly updated.

I cannot print to the remote CUPS-managed printer, except with a few
apps which see the printers directly via avahi (e.g. Evince).

I can print to the printer from the machine local to the printer.


/var/log/syslog on the remote machine shows:

ay 13 09:50:29 server cupsd: Unable to change ownership of "/var/log/cups" - Permission denied
May 13 09:50:29 server cupsd: Unable to open log file "/var/log/cups/error_log" - Permission denied
May 13 09:50:29 server kernel: [47923.441374] type=1400 audit(1431474629.549:811): apparmor="DENIED" operation="mknod" profile="/usr/sbin/cupsd" name="/data/var/cache/cups/job.cache.N" pid=7814 comm="cupsd" requested_mask="c" denied_mask="c" fsuid=0 ouid=0
May 13 09:50:29 server kernel: [47923.441413] type=1400 audit(1431474629.549:812): apparmor="DENIED" operation="mknod" profile="/usr/sbin/cupsd" name="/data/var/log/cups/error_log" pid=7814 comm="cupsd" requested_mask="c" denied_mask="c" fsuid=0 ouid=0
May 13 09:50:29 server kernel: [47923.441421] type=1400 audit(1431474629.549:813): apparmor="DENIED" operation="chown" profile="/usr/sbin/cupsd" name="/data/var/log/cups/" pid=7814 comm="cupsd" requested_mask="w" denied_mask="w" fsuid=0 ouid=0
May 13 09:50:29 server kernel: [47923.441444] type=1400 audit(1431474629.549:814): apparmor="DENIED" operation="mknod" profile="/usr/sbin/cupsd" name="/data/var/log/cups/error_log" pid=7814 comm="cupsd" requested_mask="c" denied_mask="c" fsuid=0 ouid=0
May 13 09:50:29 server kernel: [47923.706282] type=1400 audit(1431474629.817:815): apparmor="STATUS" operation="profile_replace" profile="unconfined" name="/usr/lib/cups/backend/cups-pdf" pid=16874 comm="apparmor_parser"
May 13 09:50:29 server kernel: [47923.706551] type=1400 audit(1431474629.817:816): apparmor="STATUS" operation="profile_replace" profile="unconfined" name="/usr/sbin/cupsd" pid=16874 comm="apparmor_parser"
May 13 09:50:29 server cupsd: Unable to change ownership of "/var/log/cups" - Permission denied
May 13 09:50:29 server cupsd: Unable to open log file "/var/log/cups/access_log" - Permission denied
May 13 09:50:29 server cupsd: Unable to change ownership of "/var/log/cups" - Permission denied
May 13 09:50:29 server cupsd: Unable to open log file "/var/log/cups/error_log" - Permission denied
May 13 09:50:29 server cupsd: Unable to change ownership of "/var/log/cups" - Permission denied
May 13 09:50:29 server cupsd: Unable to open log file "/var/log/cups/page_log" - Permission denied
May 13 09:50:29 server cupsd: Unable to change ownership of "/var/log/cups" - Permission denied
May 13 09:50:29 server cupsd: Unable to open log file "/var/log/cups/error_log" - Permission denied
May 13 09:50:29 server cupsd: Unable to change ownership of "/var/log/cups" - Permission denied
May 13 09:50:29 server cupsd: Unable to open log file "/var/log/cups/error_log" - Permission denied
May 13 09:50:29 server cupsd: Unable to change ownership of "/var/log/cups" - Permission denied
May 13 09:50:29 server cupsd: Unable to open log file "/var/log/cups/error_log" - Permission denied
May 13 09:50:29 server cupsd: Unable to change ownership of "/var/log/cups" - Permission denied
May 13 09:50:29 server cupsd: Unable to open log file "/var/log/cups/error_log" - Permission denied
May 13 09:50:29 server cupsd: Unable to change ownership of "/var/log/cups" - Permission denied
May 13 09:50:29 server cupsd: Unable to open log file "/var/log/cups/error_log" - Permission denied
May 13 09:50:29 server kernel: [47923.710922] type=1400 audit(1431474629.821:817): apparmor="DENIED" operation="mknod" profile="/usr/sbin/cupsd" name="/data/var/log/cups/access_log" pid=16884 comm="cupsd" requested_mask="c" denied_mask="c" fsuid=0 ouid=0
May 13 09:50:29 server kernel: [47923.710931] type=1400 audit(1431474629.821:818): apparmor="DENIED" operation="chown" profile="/usr/sbin/cupsd" name="/data/var/log/cups/" pid=16884 comm="cupsd" requested_mask="w" denied_mask="w" fsuid=0 ouid=0
May 13 09:50:29 server kernel: [47923.710964] type=1400 audit(1431474629.821:819): apparmor="DENIED" operation="mknod" profile="/usr/sbin/cupsd" name="/data/var/log/cups/access_log" pid=16884 comm="cupsd" requested_mask="c" denied_mask="c" fsuid=0 ouid=0
May 13 09:50:29 server kernel: [47923.710985] type=1400 audit(1431474629.821:820): apparmor="DENIED" operation="mknod" profile="/usr/sbin/cupsd" name="/data/var/log/cups/error_log" pid=16884 comm="cupsd" requested_mask="c" denied_mask="c" fsuid=0 ouid=0


Google search yields similar but significantly different bugs, and from years ago.

** Affects: cups (Ubuntu)
     Importance: Undecided
         Status: New


** Tags: apparmor avahi cups mknod printing

** Summary changed:

- CUPS not allowed to mknod to /varlog by apparmor
+ CUPS not allowed to mknod to /var/log by apparmor

-- 
You received this bug notification because you are a member of Desktop
Packages, which is subscribed to cups in Ubuntu.
https://bugs.launchpad.net/bugs/1454463

Title:
  CUPS not allowed to mknod to /var/log by apparmor

Status in cups package in Ubuntu:
  New

Bug description:
  I have a two-machine network, both running 14.04.1 but mostly updated.

  I cannot print to the remote CUPS-managed printer, except with a few
  apps which see the printers directly via avahi (e.g. Evince).

  I can print to the printer from the machine local to the printer.

  
  /var/log/syslog on the remote machine shows:

  ay 13 09:50:29 server cupsd: Unable to change ownership of "/var/log/cups" - Permission denied
  May 13 09:50:29 server cupsd: Unable to open log file "/var/log/cups/error_log" - Permission denied
  May 13 09:50:29 server kernel: [47923.441374] type=1400 audit(1431474629.549:811): apparmor="DENIED" operation="mknod" profile="/usr/sbin/cupsd" name="/data/var/cache/cups/job.cache.N" pid=7814 comm="cupsd" requested_mask="c" denied_mask="c" fsuid=0 ouid=0
  May 13 09:50:29 server kernel: [47923.441413] type=1400 audit(1431474629.549:812): apparmor="DENIED" operation="mknod" profile="/usr/sbin/cupsd" name="/data/var/log/cups/error_log" pid=7814 comm="cupsd" requested_mask="c" denied_mask="c" fsuid=0 ouid=0
  May 13 09:50:29 server kernel: [47923.441421] type=1400 audit(1431474629.549:813): apparmor="DENIED" operation="chown" profile="/usr/sbin/cupsd" name="/data/var/log/cups/" pid=7814 comm="cupsd" requested_mask="w" denied_mask="w" fsuid=0 ouid=0
  May 13 09:50:29 server kernel: [47923.441444] type=1400 audit(1431474629.549:814): apparmor="DENIED" operation="mknod" profile="/usr/sbin/cupsd" name="/data/var/log/cups/error_log" pid=7814 comm="cupsd" requested_mask="c" denied_mask="c" fsuid=0 ouid=0
  May 13 09:50:29 server kernel: [47923.706282] type=1400 audit(1431474629.817:815): apparmor="STATUS" operation="profile_replace" profile="unconfined" name="/usr/lib/cups/backend/cups-pdf" pid=16874 comm="apparmor_parser"
  May 13 09:50:29 server kernel: [47923.706551] type=1400 audit(1431474629.817:816): apparmor="STATUS" operation="profile_replace" profile="unconfined" name="/usr/sbin/cupsd" pid=16874 comm="apparmor_parser"
  May 13 09:50:29 server cupsd: Unable to change ownership of "/var/log/cups" - Permission denied
  May 13 09:50:29 server cupsd: Unable to open log file "/var/log/cups/access_log" - Permission denied
  May 13 09:50:29 server cupsd: Unable to change ownership of "/var/log/cups" - Permission denied
  May 13 09:50:29 server cupsd: Unable to open log file "/var/log/cups/error_log" - Permission denied
  May 13 09:50:29 server cupsd: Unable to change ownership of "/var/log/cups" - Permission denied
  May 13 09:50:29 server cupsd: Unable to open log file "/var/log/cups/page_log" - Permission denied
  May 13 09:50:29 server cupsd: Unable to change ownership of "/var/log/cups" - Permission denied
  May 13 09:50:29 server cupsd: Unable to open log file "/var/log/cups/error_log" - Permission denied
  May 13 09:50:29 server cupsd: Unable to change ownership of "/var/log/cups" - Permission denied
  May 13 09:50:29 server cupsd: Unable to open log file "/var/log/cups/error_log" - Permission denied
  May 13 09:50:29 server cupsd: Unable to change ownership of "/var/log/cups" - Permission denied
  May 13 09:50:29 server cupsd: Unable to open log file "/var/log/cups/error_log" - Permission denied
  May 13 09:50:29 server cupsd: Unable to change ownership of "/var/log/cups" - Permission denied
  May 13 09:50:29 server cupsd: Unable to open log file "/var/log/cups/error_log" - Permission denied
  May 13 09:50:29 server cupsd: Unable to change ownership of "/var/log/cups" - Permission denied
  May 13 09:50:29 server cupsd: Unable to open log file "/var/log/cups/error_log" - Permission denied
  May 13 09:50:29 server kernel: [47923.710922] type=1400 audit(1431474629.821:817): apparmor="DENIED" operation="mknod" profile="/usr/sbin/cupsd" name="/data/var/log/cups/access_log" pid=16884 comm="cupsd" requested_mask="c" denied_mask="c" fsuid=0 ouid=0
  May 13 09:50:29 server kernel: [47923.710931] type=1400 audit(1431474629.821:818): apparmor="DENIED" operation="chown" profile="/usr/sbin/cupsd" name="/data/var/log/cups/" pid=16884 comm="cupsd" requested_mask="w" denied_mask="w" fsuid=0 ouid=0
  May 13 09:50:29 server kernel: [47923.710964] type=1400 audit(1431474629.821:819): apparmor="DENIED" operation="mknod" profile="/usr/sbin/cupsd" name="/data/var/log/cups/access_log" pid=16884 comm="cupsd" requested_mask="c" denied_mask="c" fsuid=0 ouid=0
  May 13 09:50:29 server kernel: [47923.710985] type=1400 audit(1431474629.821:820): apparmor="DENIED" operation="mknod" profile="/usr/sbin/cupsd" name="/data/var/log/cups/error_log" pid=16884 comm="cupsd" requested_mask="c" denied_mask="c" fsuid=0 ouid=0

  
  Google search yields similar but significantly different bugs, and from years ago.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/cups/+bug/1454463/+subscriptions
Follow ups

[Bug 1454463] Re: CUPS not allowed to mknod to /var/log by apparmor
From: Seth Arnold, 2015-05-13
[Bug 1454463] Re: CUPS not allowed to mknod to /var/log by apparmor
From: Greg Bell, 2015-05-13
[Bug 1454463] Re: CUPS not allowed to mknod to /var/log by apparmor
From: Seth Arnold, 2015-05-13
[Bug 1454463] Re: CUPS not allowed to mknod to /var/log by apparmor
From: Greg Bell, 2015-05-13
[Bug 1454463] [NEW] CUPS not allowed to mknod to /var/log by apparmor
From: Greg Bell, 2015-05-13
References

[Bug 1454463] [NEW] CUPS not allowed to mknod to /var/log by apparmor
From: Greg Bell, 2015-05-13