← Back to team overview

touch-packages team mailing list archive

[Bug 1477106] [NEW] Cups directive "Browsing Off" ignored by print dialog

 

Public bug reported:

On Ubuntu 15.04, I have cups configured with the "Browsing Off" option
in the /etc/cups/cupsd.conf to disallow listing non local printers (I'm
on a huge network where there are many  printers).

This works well with non Gnome applications (LibreOffice, Adobe Reader
for example). But the print dialog of Gnome GTK3 applications seems to
ignore the "Browsing Off" directive and lists a lot of remote
printers...

The same problem arises with Gnome GTK2 applications...

cups  version: 2.0.2-1ubuntu3.2
gtk3 version: 3.14.13-0ubuntu1
gtk2 version: 2.24.27-0ubuntu1

The package cups-browsed is not installed.

Here is the content of my cupsd.conf:

#
# Configuration file for the CUPS scheduler.  See "man cupsd.conf" for a
# complete description of this file.
#

# Log general information in error_log - change "warn" to "debug"
# for troubleshooting...
LogLevel warn
PageLogFormat

# Deactivate CUPS' internal logrotating, as we provide a better one, especially
# LogLevel debug2 gets usable now
MaxLogSize 0

# Only listen for connections from the local machine.
Listen localhost:631
Listen /var/run/cups/cups.sock

# Show shared printers on the local network.
Browsing Off
BrowseLocalProtocols dnssd

# Default authentication type, when authentication is required...
DefaultAuthType Basic

# Web interface setting...
WebInterface Yes

# Restrict access to the server...
<Location />
  Order allow,deny
</Location>

# Restrict access to the admin pages...
<Location /admin>
  Order allow,deny
</Location>

# Restrict access to configuration files...
<Location /admin/conf>
  AuthType Default
  Require user @SYSTEM
  Order allow,deny
</Location>

# Set the default printer/job policies...
<Policy default>
  # Job/subscription privacy...
  JobPrivateAccess default
  JobPrivateValues default
  SubscriptionPrivateAccess default
  SubscriptionPrivateValues default

  # Job-related operations must be done by the owner or an administrator...
  <Limit Create-Job Print-Job Print-URI Validate-Job>
    Order deny,allow
  </Limit>

  <Limit Send-Document Send-URI Hold-Job Release-Job Restart-Job Purge-Jobs Set-Job-Attributes Create-Job-Subscription Renew-Subscription Cancel-Subscription Get-Notifications Reprocess-Job Cancel-Current-Job Suspend-Current-Job Resume-Job Cancel-My-Jobs Close-Job CUPS-Move-Job CUPS-Get-Document>
    Require user @OWNER @SYSTEM
    Order deny,allow
  </Limit>

  # All administration operations require an administrator to authenticate...
  <Limit CUPS-Add-Modify-Printer CUPS-Delete-Printer CUPS-Add-Modify-Class CUPS-Delete-Class CUPS-Set-Default CUPS-Get-Devices>
    AuthType Default
    Require user @SYSTEM
    Order deny,allow
  </Limit>

  # All printer operations require a printer operator to authenticate...
  <Limit Pause-Printer Resume-Printer Enable-Printer Disable-Printer Pause-Printer-After-Current-Job Hold-New-Jobs Release-Held-New-Jobs Deactivate-Printer Activate-Printer Restart-Printer Shutdown-Printer Startup-Printer Promote-Job Schedule-Job-After Cancel-Jobs CUPS-Accept-Jobs CUPS-Reject-Jobs>
    AuthType Default
    Require user @SYSTEM
    Order deny,allow
  </Limit>

  # Only the owner or an administrator can cancel or authenticate a job...
  <Limit Cancel-Job CUPS-Authenticate-Job>
    Require user @OWNER @SYSTEM
    Order deny,allow
  </Limit>

  <Limit All>
    Order deny,allow
  </Limit>
</Policy>

# Set the authenticated printer/job policies...
<Policy authenticated>
  # Job/subscription privacy...
  JobPrivateAccess default
  JobPrivateValues default
  SubscriptionPrivateAccess default
  SubscriptionPrivateValues default

  # Job-related operations must be done by the owner or an administrator...
  <Limit Create-Job Print-Job Print-URI Validate-Job>
    AuthType Default
    Order deny,allow
  </Limit>

  <Limit Send-Document Send-URI Hold-Job Release-Job Restart-Job Purge-Jobs Set-Job-Attributes Create-Job-Subscription Renew-Subscription Cancel-Subscription Get-Notifications Reprocess-Job Cancel-Current-Job Suspend-Current-Job Resume-Job Cancel-My-Jobs Close-Job CUPS-Move-Job CUPS-Get-Document>
    AuthType Default
    Require user @OWNER @SYSTEM
    Order deny,allow
  </Limit>

  # All administration operations require an administrator to authenticate...
  <Limit CUPS-Add-Modify-Printer CUPS-Delete-Printer CUPS-Add-Modify-Class CUPS-Delete-Class CUPS-Set-Default>
    AuthType Default
    Require user @SYSTEM
    Order deny,allow
  </Limit>

  # All printer operations require a printer operator to authenticate...
  <Limit Pause-Printer Resume-Printer Enable-Printer Disable-Printer Pause-Printer-After-Current-Job Hold-New-Jobs Release-Held-New-Jobs Deactivate-Printer Activate-Printer Restart-Printer Shutdown-Printer Startup-Printer Promote-Job Schedule-Job-After Cancel-Jobs CUPS-Accept-Jobs CUPS-Reject-Jobs>
    AuthType Default
    Require user @SYSTEM
    Order deny,allow
  </Limit>

  # Only the owner or an administrator can cancel or authenticate a job...
  <Limit Cancel-Job CUPS-Authenticate-Job>
    AuthType Default
    Require user @OWNER @SYSTEM
    Order deny,allow
  </Limit>

  <Limit All>
    Order deny,allow
  </Limit>
</Policy>

** Affects: gtk+3.0 (Ubuntu)
     Importance: Undecided
         Status: New

** Description changed:

- On Ubuntu 15.04, I have cups configured with the "Browsing Offe option
+ On Ubuntu 15.04, I have cups configured with the "Browsing Off" option
  in the /etc/cups/cupsd.conf to disallow listing non local printers (I'm
  on a huge network where there are many  printers).
  
  This works well with non Gnome applications (LibreOffice, Adobe Reader
  for example). But the print dialog of Gnome GTK3 applications seems to
  ignore the "Browsing Off" directive and lists a lot of remote
  printers...
  
  The same problem arises with Gnome GTK2 applications...
  
- cups  version: 2.0.2-1ubuntu3.2 
+ cups  version: 2.0.2-1ubuntu3.2
  gtk3 version: 3.14.13-0ubuntu1
  gtk2 version: 2.24.27-0ubuntu1
  
  Here is the content of my cupsd.conf:
  
  #
  # Configuration file for the CUPS scheduler.  See "man cupsd.conf" for a
  # complete description of this file.
  #
  
  # Log general information in error_log - change "warn" to "debug"
  # for troubleshooting...
  LogLevel warn
  PageLogFormat
  
  # Deactivate CUPS' internal logrotating, as we provide a better one, especially
  # LogLevel debug2 gets usable now
  MaxLogSize 0
  
  # Only listen for connections from the local machine.
  Listen localhost:631
  Listen /var/run/cups/cups.sock
  
  # Show shared printers on the local network.
  Browsing Off
  BrowseLocalProtocols dnssd
  
  # Default authentication type, when authentication is required...
  DefaultAuthType Basic
  
  # Web interface setting...
  WebInterface Yes
  
  # Restrict access to the server...
  <Location />
-   Order allow,deny
+   Order allow,deny
  </Location>
  
  # Restrict access to the admin pages...
  <Location /admin>
-   Order allow,deny
+   Order allow,deny
  </Location>
  
  # Restrict access to configuration files...
  <Location /admin/conf>
-   AuthType Default
-   Require user @SYSTEM
-   Order allow,deny
+   AuthType Default
+   Require user @SYSTEM
+   Order allow,deny
  </Location>
  
  # Set the default printer/job policies...
  <Policy default>
-   # Job/subscription privacy...
-   JobPrivateAccess default
-   JobPrivateValues default
-   SubscriptionPrivateAccess default
-   SubscriptionPrivateValues default
+   # Job/subscription privacy...
+   JobPrivateAccess default
+   JobPrivateValues default
+   SubscriptionPrivateAccess default
+   SubscriptionPrivateValues default
  
-   # Job-related operations must be done by the owner or an administrator...
-   <Limit Create-Job Print-Job Print-URI Validate-Job>
-     Order deny,allow
-   </Limit>
+   # Job-related operations must be done by the owner or an administrator...
+   <Limit Create-Job Print-Job Print-URI Validate-Job>
+     Order deny,allow
+   </Limit>
  
-   <Limit Send-Document Send-URI Hold-Job Release-Job Restart-Job Purge-Jobs Set-Job-Attributes Create-Job-Subscription Renew-Subscription Cancel-Subscription Get-Notifications Reprocess-Job Cancel-Current-Job Suspend-Current-Job Resume-Job Cancel-My-Jobs Close-Job CUPS-Move-Job CUPS-Get-Document>
-     Require user @OWNER @SYSTEM
-     Order deny,allow
-   </Limit>
+   <Limit Send-Document Send-URI Hold-Job Release-Job Restart-Job Purge-Jobs Set-Job-Attributes Create-Job-Subscription Renew-Subscription Cancel-Subscription Get-Notifications Reprocess-Job Cancel-Current-Job Suspend-Current-Job Resume-Job Cancel-My-Jobs Close-Job CUPS-Move-Job CUPS-Get-Document>
+     Require user @OWNER @SYSTEM
+     Order deny,allow
+   </Limit>
  
-   # All administration operations require an administrator to authenticate...
-   <Limit CUPS-Add-Modify-Printer CUPS-Delete-Printer CUPS-Add-Modify-Class CUPS-Delete-Class CUPS-Set-Default CUPS-Get-Devices>
-     AuthType Default
-     Require user @SYSTEM
-     Order deny,allow
-   </Limit>
+   # All administration operations require an administrator to authenticate...
+   <Limit CUPS-Add-Modify-Printer CUPS-Delete-Printer CUPS-Add-Modify-Class CUPS-Delete-Class CUPS-Set-Default CUPS-Get-Devices>
+     AuthType Default
+     Require user @SYSTEM
+     Order deny,allow
+   </Limit>
  
-   # All printer operations require a printer operator to authenticate...
-   <Limit Pause-Printer Resume-Printer Enable-Printer Disable-Printer Pause-Printer-After-Current-Job Hold-New-Jobs Release-Held-New-Jobs Deactivate-Printer Activate-Printer Restart-Printer Shutdown-Printer Startup-Printer Promote-Job Schedule-Job-After Cancel-Jobs CUPS-Accept-Jobs CUPS-Reject-Jobs>
-     AuthType Default
-     Require user @SYSTEM
-     Order deny,allow
-   </Limit>
+   # All printer operations require a printer operator to authenticate...
+   <Limit Pause-Printer Resume-Printer Enable-Printer Disable-Printer Pause-Printer-After-Current-Job Hold-New-Jobs Release-Held-New-Jobs Deactivate-Printer Activate-Printer Restart-Printer Shutdown-Printer Startup-Printer Promote-Job Schedule-Job-After Cancel-Jobs CUPS-Accept-Jobs CUPS-Reject-Jobs>
+     AuthType Default
+     Require user @SYSTEM
+     Order deny,allow
+   </Limit>
  
-   # Only the owner or an administrator can cancel or authenticate a job...
-   <Limit Cancel-Job CUPS-Authenticate-Job>
-     Require user @OWNER @SYSTEM
-     Order deny,allow
-   </Limit>
+   # Only the owner or an administrator can cancel or authenticate a job...
+   <Limit Cancel-Job CUPS-Authenticate-Job>
+     Require user @OWNER @SYSTEM
+     Order deny,allow
+   </Limit>
  
-   <Limit All>
-     Order deny,allow
-   </Limit>
+   <Limit All>
+     Order deny,allow
+   </Limit>
  </Policy>
  
  # Set the authenticated printer/job policies...
  <Policy authenticated>
-   # Job/subscription privacy...
-   JobPrivateAccess default
-   JobPrivateValues default
-   SubscriptionPrivateAccess default
-   SubscriptionPrivateValues default
+   # Job/subscription privacy...
+   JobPrivateAccess default
+   JobPrivateValues default
+   SubscriptionPrivateAccess default
+   SubscriptionPrivateValues default
  
-   # Job-related operations must be done by the owner or an administrator...
-   <Limit Create-Job Print-Job Print-URI Validate-Job>
-     AuthType Default
-     Order deny,allow
-   </Limit>
+   # Job-related operations must be done by the owner or an administrator...
+   <Limit Create-Job Print-Job Print-URI Validate-Job>
+     AuthType Default
+     Order deny,allow
+   </Limit>
  
-   <Limit Send-Document Send-URI Hold-Job Release-Job Restart-Job Purge-Jobs Set-Job-Attributes Create-Job-Subscription Renew-Subscription Cancel-Subscription Get-Notifications Reprocess-Job Cancel-Current-Job Suspend-Current-Job Resume-Job Cancel-My-Jobs Close-Job CUPS-Move-Job CUPS-Get-Document>
-     AuthType Default
-     Require user @OWNER @SYSTEM
-     Order deny,allow
-   </Limit>
+   <Limit Send-Document Send-URI Hold-Job Release-Job Restart-Job Purge-Jobs Set-Job-Attributes Create-Job-Subscription Renew-Subscription Cancel-Subscription Get-Notifications Reprocess-Job Cancel-Current-Job Suspend-Current-Job Resume-Job Cancel-My-Jobs Close-Job CUPS-Move-Job CUPS-Get-Document>
+     AuthType Default
+     Require user @OWNER @SYSTEM
+     Order deny,allow
+   </Limit>
  
-   # All administration operations require an administrator to authenticate...
-   <Limit CUPS-Add-Modify-Printer CUPS-Delete-Printer CUPS-Add-Modify-Class CUPS-Delete-Class CUPS-Set-Default>
-     AuthType Default
-     Require user @SYSTEM
-     Order deny,allow
-   </Limit>
+   # All administration operations require an administrator to authenticate...
+   <Limit CUPS-Add-Modify-Printer CUPS-Delete-Printer CUPS-Add-Modify-Class CUPS-Delete-Class CUPS-Set-Default>
+     AuthType Default
+     Require user @SYSTEM
+     Order deny,allow
+   </Limit>
  
-   # All printer operations require a printer operator to authenticate...
-   <Limit Pause-Printer Resume-Printer Enable-Printer Disable-Printer Pause-Printer-After-Current-Job Hold-New-Jobs Release-Held-New-Jobs Deactivate-Printer Activate-Printer Restart-Printer Shutdown-Printer Startup-Printer Promote-Job Schedule-Job-After Cancel-Jobs CUPS-Accept-Jobs CUPS-Reject-Jobs>
-     AuthType Default
-     Require user @SYSTEM
-     Order deny,allow
-   </Limit>
+   # All printer operations require a printer operator to authenticate...
+   <Limit Pause-Printer Resume-Printer Enable-Printer Disable-Printer Pause-Printer-After-Current-Job Hold-New-Jobs Release-Held-New-Jobs Deactivate-Printer Activate-Printer Restart-Printer Shutdown-Printer Startup-Printer Promote-Job Schedule-Job-After Cancel-Jobs CUPS-Accept-Jobs CUPS-Reject-Jobs>
+     AuthType Default
+     Require user @SYSTEM
+     Order deny,allow
+   </Limit>
  
-   # Only the owner or an administrator can cancel or authenticate a job...
-   <Limit Cancel-Job CUPS-Authenticate-Job>
-     AuthType Default
-     Require user @OWNER @SYSTEM
-     Order deny,allow
-   </Limit>
+   # Only the owner or an administrator can cancel or authenticate a job...
+   <Limit Cancel-Job CUPS-Authenticate-Job>
+     AuthType Default
+     Require user @OWNER @SYSTEM
+     Order deny,allow
+   </Limit>
  
-   <Limit All>
-     Order deny,allow
-   </Limit>
+   <Limit All>
+     Order deny,allow
+   </Limit>
  </Policy>

** Description changed:

  On Ubuntu 15.04, I have cups configured with the "Browsing Off" option
  in the /etc/cups/cupsd.conf to disallow listing non local printers (I'm
  on a huge network where there are many  printers).
  
  This works well with non Gnome applications (LibreOffice, Adobe Reader
  for example). But the print dialog of Gnome GTK3 applications seems to
  ignore the "Browsing Off" directive and lists a lot of remote
  printers...
  
  The same problem arises with Gnome GTK2 applications...
  
  cups  version: 2.0.2-1ubuntu3.2
  gtk3 version: 3.14.13-0ubuntu1
  gtk2 version: 2.24.27-0ubuntu1
+ 
+ The package cups-browsed is not installed.
  
  Here is the content of my cupsd.conf:
  
  #
  # Configuration file for the CUPS scheduler.  See "man cupsd.conf" for a
  # complete description of this file.
  #
  
  # Log general information in error_log - change "warn" to "debug"
  # for troubleshooting...
  LogLevel warn
  PageLogFormat
  
  # Deactivate CUPS' internal logrotating, as we provide a better one, especially
  # LogLevel debug2 gets usable now
  MaxLogSize 0
  
  # Only listen for connections from the local machine.
  Listen localhost:631
  Listen /var/run/cups/cups.sock
  
  # Show shared printers on the local network.
  Browsing Off
  BrowseLocalProtocols dnssd
  
  # Default authentication type, when authentication is required...
  DefaultAuthType Basic
  
  # Web interface setting...
  WebInterface Yes
  
  # Restrict access to the server...
  <Location />
    Order allow,deny
  </Location>
  
  # Restrict access to the admin pages...
  <Location /admin>
    Order allow,deny
  </Location>
  
  # Restrict access to configuration files...
  <Location /admin/conf>
    AuthType Default
    Require user @SYSTEM
    Order allow,deny
  </Location>
  
  # Set the default printer/job policies...
  <Policy default>
    # Job/subscription privacy...
    JobPrivateAccess default
    JobPrivateValues default
    SubscriptionPrivateAccess default
    SubscriptionPrivateValues default
  
    # Job-related operations must be done by the owner or an administrator...
    <Limit Create-Job Print-Job Print-URI Validate-Job>
      Order deny,allow
    </Limit>
  
    <Limit Send-Document Send-URI Hold-Job Release-Job Restart-Job Purge-Jobs Set-Job-Attributes Create-Job-Subscription Renew-Subscription Cancel-Subscription Get-Notifications Reprocess-Job Cancel-Current-Job Suspend-Current-Job Resume-Job Cancel-My-Jobs Close-Job CUPS-Move-Job CUPS-Get-Document>
      Require user @OWNER @SYSTEM
      Order deny,allow
    </Limit>
  
    # All administration operations require an administrator to authenticate...
    <Limit CUPS-Add-Modify-Printer CUPS-Delete-Printer CUPS-Add-Modify-Class CUPS-Delete-Class CUPS-Set-Default CUPS-Get-Devices>
      AuthType Default
      Require user @SYSTEM
      Order deny,allow
    </Limit>
  
    # All printer operations require a printer operator to authenticate...
    <Limit Pause-Printer Resume-Printer Enable-Printer Disable-Printer Pause-Printer-After-Current-Job Hold-New-Jobs Release-Held-New-Jobs Deactivate-Printer Activate-Printer Restart-Printer Shutdown-Printer Startup-Printer Promote-Job Schedule-Job-After Cancel-Jobs CUPS-Accept-Jobs CUPS-Reject-Jobs>
      AuthType Default
      Require user @SYSTEM
      Order deny,allow
    </Limit>
  
    # Only the owner or an administrator can cancel or authenticate a job...
    <Limit Cancel-Job CUPS-Authenticate-Job>
      Require user @OWNER @SYSTEM
      Order deny,allow
    </Limit>
  
    <Limit All>
      Order deny,allow
    </Limit>
  </Policy>
  
  # Set the authenticated printer/job policies...
  <Policy authenticated>
    # Job/subscription privacy...
    JobPrivateAccess default
    JobPrivateValues default
    SubscriptionPrivateAccess default
    SubscriptionPrivateValues default
  
    # Job-related operations must be done by the owner or an administrator...
    <Limit Create-Job Print-Job Print-URI Validate-Job>
      AuthType Default
      Order deny,allow
    </Limit>
  
    <Limit Send-Document Send-URI Hold-Job Release-Job Restart-Job Purge-Jobs Set-Job-Attributes Create-Job-Subscription Renew-Subscription Cancel-Subscription Get-Notifications Reprocess-Job Cancel-Current-Job Suspend-Current-Job Resume-Job Cancel-My-Jobs Close-Job CUPS-Move-Job CUPS-Get-Document>
      AuthType Default
      Require user @OWNER @SYSTEM
      Order deny,allow
    </Limit>
  
    # All administration operations require an administrator to authenticate...
    <Limit CUPS-Add-Modify-Printer CUPS-Delete-Printer CUPS-Add-Modify-Class CUPS-Delete-Class CUPS-Set-Default>
      AuthType Default
      Require user @SYSTEM
      Order deny,allow
    </Limit>
  
    # All printer operations require a printer operator to authenticate...
    <Limit Pause-Printer Resume-Printer Enable-Printer Disable-Printer Pause-Printer-After-Current-Job Hold-New-Jobs Release-Held-New-Jobs Deactivate-Printer Activate-Printer Restart-Printer Shutdown-Printer Startup-Printer Promote-Job Schedule-Job-After Cancel-Jobs CUPS-Accept-Jobs CUPS-Reject-Jobs>
      AuthType Default
      Require user @SYSTEM
      Order deny,allow
    </Limit>
  
    # Only the owner or an administrator can cancel or authenticate a job...
    <Limit Cancel-Job CUPS-Authenticate-Job>
      AuthType Default
      Require user @OWNER @SYSTEM
      Order deny,allow
    </Limit>
  
    <Limit All>
      Order deny,allow
    </Limit>
  </Policy>

-- 
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to gtk+3.0 in Ubuntu.
https://bugs.launchpad.net/bugs/1477106

Title:
  Cups directive "Browsing Off" ignored by print dialog

Status in gtk+3.0 package in Ubuntu:
  New

Bug description:
  On Ubuntu 15.04, I have cups configured with the "Browsing Off" option
  in the /etc/cups/cupsd.conf to disallow listing non local printers
  (I'm on a huge network where there are many  printers).

  This works well with non Gnome applications (LibreOffice, Adobe Reader
  for example). But the print dialog of Gnome GTK3 applications seems to
  ignore the "Browsing Off" directive and lists a lot of remote
  printers...

  The same problem arises with Gnome GTK2 applications...

  cups  version: 2.0.2-1ubuntu3.2
  gtk3 version: 3.14.13-0ubuntu1
  gtk2 version: 2.24.27-0ubuntu1

  The package cups-browsed is not installed.

  Here is the content of my cupsd.conf:

  #
  # Configuration file for the CUPS scheduler.  See "man cupsd.conf" for a
  # complete description of this file.
  #

  # Log general information in error_log - change "warn" to "debug"
  # for troubleshooting...
  LogLevel warn
  PageLogFormat

  # Deactivate CUPS' internal logrotating, as we provide a better one, especially
  # LogLevel debug2 gets usable now
  MaxLogSize 0

  # Only listen for connections from the local machine.
  Listen localhost:631
  Listen /var/run/cups/cups.sock

  # Show shared printers on the local network.
  Browsing Off
  BrowseLocalProtocols dnssd

  # Default authentication type, when authentication is required...
  DefaultAuthType Basic

  # Web interface setting...
  WebInterface Yes

  # Restrict access to the server...
  <Location />
    Order allow,deny
  </Location>

  # Restrict access to the admin pages...
  <Location /admin>
    Order allow,deny
  </Location>

  # Restrict access to configuration files...
  <Location /admin/conf>
    AuthType Default
    Require user @SYSTEM
    Order allow,deny
  </Location>

  # Set the default printer/job policies...
  <Policy default>
    # Job/subscription privacy...
    JobPrivateAccess default
    JobPrivateValues default
    SubscriptionPrivateAccess default
    SubscriptionPrivateValues default

    # Job-related operations must be done by the owner or an administrator...
    <Limit Create-Job Print-Job Print-URI Validate-Job>
      Order deny,allow
    </Limit>

    <Limit Send-Document Send-URI Hold-Job Release-Job Restart-Job Purge-Jobs Set-Job-Attributes Create-Job-Subscription Renew-Subscription Cancel-Subscription Get-Notifications Reprocess-Job Cancel-Current-Job Suspend-Current-Job Resume-Job Cancel-My-Jobs Close-Job CUPS-Move-Job CUPS-Get-Document>
      Require user @OWNER @SYSTEM
      Order deny,allow
    </Limit>

    # All administration operations require an administrator to authenticate...
    <Limit CUPS-Add-Modify-Printer CUPS-Delete-Printer CUPS-Add-Modify-Class CUPS-Delete-Class CUPS-Set-Default CUPS-Get-Devices>
      AuthType Default
      Require user @SYSTEM
      Order deny,allow
    </Limit>

    # All printer operations require a printer operator to authenticate...
    <Limit Pause-Printer Resume-Printer Enable-Printer Disable-Printer Pause-Printer-After-Current-Job Hold-New-Jobs Release-Held-New-Jobs Deactivate-Printer Activate-Printer Restart-Printer Shutdown-Printer Startup-Printer Promote-Job Schedule-Job-After Cancel-Jobs CUPS-Accept-Jobs CUPS-Reject-Jobs>
      AuthType Default
      Require user @SYSTEM
      Order deny,allow
    </Limit>

    # Only the owner or an administrator can cancel or authenticate a job...
    <Limit Cancel-Job CUPS-Authenticate-Job>
      Require user @OWNER @SYSTEM
      Order deny,allow
    </Limit>

    <Limit All>
      Order deny,allow
    </Limit>
  </Policy>

  # Set the authenticated printer/job policies...
  <Policy authenticated>
    # Job/subscription privacy...
    JobPrivateAccess default
    JobPrivateValues default
    SubscriptionPrivateAccess default
    SubscriptionPrivateValues default

    # Job-related operations must be done by the owner or an administrator...
    <Limit Create-Job Print-Job Print-URI Validate-Job>
      AuthType Default
      Order deny,allow
    </Limit>

    <Limit Send-Document Send-URI Hold-Job Release-Job Restart-Job Purge-Jobs Set-Job-Attributes Create-Job-Subscription Renew-Subscription Cancel-Subscription Get-Notifications Reprocess-Job Cancel-Current-Job Suspend-Current-Job Resume-Job Cancel-My-Jobs Close-Job CUPS-Move-Job CUPS-Get-Document>
      AuthType Default
      Require user @OWNER @SYSTEM
      Order deny,allow
    </Limit>

    # All administration operations require an administrator to authenticate...
    <Limit CUPS-Add-Modify-Printer CUPS-Delete-Printer CUPS-Add-Modify-Class CUPS-Delete-Class CUPS-Set-Default>
      AuthType Default
      Require user @SYSTEM
      Order deny,allow
    </Limit>

    # All printer operations require a printer operator to authenticate...
    <Limit Pause-Printer Resume-Printer Enable-Printer Disable-Printer Pause-Printer-After-Current-Job Hold-New-Jobs Release-Held-New-Jobs Deactivate-Printer Activate-Printer Restart-Printer Shutdown-Printer Startup-Printer Promote-Job Schedule-Job-After Cancel-Jobs CUPS-Accept-Jobs CUPS-Reject-Jobs>
      AuthType Default
      Require user @SYSTEM
      Order deny,allow
    </Limit>

    # Only the owner or an administrator can cancel or authenticate a job...
    <Limit Cancel-Job CUPS-Authenticate-Job>
      AuthType Default
      Require user @OWNER @SYSTEM
      Order deny,allow
    </Limit>

    <Limit All>
      Order deny,allow
    </Limit>
  </Policy>

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/gtk+3.0/+bug/1477106/+subscriptions