Ubuntu
cupsys package

make backend invocation compatible to upstream

Bug #119289 reported by Martin Pitt
4
Affects Status Importance Assigned to Milestone
cupsys (Debian)
Fix Released
Unknown
cupsys (Ubuntu)
Fix Released
High
Martin Pitt
Ubuntu tribe-4

Bug Description

Binary package hint: cupsys

Cups backends need to be executed as root when installed with 0700 permissions, and as normal user cupsys when being world-executable, to get compatible with the upstream behaviour and unbreak third-party backends. See the Debian bug for details.

Martin Pitt (pitti)
Changed in cupsys:
assignee: nobody → pitti
importance: Undecided → High
status: Unconfirmed → In Progress
Bug Watch Updater (bug-watch-updater)
Changed in cupsys:
status: Unknown → Fix Released
Revision history for this message
Martin Pitt (pitti) wrote :

cupsys (1.2.12-1ubuntu2) gutsy; urgency=low

  * Drop our derooting changes. It still has some regressions, and with
    upstream not even acknowledging the need for improving cupsys' security we
    will sit on this forever. (LP: #119289, LP: #129634)
    - Drop derooting related patches:
      06_disable_backend_setuid.dpatch
      10_external_pam_helper.dpatch
      09_runasuser.dpatch
      09_runasuser_autoconf.dpatch
    - debian/cupsys{,-client}.postinst: Drop the 'cupsys' user setup and file
      permission juggling.
    - debian/rules:
      + Drop --with-cups-user and --enable-privilege-dropping configure
        options.
      + Do not modify the upstream default backend permissions.
    - debian/cupsys.init.d: Do not touch log file permissions any more.
    - debian/cupsys.files: Drop cups-check-pam-auth.
    - debian/NEWS: Drop description of derooting changes.
    - debian/control: Drop adduser dependency.
  * debian/patches/44_fixconfdirperms.dpatch: Do not create
    /var/run/cups/certs as lp:lpadmin, but as root:lpadmin, so that cupsd
    does not need CAP_DAC_OVERRIDE. This will make it possible to create a
    sensible AppArmor profile.
  * debian/cupsys.preinst: Fix file permissions on upgrades (owner cupsys ->
    root).
  * Add debian/local/apparmor-profile: AppArmor profile for cupsys, to replace
    the former derooting patches. This uses complain mode for now, until we
    got some more testing. Install it to /etc/apparmor.d/usr.sbin.cupsd in
    debian/rules and reload apparmor in debian/cupsys.postinst on configure.

 -- Martin Pitt <email address hidden> Thu, 02 Aug 2007 14:06:05 +0200

Changed in cupsys:
status: In Progress → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.