AppArmor profile breaks printing with hplip

I'm having similar issues. I used update-manager to upgrade from Feisty to Gutsy Tribe 4. I'm running cupsys 1.2.12-3ubuntu1 on amd64 architecture. My Samsung ML-4500 attached to a standalone ethernet print server dongle stopped printing following the upgrade. Everything I attempt to print shows a "stopped job" in the GUI interfaces.

The CUPS error_log has:
PID 23049 (/usr/lib/cups/filter/foomatic-rip) stopped with status 9!

When I try to recreate the printer in the printer admin windows, there is no ML-4500 driver listed.

Same here, Gutsy with current updates and an HP Photosmart 8150 which worked before. Had the same "job-stopped" problem. After removing the printer using gnome-cups-manager, I cannot recreate it because there is no driver for any Photosmart model, only LaserJet models from HP are listed.

Started from the terminal, gnome-cups-manager prints many messages of the kind

** (gnome-cups-add:3585): WARNING **: Two ppds have driver == 'PS, 1.1'
        ->openprinting/Sharp/Sharp-MX-4501N-ps.ppd.gz (Sharp MX-4501N PS, 1.1[0]) and
        ->openprinting/Sharp/Sharp-MX-4501N-ps-jp.ppd.gz (Sharp MX-4501N PS, 1.1)[0]

however I'm not sure if that's an error.

Peter Miller : Is your printer connected with USB or over a network?

Right, I forgot: It is a local printer connected with USB.

So it seems that the bug affect both USB and Ethernet printers. That's pretty bad

Changing Status to Confirmed

Do

sudo aa-complain cupsd

to deactivate the AppArmor protection of CUPS temprarily, then you should be able to print again.

Cupsys just got updated again, so I've plugged my printer back in and it was added automatically with the correct Photosmart driver, quite nice!

However, when trying to print a document, I had got the job state "Pending: printer-stopped". Canceling the job, running "sudo aa-complain cupsd" and trying to print again did not help. While the printer status in the properties dialog was "Ready" before submitting the job, it now was "Unplugged or turned off". Of course the printer was neither unplugged nor turned off. I've removed the printer and recreated it (the correct drivers are available again now). After that I was able to print successfully, multiple times.

It seems I'm able to reproduce the problem by restarting Ubuntu. Running "sudo aa-complain cupsd" before printing does not help. The status of a print job is "Pending: printer-stopped" until I recreate the printer. Let me know if I can provide any information from log files etc. that could help to fix this.

I got the new cupsys update which didn't fix the problem yet

"sudo aa-complain cupsd" successfully works, printers are able to print after this command is typed.

I'd like to confirm this issue on my system that my printer on Gutsy won't work even with the latest update.
Also, I'd like to confirm Saïvann Carignan's workaround which got my printers working again.
I thought aa-complain is a joke, I almost didn't try it and almost regretted it.
Thanks Saïvann!

Oops, sorry, it was actually Till Kamppeter who suggested sudo aa-complain cupsd. But if that's a workaround for AppArmor's protection on Cupsys, then shouldn't this be an AppArmor issue?

I'm not sure because the update 1.2.12.3ubuntu1 was a fix to add AppArmor functionnalities to Cupsys. I'd probably more think that this problem is due to a bad AppArmor integrating but actually I don't know a lot about that type of new protection. Maybe that the problem is from AppArmor, but I have doubts.

Dmesg gives numerous cupsys outputs!

Updating to cupsys 1.2.12-3ubuntu2 and running sudo aa-complain cupsd have allowed me to print again. Unfortunately I didn't do a printing test right after upgrading to the newer cupsys release so I don't know which change fixed it.

Thanks for the dmesg output, I will fix that ASAP.

cupsys (1.2.12-3ubuntu3) gutsy; urgency=low

  * debian/local/apparmor-profile: Allow unrestricted access to hplip. This
    has not been confined before and unbreaks hplip until we get an actual
    profile for it. (LP: #131470)

 -- Martin Pitt <email address hidden> Tue, 14 Aug 2007 17:08:50 +0200

Thanks to Till Kamppeter and anyone for the temporary solution to printing with cups.
Regards, Alejandro Escalante

I don't know if this is related to AppArmor, but right now I'm getting these errors in /var/log/cups/error_log when trying to use an HP Photosmart 8150:

adding the printer:
E [17/Aug/2007:12:44:17 +0200] [cups-driverd] Unable to open PPD directory "/opt/share/ppd": No such file or directory
E [17/Aug/2007:12:44:17 +0200] [cups-driverd] Unable to write "/var/cache/cups/ppds.dat" - Permission denied
E [17/Aug/2007:12:44:33 +0200] CUPS-Add-Modify-Printer: Unauthorized

trying to print (doesn't work, always state "Stopped: job-stopped"):
E [17/Aug/2007:12:45:13 +0200] PID 18894 (/usr/lib/cups/filter/foomatic-rip) stopped with status 3!
E [17/Aug/2007:12:45:13 +0200] [Job 28] Job stopped due to filter errors.

removing the printer:
E [17/Aug/2007:12:45:38 +0200] CUPS-Delete-Printer: Unauthorized

when not canceling the stopped printer job, the error-log gets floated with these messages:
E [17/Aug/2007:12:56:23 +0200] cupsdAuthorize: Local authentication certificate not found!

dmesg output contains:
[23047.811124] audit(1187347910.312:79): PERMITTING w access to /etc/printcap (cupsd(17834) profile /usr/sbin/cupsd active /usr/sbin/cupsd)
[23047.811145] audit(1187347910.312:80): PERMITTING attribute (size,mtime,ctime,) change to /etc/printcap (cupsd(17834) profile /usr/sbin/cupsd active /usr/sbin/cupsd)
[23063.755197] audit(1187347926.269:81): PERMITTING w access to /etc/printcap (cupsd(17834) profile /usr/sbin/cupsd active /usr/sbin/cupsd)
[23063.755217] audit(1187347926.269:82): PERMITTING attribute (size,mtime,ctime,) change to /etc/printcap (cupsd(17834) profile /usr/sbin/cupsd active /usr/sbin/cupsd)
[23085.323507] audit(1187347947.858:83): PERMITTING rw access to /dev/tty (bash(19688) profile /usr/sbin/cupsd active /usr/sbin/cupsd)
[23085.338190] audit(1187347947.870:84): PERMITTING rw access to /dev/tty (bash(19691) profile /usr/sbin/cupsd active /usr/sbin/cupsd)

I tried reinstalling cups, hplip, and running "sudo aa-complain cupsd". It all didn't help.

The latest cupsys / hpijs updates seemed to fix my problems. I hope it stays that way ;-).

Hi, I am relatively new to Ubuntu. I am presently using HP 6940 and I have the same complaints. I tried the 'sudo aa-complain cupsd' command with no luck. What should I do?

Rosemarie : Are-you using Ubuntu Gutsy 7.10 or the stable ubuntu release 7.04 ? This bug can only happens in gutsy so I want to make sure that we speak about the same bug.

Hi:

I had the same problem with a HP 710c over LPT1, with sudo aa-complain cupsd it works again.

Rodrigo Donado : Do you use the latest Gutsy release?

sudo aa-complain cupsd fixed my issue with the 710c, but I'm not getting the jobs on the list. Bug confiremed. We need to fix this guys.

I have a HP 710C on LPT1 in Gutsy stable, and the same problem has appear. In can print on the Live CD but when it was installed, the printer didn't work.

I try the command :
sudo aa-complain cupsd

And now I can print again !
Thanks !

i have the same printing issue : jobs are stopped.

i have an USB HP Photosmart C3170 that was automatically recognized by Gusty as a C3100.

#rm -f /var/spool/cups/{*,tmp/*}
# /etc/init.d/cupsys stop
 * Stopping Common Unix Printing System: cupsd
   ...done.
# aa-complain cupsd
Setting /etc/apparmor.d/usr.sbin.cupsd to complain mode.
#/etc/init.d/cupsys start
 * Starting Common Unix Printing System: cupsd
   ...done.
# dpkg -l|grep cupsys
ii cupsys 1.3.2-1ubuntu7.1 Common UNIX Printing System(tm) - server
ii cupsys-bsd 1.3.2-1ubuntu7.1 Common UNIX Printing System(tm) - BSD comman
ii cupsys-client 1.3.2-1ubuntu7.1 Common UNIX Printing System(tm) - client pro
ii cupsys-common 1.3.2-1ubuntu7.1 Common UNIX Printing System(tm) - common fil
ii cupsys-driver-gutenprint 5.0.1-0ubuntu8 printer drivers for CUPS
ii libcupsys2 1.3.2-1ubuntu7.1 Common UNIX Printing System(tm) - libs

#echo 0>/var/log/cups/error_log

# lpq
Photosmart_C3100_series est prête
aucune entrée

#i use evince to print a pdf file but nothing happens.

# lpq
Photosmart_C3100_series est prête
Rang Propr. Tâche Fichiers Taille totale
1st username 58 evince-print 4791296 octets

# cat /var/log/cups/error_log
E [24/Nov/2007:21:42:42 +0100] PID 28408 (/usr/lib/cups/filter/foomatic-rip) stopped with status 3!
E [24/Nov/2007:21:42:44 +0100] [Job 58] Job stopped due to filter errors.

attachment: /tmp/printingbuginfo
                  /var/log/messages

Please try the current package in gutsy-proposed, it should fix a lot of these issues.

Same problem, can't print over network. USB printer is on gutsy Dell Dimension with HPLIP driver and works fine locally but dual-boot Dell Inspiron 500m laptop XP/gutsy and another dual-boot Acer Win2k/gutsy can't print from either OS using SAMBA/CUPS. When I set it up and check accessibility, printer installer reports that printer is accessible, job gets queued, printing starts but then stalls. It's then impossible to cancel the job - even restarting cups on the server doesn't clear the job. I have to reinstall the printer on the server to get it working even locally again.

dmesg on Dell laptop:
[ 230.780000] audit(1202646801.294:3): type=1503 operation="inode_permission" requested_mask="a" denied_mask="a" name="/dev/tty" pid=4666 profile="/usr/sbin/cupsd"

on Dell Dimension where printer is installed:
dmesg:
[146446.790557] audit(1202650477.701:5): type=1503 operation="inode_permission" requested_mask="a" denied_mask="a" name="/dev/tty" pid=16096 profile="/usr/sbin/cupsd"
cups error log:
E [10/Feb/2008:13:21:09 +0000] Resume-Printer: Unauthorized
E [10/Feb/2008:13:21:10 +0000] Pause-Printer: Unauthorized
var/log/syslog:
output of /var/log/syslog:
Feb 10 13:20:49 puter cupsd[15877]: *** WARNING *** The programme 'cupsd' uses the Apple Bonjour compatiblity layer of Avahi.
Feb 10 13:20:49 puter cupsd[15877]: *** WARNING *** Please fix your application to use the native API of Avahi!
Feb 10 13:20:49 puter cupsd[15877]: *** WARNING *** For more information see <http://0pointer.de/avahi-compat?s=libdns_sd&e=cupsd>
Feb 10 13:20:49 puter kernel: [145619.432996] audit(1202649649.105:4): type=1503 operation="inode_permission" requested_mask="a" denied_mask="a" name="/dev/tty" pid=15877 profile="/usr/sbin/cupsd"

tried sudo aa-complain cupsd but it didn't resolve it. No idea how I might 'fix my application' for the native API of Avahi or whether this would help?

Try *which* package in gutsy-proposed? HPLIP?

Worked it out - for anyone who's struggling, I installed the latest HPLIP using the self-installer from sourceforge on both machines and it's working perfectly now. http://hplip.sourceforge.net/install/install/index.html

bastubis: For the record, the dmesg apparmor messages are harmless and known. If aa-complain doesn't fix printing, then it is not a bug in the AppArmor profile and thus a bug in hplip itself. Seems that the newest version fixed it for you, good! Thanks for your feedback.

I ran "sudo aa-complain cupsd", then "hp-setup 001:052" : this opens the gui, the printer is correctly found, and clicking on button "Next" triggers the segfault. dmesg yields :

[588629.086002] audit: type=1400 audit(1672757991.548:13283): apparmor="ALLOWED" operation="capable" profile="/usr/sbin/cupsd" pid=249805 comm="cupsd" capability=12 capname="net_admin"
[588635.064146] python[249810]: segfault at fffffc00 ip 00007f6575b5b75d sp 00007ffc99214c98 error 4 in libc.so.6[7f65759e1000+195000]
[588635.064156] Code: 1f 84 00 00 00 00 00 66 0f 1f 44 00 00 f3 0f 1e fa 89 f8 48 89 fa c5 f9 ef c0 25 ff 0f 00 00 3d e0 0f 00 00 0f 87 a3 01 00 00 <c5> fd 76 0f c5 fd d7 c1 85 c0 0f 84 93 00 00 00 f3 0f bc c0 c1 e8

sorry wrong window