Since 14.04, apparmor has signal mediation. Cups is trying to kill some processes. To obtain 13.10 behavior, you could add this to usr.sbin.cupsd:
signal,
However, this would obviously allow cups to send signals to anything. I'm guessing it is sending signals to third party backends. It would probably be best to change this rule:
/usr/lib/cups/backend/* Ux,
to something like (untested):
/usr/lib/cups/backend/* Cx -> cups_backends,
signal (send) peer=cups_backends,
profile cups_backends {
file,
capability,
network,
audit deny capability mac_admin,
dbus,
signal,
ptrace,
unix,
}
In addition to fixing the above, this adds a modest improvement over what we have now: backends aren't allowed to change MAC policy, can't change_profile and can't use mount.
Since 14.04, apparmor has signal mediation. Cups is trying to kill some processes. To obtain 13.10 behavior, you could add this to usr.sbin.cupsd:
signal,
However, this would obviously allow cups to send signals to anything. I'm guessing it is sending signals to third party backends. It would probably be best to change this rule: lib/cups/ backend/ * Ux,
/usr/
to something like (untested): lib/cups/ backend/ * Cx -> cups_backends,
/usr/
signal (send) peer=cups_backends,
profile cups_backends {
file,
capability,
network,
audit deny capability mac_admin,
dbus,
signal,
ptrace,
unix,
}
In addition to fixing the above, this adds a modest improvement over what we have now: backends aren't allowed to change MAC policy, can't change_profile and can't use mount.