Comment 3 for bug 1370930

Revision history for this message
Jamie Strandboge (jdstrand) wrote :

Since 14.04, apparmor has signal mediation. Cups is trying to kill some processes. To obtain 13.10 behavior, you could add this to usr.sbin.cupsd:
  signal,

However, this would obviously allow cups to send signals to anything. I'm guessing it is sending signals to third party backends. It would probably be best to change this rule:
  /usr/lib/cups/backend/* Ux,

to something like (untested):
  /usr/lib/cups/backend/* Cx -> cups_backends,
  signal (send) peer=cups_backends,
  profile cups_backends {
    file,
    capability,
    network,
    audit deny capability mac_admin,
    dbus,
    signal,
    ptrace,
    unix,
  }

In addition to fixing the above, this adds a modest improvement over what we have now: backends aren't allowed to change MAC policy, can't change_profile and can't use mount.