|
Bugzilla – Full Text Bug Listing |
| Summary: | AppArmor makes CUPS irresponsive | ||
|---|---|---|---|
| Product: | [openSUSE] openSUSE 11.1 | Reporter: | Elmar Stellnberger <estellnb> |
| Component: | AppArmor | Assignee: | Jeff Mahoney <jeffm> |
| Status: | RESOLVED INVALID | QA Contact: | E-mail List <qa-bugs> |
| Severity: | Normal | ||
| Priority: | P5 - None | CC: | jsmeix |
| Version: | Final | ||
| Target Milestone: | --- | ||
| Hardware: | All | ||
| OS: | openSUSE 11.1 | ||
| Whiteboard: | |||
| Found By: | --- | Services Priority: | |
| Business Priority: | Blocker: | --- | |
| Marketing QA Status: | --- | IT Deployment: | --- |
|
Description
Elmar Stellnberger
2009-02-10 16:56:35 UTC
Everything works well for me for opemSUSE 11.1 (and worked well in the past for all openSUSE versions). I have no idea at all why the cupsd process gets "Permission denied" errors because the cupsd has unlimited permissions because it runs as root since CUPS 1.2 i.e. since openSUSE 10.2, see http://en.opensuse.org/SDB:CUPS_in_a_Nutshell --------------------------------------------------------------- Up to SUSE LINUX 10.1 we provided CUPS 1.1 and since openSUSE 10.2 we provide CUPS 1.2 which is not fully backward compatible with CUPS 1.1. Therefore in case of an update it is recommended not to use an outdated cupsd.conf from a CUPS 1.1 installation before but to start from scratch with the original cupsd.conf from our CUPS 1.2 RPM. --------------------------------------------------------------- Therefore I can only close the report as "worksforme". Perhaps you have whatever special add-on security stuff set up and running which could even jail root-processes like AppArmor or SELinux or whatever else? But this is not how openSUSE 11.1 is running by default. oops; thx - in deed apparmour has confined cupsd by default; perhaps we should not activate the usr.sbin.cupsd profile by default for it simply does not work. apart from that little fallacy I think of apparmour as a very useful and user friendly security solution. its just a pity that Novell has unlessly separated from it! may we keep the thread for the usr.sbin.cupsd - profile; perhaps I wanna upload an updated version of the profile in the near future. Many thanks for your feedback! Strange: For you AppArmor made CUPS unusable by default but for me CUPS works well out-of-the-box. I did a out-of-the-box default installation of openSUSE 11.1. I am really no AppArmor expert so that I don't know how to find out what went wrong on your system. To investigate what went wrong on your system, I reopen the issue and change the component to AppArmor so that an AppArmor expert could have a look. Wanna close this bug for the system it has been reported for had been hacked (It does not make sense to issue an error report on a hacked system.). Works well for a clean reinstallation. Again many thanks for your candid feedback! What about providing Apparmor profiles out-of-the-box for sbin.rpcbind(like under Mandrake) or for Kopete, Epiphany and Thunderbird? It should be worth a recommendation to activate this right after the primary installation. Besides this something seems to be wrong with the profile for Firefox:
>/etc/init.d/boot.apparmor
Profile /etc/apparmor.d/usr.lib.firefox.firefox failed to load
|