Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 863221 - net-print/cups-2.4.2-r1 forbids all requests
Summary: net-print/cups-2.4.2-r1 forbids all requests
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: Current packages (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Printing Team
URL:
Whiteboard:
Keywords:
Depends on:
Blocks: 867427
  Show dependency tree
 
Reported: 2022-08-02 23:17 UTC by Freddie Witherden
Modified: 2022-08-30 14:16 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Freddie Witherden 2022-08-02 23:17:33 UTC
Installing CUPS as:

emerge -av cups

These are the packages that would be merged, in order:

Calculating dependencies... done!
[ebuild   R    ] net-print/cups-2.4.2-r1::gentoo  USE="X acl dbus pam ssl usb zeroconf -debug -kerberos -openssl (-selinux) -static-libs -systemd -test -xinetd" ABI_X86="32 (64) (-x32)" 0 KiB

and then after starting cupsd and cups-browsed I find:

# whoami
root
# lpinfo -v
lpinfo: Forbidden

Similarly, going to the web interface on port 631, authenticating as root, and then going to "add new printers" via the administration tab I am also given a forbidden message.  This is all with the default configuration.

Looking through the error log I see lines of:

E [02/Aug/2022:18:15:58 -0500] [Client 367] Returning HTTP Forbidden for CUPS-Add-Modify-Printer (ipp://localhost/printers/HP_Color_LaserJet_M653) from localhost
E [02/Aug/2022:18:15:59 -0500] [Client 369] Returning HTTP Forbidden for CUPS-Add-Modify-Printer (ipp://localhost/printers/HP_PageWide_Pro_577_MFP) from localhost
E [02/Aug/2022:18:15:59 -0500] [Client 371] Returning HTTP Forbidden for CUPS-Add-Modify-Printer (ipp://localhost/printers/HP_PageWide_Pro_577_MFP) from localhost
E [02/Aug/2022:18:16:08 -0500] [Client 373] Returning HTTP Forbidden for CUPS-Add-Modify-Printer (ipp://localhost/printers/HP_Color_LaserJet_M653) from localhost
E [02/Aug/2022:18:16:08 -0500] [Client 375] Returning HTTP Forbidden for CUPS-Add-Modify-Printer (ipp://localhost/printers/HP_Color_LaserJet_M653) from localhost
E [02/Aug/2022:18:16:09 -0500] [Client 377] Returning HTTP Forbidden for CUPS-Add-Modify-Printer (ipp://localhost/printers/HP_PageWide_Pro_577_MFP) from localhost
E [02/Aug/2022:18:16:09 -0500] [Client 379] Returning HTTP Forbidden for CUPS-Add-Modify-Printer (ipp://localhost/printers/HP_PageWide_Pro_577_MFP) from localhost

which I believe are from cups-browsed trying to automatically add driverless printers it has found on the network.  With a default config this should not be forbidden.

Reproducible: Always
Comment 1 mario.haustein 2022-08-26 16:44:52 UTC
I experienced the same issue. Just a hint/workaround: Adding user `root` to the group `lpadmin` solved the issue.
Comment 2 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2022-08-26 23:33:21 UTC
(In reply to mario.haustein from comment #1)
> I experienced the same issue. Just a hint/workaround: Adding user `root` to
> the group `lpadmin` solved the issue.

Thanks for the hint.

Okay, so, found a Debian bug at https://bugs.debian.org/1006853.

They did:
```
cups (2.4.1op1-2) unstable; urgency=medium

  * debian/rules: in latest cups version, root is no longer automatically
                  added to SystemGroup in cups-files.conf, so add
                     --with-system-groups="root lpadmin"
                  to configure step
                  (Closes: #1006849 #1006727 #876207)

 -- Thorsten Alteholz <debian@alteholz.de>  Mon, 07 Mar 2022 22:08:09 +0100
```
Comment 3 Larry the Git Cow gentoo-dev 2022-08-27 07:46:58 UTC
The bug has been closed via the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=ac8d965b745c52b54d542552776f350dba0fab7a

commit ac8d965b745c52b54d542552776f350dba0fab7a
Author:     Sam James <sam@gentoo.org>
AuthorDate: 2022-08-27 07:45:41 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2022-08-27 07:46:48 +0000

    net-print/cups: allow root to access web interface
    
    See also: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1006853.
    
    Closes: https://bugs.gentoo.org/863221
    Signed-off-by: Sam James <sam@gentoo.org>

 net-print/cups/cups-2.4.2-r2.ebuild | 320 ++++++++++++++++++++++++++++++++++++
 net-print/cups/cups-9999.ebuild     |   3 +-
 2 files changed, 322 insertions(+), 1 deletion(-)