Bug#1060378: cups-daemon: Still present in September 2025.

[Eric Towers <fuzzyeric@gmail.com>]

Package: cups-daemon
Version: 2.4.2-3+deb12u8
Followup-For: Bug #1060378
X-Debbugs-Cc: fuzzyeric@gmail.com

Dear Maintainer,

At /usr/sbin/cupsd start by systemd, kernel syslog reports

apparmor="DENIED" operation="capable" profile="/usr/sbin/cupsd" pid=48383 comm="cupsd" capability=12  capname="net_admin"

Bug #980974 correctly determined that a setsockopt(2) with
SO_SNDBUFFORCE and/or ipp-usb may require net_admin capability.  That
bug was incorrectly closed following a report that someone suppressed
the denial reporting.  So this defect persists.

(Aside: While we're talking about AppArmor, could we also get cupsd read
access to /etc/papersize and /etc/magic ?)



-- System Information:
Debian Release: 12.11
  APT prefers oldstable-updates
  APT policy: (500, 'oldstable-updates'), (500, 'oldstable-security'), (500, 'oldstable')
Architecture: amd64 (x86_64)

Kernel: Linux 6.1.0-37-amd64 (SMP w/6 CPU threads; PREEMPT)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages cups-daemon depends on:
ii  adduser                    3.134
ii  bc                         1.07.1-3+b1
ii  init-system-helpers        1.65.2
ii  libavahi-client3           0.8-10+deb12u1
ii  libavahi-common3           0.8-10+deb12u1
ii  libc6                      2.36-9+deb12u10
ii  libcups2                   2.4.2-3+deb12u8
ii  libdbus-1-3                1.14.10-1~deb12u1
ii  libgssapi-krb5-2           1.20.1-2+deb12u3
ii  libpam0g                   1.5.2-6+deb12u1
ii  libpaper1                  1.1.29
ii  libsystemd0                252.38-1~deb12u1
ii  procps                     2:4.0.2-3
ii  ssl-cert                   1.1.2
ii  sysvinit-utils [lsb-base]  3.06-4

Versions of packages cups-daemon recommends:
ii  avahi-daemon  0.8-10+deb12u1
ii  colord        1.4.6-2.2
ii  cups-browsed  1.28.17-3+deb12u1
ii  ipp-usb       0.9.23-1+b4

Versions of packages cups-daemon suggests:
ii  cups                                       2.4.2-3+deb12u8
ii  cups-bsd                                   2.4.2-3+deb12u8
ii  cups-client                                2.4.2-3+deb12u8
ii  cups-common                                2.4.2-3+deb12u8
ii  cups-filters                               1.28.17-3+deb12u1
ii  cups-ppdc                                  2.4.2-3+deb12u8
ii  cups-server-common                         2.4.2-3+deb12u8
ii  foomatic-db-compressed-ppds [foomatic-db]  20230202-1
ii  ghostscript                                10.0.0~dfsg-11+deb12u7
ii  poppler-utils                              22.12.0-2+deb12u1
ii  printer-driver-cups-pdf [cups-pdf]         3.0.1-14
ii  smbclient                                  2:4.17.12+dfsg-0+deb12u2
ii  udev                                       252.38-1~deb12u1

-- Configuration Files:
/etc/cups/cups-files.conf changed:
SystemGroup root lpadmin
LogFileGroup adm
AccessLog /mnt/tera/rsyslog/cups/access_log
ErrorLog /mnt/tera/rsyslog/cups/error_log
PageLog /mnt/tera/rsyslog/cups/page_log

/etc/logrotate.d/cups-daemon changed:
/mnt/tera/rsyslog/tera003/cups/*log {
	daily
	missingok
	rotate 7
	sharedscripts
	postrotate
		invoke-rc.d --quiet cups restart > /dev/null
	endscript
	compress
	delaycompress
	notifempty
	create
}


-- no debconf information