According to the cups RPM, /var/spool/cups and /var/spool/cups/tmp are supposed to be owned by user "lp" and group "root". But after installing cups yesterday, I see that both directories are owned by group "sys" instead of "root"; it would appear that something changed their ownership after rpm created the directories during installation. Either whatever changed the ownership should be fixed not to do that, or the RPM should be updated to indicate the correct group ownership (i.e., "sys" instead of "root").
I just updated to cups-1.1.13-1, and there still appear to be permissions issues. Now /etc/cups, /etc/cups/certs, /etc/cups/classes.conf, /etc/cups/cupsd.conf, /etc/cups/ppd, and /etc/cups/printers.conf all have different permissions than the RPm says they should have.
I suspect cupsd is changing this. RPM specfile needs to reflect this.
Fixed in cups-1.1.15-12.