Bug 974462 - Fedora19:beta:cups with FileDevice=yes is not working
Fedora19:beta:cups with FileDevice=yes is not working
Status: CLOSED NOTABUG
Product: Fedora
Classification: Fedora
Component: cups (Show other bugs)
19
ppc64 All
unspecified Severity high
: ---
: ---
Assigned To: Tim Waugh
Fedora Extras Quality Assurance
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2013-06-14 04:44 EDT by IBM Bug Proxy
Modified: 2013-06-14 11:10 EDT (History)
4 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2013-06-14 06:16:37 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
error_log (8.82 KB, text/plain)
2013-06-14 04:44 EDT, IBM Bug Proxy
no flags Details


External Trackers
Tracker ID Priority Status Summary Last Updated
IBM Linux Technology Center 94477 None None None Never

  None (edit)
Description IBM Bug Proxy 2013-06-14 04:44:33 EDT
== Comment: #0 - Sanjeev Patro <sanpatr1@in.ibm.com> - 2013-06-07 08:53:14 ==
In Fedoar19 system printing through FileDevice is not working. FileDevice=yes enables the cups to print the source content in another file. This is mainly used test the configuration of the cups

Here are the steps
1> Installed cups rpm
# rpm -qa | grep cups
cups-libs-1.6.2-7.fc19.ppc64
cups-filesystem-1.6.2-7.fc19.noarch
cups-1.6.2-7.fc19.ppc64
python-cups-1.9.63-3.fc19.ppc64
cups-pk-helper-0.2.4-2.fc19.ppc64
bluez-cups-4.101-6.fc19.ppc64
cups-filters-libs-1.0.31-2.fc19.ppc64
gutenprint-cups-5.2.9-11.fc19.ppc64
cups-filters-1.0.31-2.fc19.ppc64
ghostscript-cups-9.07-2.fc19.ppc64


2> Kernel version of F19
Linux miz11.austin.ibm.com 3.9.4-300.fc19.ppc64p7 #1 SMP Sun May 26 22:14:56 MST 2013 ppc64 ppc64 ppc64 GNU/Linux
[root@miz11 ~]# 

3> Then edited /etc/cups/cupsd.conf and modified couple of area
First added "Listen <ipaddr>:631"
# Only listen for connections from the local machine.
Listen localhost:631
127.0.0.1:631
Listen <ipaddr>:631
Listen /var/run/cups/cups.sock

Then added " allow 9.3.110.*" over here
# Restrict access to the server...
<Location />
  Order allow,deny
  allow 127.0.0.*
  allow 9.3.110.*
</Location>


4> Then we have enable FileDevice in /etc/cups/cups-files.conf
# Do we allow file: device URIs other than to /dev/null?
FileDevice Yes

5> Then restart cups service, disable the firewall and selinux

6> configure one file name /tmp/printsst as a printer output of the printer instance miz11print
 lpadmin -p printmiz11 -E -v file:/tmp/printsst

7> checked the status
# lpstat -p
printer printmiz11 is idle.  enabled since Fri 07 Jun 2013 08:26:57 AM EDT

8> Print /etc/cups/cupsd.conf
lpr -P printmiz11 /etc/cups/cupsd.conf

Output
But It does not print
# cat /tmp/printsst
cat: /tmp/printsst: No such file or directory


By following same steps we are able to get printed in RHEL6.3
Comment 1 IBM Bug Proxy 2013-06-14 04:44:48 EDT
Created attachment 761153 [details]
error_log
Comment 2 Tim Waugh 2013-06-14 06:16:37 EDT
The CUPS scheduler, and its filters and backends, runs with the systemd setting 'PrivateTmp=yes' for more robust defense against temporary file vulnerabilities.

$ systemctl show cups.service | grep PrivateTmp
PrivateTmp=yes

From the systemd.exec(5) man page:
       PrivateTmp=
           Takes a boolean argument. If true sets up a new file system
           namespace for the executed processes and mounts private /tmp and
           /var/tmp directories inside it, that are not shared by processes
           outside of the namespace. This is useful to secure access to
           temporary files of the process, but makes sharing between processes
           via /tmp or /var/tmp impossible. All temporary data created by
           service will be removed after service is stopped. Defaults to
           false.

If you need to have cupsd write to /tmp and be able to read that from other processes, set PrivateTmp=no for cups.service.  For more information on how to achieve this, see:
http://fedoraproject.org/wiki/Systemd#How_do_I_customize_a_unit_file.2F_add_a_custom_unit_file.3F
Comment 3 IBM Bug Proxy 2013-06-14 11:10:31 EDT
------- Comment From sanpatr1@in.ibm.com 2013-06-14 15:00 EDT-------
(In reply to comment #6)
> The CUPS scheduler, and its filters and backends, runs with the systemd
> setting 'PrivateTmp=yes' for more robust defense against temporary file
> vulnerabilities.
>
> $ systemctl show cups.service | grep PrivateTmp
> PrivateTmp=yes
>
> From the systemd.exec(5) man page:
> PrivateTmp=
> Takes a boolean argument. If true sets up a new file system
> namespace for the executed processes and mounts private /tmp and
> /var/tmp directories inside it, that are not shared by processes
> outside of the namespace. This is useful to secure access to
> temporary files of the process, but makes sharing between processes
> via /tmp or /var/tmp impossible. All temporary data created by
> service will be removed after service is stopped. Defaults to
> false.
>
> If you need to have cupsd write to /tmp and be able to read that from other
> processes, set PrivateTmp=no for cups.service.  For more information on how
> to achieve this, see:
> http://fedoraproject.org/wiki/Systemd#How_do_I_customize_a_unit_file.
> 2F_add_a_custom_unit_file.3F

Thanks very much, the solution works. In this case if you can mention about PrivateTmp=yes setting for systemd setting of cups in the documentation page http://fedoraproject.org/wiki/Features/CUPS1.6, then this would be well and good. As this is completely new and nice feature, so user should aware of this as a security feature and get the confidence how secured the cups is.

Note You need to log in before you can comment on or make changes to this bug.