[cups-devel] [UNKN] STR #4781: cupsenable issues 'client-error-not-authorized' when queue has ACL

[Arney]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

DO NOT REPLY TO THIS MESSAGE.  INSTEAD, POST ANY RESPONSES TO THE LINK BELOW.

[STR New]

I ran this minimal script as 'root'

/usr/sbin/lpadmin -E -p Testo -v /dev/null
/usr/sbin/lpadmin -E -p Testo -u allow:sshd
/usr/sbin/cupsenable -E Testo
echo $?

and always got the error

cupsenable: Operation failed: client-error-not-authorized
1

on every of the following systems systems:

Centos 7.1 (Cups 1.6.3)
Ubuntu 12.04 (Cups 1.7.2)
Ubuntu 15.04 (Cups 2.0.2)

In each case, the queue was actually in enabled state post-run.

Further investigation showed that the error will show if and only if 'root'
is not a member of the ACL, i.e. '-u allow:sshd' will lead to an error
whereas  '-u allow:sshd,root' will not.

In all cases, the cupsd.conf came unmodified from the vendor packages and
included

  # All printer operations require a printer operator to authenticate...
  <Limit Pause-Printer Resume-Printer Enable-Printer Disable-Printer
Pause-Printer-After-Current-Job Hold-New-Jobs Release-Held-New-Jobs
Deactivate-Printer Activate-Printer Restart-Printer Shutdown-Printer
Startup-Printer Promote-Job Schedule-Job-After Cancel-Jobs CUPS-Accept-Jobs
CUPS-Reject-Jobs>
    AuthType Default
    Require user @SYSTEM
    Order deny,allow
  </Limit>

No such behavior was observed for cupsaccept/cupsreject/cupsdisable.

Link: https://www.cups.org/str.php?L4781
Version: 2.0.2
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.14 (GNU/Linux)
Comment: GPGTools - https://gpgtools.org

iQIcBAEBCgAGBQJW4C2WAAoJENujp6sI12IjUX0QAJ/ap1vRlow7Gou9/0i7exX8
CcYAL1ejHJ0aL200dswjJ6kFESQKSWqsx0S4qt6p46eAjlljue97mNWZpQNf/IAV
CgDwEDl3yCYI2ECAIjORtY3OQRMJ5XcsrECtEgSo4G1uoc6fLEN4Yp/fLa3u0Mvn
zc3/AHamSdjGv3lCb4BtCFYHVuOHJIY676zM2d1QvKJyGRuwi8kwAMS6LOazqZd2
b7Y1q2RzHr2aRjf0xeiiQiqlftnqaoihLvqwJRzvc3hTRVCng4/2ULICI1x5hTa6
YoZzKI7eg33JaKCJr/lO4kfq8OK5xs1TjppZAUR+YR2KAa+eQHLgfx40oVXRqKQn
Mj+IVikN/z1wUOH0nxqJ38T6mNMBt7OTLGOTIpu8B/cE+dt+JYor9fr6jRoVICTa
cM1uV64uGuvPLs6dWEKUR28kZ5syLFHEwHg3BaFfJapYRPItckUEu9EvLNzLWU2G
86c8tcSMmb71lmq/IugDoG6bUI0okQjUbomOIXFW42dw1KRKtpOGv9955hivfbpb
5RNN5mHePx7PEUGvj5sEPwcHLa9vhsAhlVhN1QZPwCiEgXm1PRXeDvoGQUjfrDhQ
MUZHL7dZFAx0uwlb5IBasvkFZyVY4VTbj18dDzm33m2GwjvejIXTlSd/RSxjkFlG
Ds+mxngkrfbSrGXdQsdE
=ebyZ
-----END PGP SIGNATURE-----