[cups.bugs] [HIGH] STR #2454: world-executable backends are run under the root account during discovery

[Dmitry Sharov]

DO NOT REPLY TO THIS MESSAGE.  INSTEAD, POST ANY RESPONSES TO THE LINK BELOW.

[STR New]

Backends with world-execute permissions are run as the root user during
device discovery, while they should not.

According to backend(7), PERMISSIONS section:
Backends without world-execute permissions are run as the root user, while
backends with world-execute permissions are run using the unprivileged user
account, typically "lp".

Please note, that during job processing backends with world-execute
permissions are correctly run under the unprivileged user account.

Link: http://www.cups.org/str.php?L2454
Version: 1.3-current