Package: cups-daemon Version: 2.4.18-1 Severity: normal Tags: newcomer apparmor
Description: The CUPS AppArmor profile prevents CUPS from resolving local users managed by systemd-homed. This causes repeated authentication prompts in KDE System Settings → Printers, even when the user enters valid credentials. Symptoms: CUPS repeatedly logs: User "rein" does not exist. pam_authenticate() returned 7 (Authentication failure) The account resolves correctly outside the CUPS AppArmor profile: $ getent passwd rein rein:x:1000:1000:Rein Ketelaars:/home/rein:/bin/bash However, the same lookup fails inside the CUPS profile: $ sudo aa-exec -p /usr/sbin/cupsd -- getent passwd rein $ echo $? 2 The kernel audit log shows the cause: apparmor="DENIED" operation="open" profile="/usr/sbin/cupsd" name="/etc/machine-id" requested_mask="r" denied_mask="r" Proposed fix: Add read access to /etc/machine-id in /etc/apparmor.d/usr.sbin.cupsd: /etc/machine-id r, Verification: Adding the following rule to /etc/apparmor.d/local/usr.sbin.cupsd: /etc/machine-id r, ... resolves the issue. Thank you! Rein Ketelaars -- System Information: Debian Release: forky/sid APT prefers testing APT policy: (500, 'testing') Architecture: amd64 (x86_64) Foreign Architectures: i386 Kernel: Linux 7.2.12+deb14-amd64 (SMP w/20 CPU threads; PREEMPT) Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE not set Shell: /bin/sh linked to /usr/bin/dash Init: systemd (via /run/systemd/system) LSM: AppArmor: enabled Versions of packages cups-daemon depends on: ii bc 1.07.1-4 ii libavahi-client3 0.8-18 ii libavahi-common3 0.8-18 ii libc6 2.43-7 ii libcups2t64 2.4.18-1 ii libdbus-1-3 1.16.2-8 ii libgssapi-krb5-2 1.22.1-3 ii libpam0g 1.7.0-8 ii libpaper2 2.3.0-0.3 ii libsystemd0 262-1 ii procps 2:4.0.7-1 ii ssl-cert 1.2.0 ii systemd [systemd-sysusers] 262-1 ii sysvinit-utils [lsb-base] 3.18-1 Versions of packages cups-daemon recommends: ii avahi-daemon 0.8-18 ii colord 1.4.8-3 ii cups-browsed 1.28.17-7+b3 ii ipp-usb 0.9.31-2 Versions of packages cups-daemon suggests: ii cups 2.4.18-1 ii cups-bsd 2.4.18-1 ii cups-client 2.4.18-1 ii cups-common 2.4.18-1 ii cups-filters 1.28.17-7+b3 pn cups-pdf <none> ii cups-ppdc 2.4.18-1 ii cups-server-common 2.4.18-1 pn foomatic-db-compressed-ppds | foomatic-db <none> ii ghostscript 10.08.0~dfsg-2 ii poppler-utils 26.07.0-3 ii smbclient 2:4.25.1+dfsg-1 ii udev 262-1 -- no debconf information
