Default services enabled

Hi, I'm having trouble finding a policy on which systemd units may be enabled by default. The case I'm interested in particularly is cups.socket, cups.path, cups.service. What's the current policy, and where can I find it on the wiki? Tim. */ signature.asc Description: This is a digitally

Re: Default services enabled

On Wed, 2011-08-17 at 20:04 +0530, Rahul Sundaram wrote: https://fedoraproject.org/wiki/Starting_services_by_default Ah, thanks. So it looks like CUPS can be enabled by default: If a service does not require configuration to be functional and is not network enabled, it may be enabled by

Re: Default services enabled

On Wed, 2011-08-17 at 10:33 -0500, Chris Adams wrote: Is CUPS functional without any configuration? How do you print without configuring a printer? By plugging one in. Tim. */ signature.asc Description: This is a digitally signed message part -- devel mailing list

Re: Default services enabled

On Wed, 2011-08-17 at 21:02 +0530, Rahul Sundaram wrote: On 08/17/2011 08:47 PM, Tim Waugh wrote: I'll leave cups.service out because that's only required for network-enabled configurations -- but perhaps that needs a release note? Tim. */ Yes. You can add it here https

Re: Default services enabled

On Wed, 2011-08-17 at 10:46 -0500, Michael Cronenworth wrote: Are you pushing this change into Fedora 16? Once it's built, yes, to fix: https://bugzilla.redhat.com/show_bug.cgi?id=731421 Tim. */ signature.asc Description: This is a digitally signed message part -- devel mailing list

Re: Default services enabled

On Thu, 2011-08-18 at 16:52 -0600, Orion Poplawski wrote: It's not so much cups start up being slow as discovering network printers. That can take up to a minute I think. This is true... however, discovered printers are cached so this is only an issue the first time CUPS starts after

Re: Default services enabled

On Fri, 2011-08-19 at 11:03 -0400, Steve Grubb wrote: People running in a LSPP configuration would be horrified to know avahi is now required for printing top secret documents. Just to clarify: it is not required. Most likely in an LSPP configuration not even CUPS Browsing is used, but

Re: Default services enabled

Actually there is another reason for socket activation to use AF_INET as well as AF_UNIX: doing so prevents e.g. rpc.statd from port-squatting. In fact, this is why CUPS no longer ships to ship a portreserve file. Tim. */ signature.asc Description: This is a digitally signed message part --

Re: Heads up: libpng bumped to 1.5.x in rawhide

On Sat, 2011-11-05 at 13:02 -0400, Tom Lane wrote: twaugh ghostscript twaugh gutenprint I've rebuilt these two. Tim. */ signature.asc Description: This is a digitally signed message part -- devel mailing list devel@lists.fedoraproject.org

Too late to merge unix2dos/dos2unix?

The unix2dos and dos2unix packages have merged upstream and I've been sent a spec file that upgrades dos2unix to the new upstream version. It correctly obsoletes the unix2dos package. Is it too late in the Fedora 14 cycle to bring this package in (and retire unix2dos)? Tim. */ signature.asc

Firewall settings unworkable

There are several protocols used for discovery of network services that currently cannot be made to work on Fedora simply due to the restrictive firewall we use by default. For example, a broadcast SNMP query to discover network printers is sent as a UDP packet from an unprivileged local port to

Re: Firewall settings unworkable

On Fri, 2010-10-01 at 15:23 +0200, Tomasz Torcz wrote: ZeroConf discovery (port 5353) is denied by default also :( But that can be enabled with a single checkbox (Multicast DNS (mDNS)), and that can also be done programmatically using system-config-firewall's D-Bus interface, such as it is.

Re: Firewall settings unworkable

On Fri, 2010-10-01 at 15:07 +0100, David Howells wrote: The following works for UDP too: -A INCOMING -m state --state RELATED,ESTABLISHED -j ACCEPT Leastways, I can do AFS through my firewall with it. Does that work for unicast replies to broadcast queries though? e.g. IP

Re: Firewall settings unworkable

On Fri, 2010-10-01 at 15:19 +0100, David Howells wrote: Good question; I don't know. netfil...@vger.kernel.org is probably the place to ask. I did ask about this issue on netfilter, last year (look for SNMP conntrack module a la netbios_ns, Dec 4th 2009). That's where the idea for a general

Re: Package rebuilds for gcc bug https://bugzilla.redhat.com/show_bug.cgi?id=634757

On Tue, 2010-10-05 at 15:27 -0700, Jesse Keating wrote: PPS I did not modify my bump script yet to attempt a commit to master and merge to the f14 branch. In the interest of time, I took the easy route and just did commits to the f14 branch. Maintainers can do a merge and fixup after the

Re: Firewall settings unworkable

On Wed, 2010-10-06 at 17:26 +0200, Thomas Woerner wrote: It is possible to specify a timeout for a firewall service and also the other features. The service will be opened immediately and closed again after the defined period is over. This allows to accept new connections from unknown

Re: Firewall settings unworkable

On Wed, 2010-10-06 at 19:31 +0100, Richard W.M. Jones wrote: Seems quite complex. What's wrong with a directory: /etc/iptables.d/ where RPMs like libvirt just drop the required additional rules (in a separate chain if you like) and restart the iptables service? It's low-tech but

Re: Final (hopefully) privilege escalation policy draft

On Wed, 2010-02-10 at 12:48 -0800, Adam Williamson wrote: I have now adjusted the draft - https://fedoraproject.org/wiki/User:Adamwill/Draft_Fedora_privilege_escalation_policy - to reflect all feedback from this list and from FESco. It will be reviewed again by FESco next week. Please raise

Re: Final (hopefully) privilege escalation policy draft

On Mon, 2010-02-15 at 12:10 -0800, Adam Williamson wrote: That's correct. This is frankly a 'realistic' decision, on the basis that the PackageKit maintainer believes updating packages should be allowed for a regular user by default and intends to implement this, and I don't want to dictate

Re: GSoC 2010 : Better iptables management

On Fri, 2010-03-12 at 10:49 +0530, Zubin Mithra wrote: My name is Zubin Mithra and I am aspiring to get into GSoC on behalf of Fedora. I wish to work on making a library for better iptables management. Details can be viewed in the proposal which I have attached along with the email. I would

Re: Debugging printing problems

On Thu, 2010-03-18 at 21:37 +0100, Louis Lagendijk wrote: great info indeed. Maybe you could consider adding info on the bjnp backend (for Canon's proprietary network (usb-over-ip) protocol: bjnp is for Canon's proprietary bjnp network protocol (usually port 8611) The bjp backend is

[Test-Announce] Printing Test Day Thursday 2010-03-25

There will be a Printing Test Day[1] this Thursday, 2010-03-25. Have access to a printer? Please come along and join in! This is an opportunity to try out the new automatic printer driver installation feature[2] in Fedora 13, as well as to give the printing system a bit of an exercise. For the

Re: Upstream bugs vs. Fedora bugs: KDE people do it wrong

On Mon, 2010-03-29 at 13:35 +0200, Jaroslav Reznik wrote: The problem is - we can't act as man in middle - it's better when original reporter is also upstream reporter = direct communication. Wait -- *any* Fedora developer could say this about any bug. I just don't think it's true, and it

Re: 2010-03-25 Printing test day recap

On Fri, 2010-04-02 at 12:49 -0500, Bruno Wolff III wrote: This isn't exactly a bug, but if I print text files I need to specify a top margin of 9 points and a left margin of 18 points or some text doesn't show up. But postscript output to the same printer works without fudging. This seems odd.

Re: 2010-03-25 Printing test day recap

On Tue, 2010-04-06 at 08:06 -0500, Bruno Wolff III wrote: For both different printer types? (I am pretty sure they used different PPD files.) Well, does the PostScript output go closer to the edge of the paper than where the text output gets cut off? In other words, does it look like it is a

Re: New gtk-vnc slower?

On Wed, 2010-11-24 at 22:05 -0700, Jerry James wrote: Is anybody else seeing this? Is there any other component besides gtk-vnc that I should examine as a possible source of the slowdown? I'm seeing this too. Downgrading to gtk-vnc-0.4.1-6.fc14.1 fixes it here. I've filed a bug report about

Re: Firewall

On Mon, 2010-12-06 at 21:50 +, Richard W.M. Jones wrote: Still not seeing how /etc/iptables.d wouldn't work ... Here is how: When I ask CUPS for a list of network printers, it runs the backends in /usr/lib/cups/backend. One of those is /usr/lib/cups/backend/snmp, which: a) binds to a

Re: Firewall

On Tue, 2010-12-07 at 11:18 -0500, Matthew Miller wrote: Is there a compelling reason for this not to be: - cups snmp backend says to the firewall, hey, please allow responses on this port I've got - cups snmp backend listens for responses until timeout - cups snmp backend says to the

Re: Services that can start by default policy feedback

On Wed, 2011-02-23 at 11:56 -0700, Kevin Fenzi wrote: Some questions: * Do you know of/maintain another service that should start by default? Why? CUPS currently starts by default. The reason is that, even when printing over the network as a client, this service is required to be

Re: Services that can start by default policy feedback

On Thu, 2011-02-24 at 14:27 +0100, Lennart Poettering wrote: I still have unupstreamed patches here which would allow us to start CUPS automatically when a local client needs it or when a printer is plugged in. I think that's separate from the issue of whether the service is allowed to start

Re: hplip (hp-plugin) installs binary-only plugins and firmware into system directories without RPM control

On Sun, 2011-03-13 at 01:14 +0100, Dominik 'Rathann' Mierzejewski wrote: For Tim: have you considered doing something similar to RPMFusion akmod, i.e. modifying hp-setup/hp-plugin to build an appropriate package on-the-fly? Also, the binary plugins get installed under /usr/share/hplip, which

Re: quilt, patch, diff or something else is br0ken in F15

The patch command was recently fixed to prevent files outside the current working directory from being patched unintentionally. Could that be the issue? (It doesn't look like it from the error messages you are getting, but I thought it worth mentioning...) Tim. */ signature.asc Description:

Re: rawhide report: 20110531 changes

On Tue, 2011-05-31 at 10:17 +, Rawhide Report wrote: rasterview-1.3-2.fc16.x86_64 requires libfltk.so.1.1()(64bit) rasterview-1.3-2.fc16.x86_64 requires libfltk_images.so.1.1()(64bit) Fixed. Tim. */ signature.asc Description: This is a digitally signed message part -- devel

Re: cups service gone walkabouts?

On Wed, 2011-07-06 at 10:30 +0100, Tom Hughes wrote: Well first of all I'd check it's enabled as I believe policy is that the enabled/disabled state of a service is not carried over when it migrates from svsvinit to systemd. Correct, and I haven't pursued getting an exception for cups so

Re: cups service gone walkabouts?

On Wed, 2011-07-06 at 11:32 +, Jóhann B. Guðmundsson wrote: I thought with Lennart patch/setup on his blog the only case you need to enable cups is if you are going to be running centralized printer server which in that case the admin himself would enabled it hence we would not have to

Re: cups service gone walkabouts?

On Wed, 2011-07-06 at 13:38 +0100, Tom Hughes wrote: I had assumed that was deliberate, but maybe not? Try today's rawhide. Tim. */ signature.asc Description: This is a digitally signed message part -- devel mailing list devel@lists.fedoraproject.org

Re: Deprecating portreserve

The BMC thing sounds a bit more special-purpose than portreserve, and presumably could be done in its own package that could perhaps be installed as needed depending on the hardware. So is the next step to deprecate portreserve? What actually needs to be done for that to happen? Tim. */

Re: systemd vnc - how to properly handle /etc/sysconfig/vncservers

On Wed, 2011-07-20 at 11:48 +0200, Adam Tkac wrote: Any idea how to handle the VNCSERVERS argument in backward-compatible way is welcomed, otherwise I will simply drop sysconfig support at all in the service file and admin will have to create /etc/systemd/system/ service files with appropriate

Re: PDF printing woes

On Wed, 2012-05-30 at 21:32 +0800, P J P wrote: I'm facing a weird printing problem with cups-1.5.2 on F16. I can print a document from the browser; But when i try to print a PDF document, it prompts me for the cups server password. I've tried with epdfviewer and Adobe Reader both halt at the

Re: Escalation - better desktop printing policy (over two years old issue)

On Fri, 2012-06-15 at 09:30 +0200, valent.turko...@gmail.com wrote: Hi, Fedora still has quite strict printing policies even if users choose to be a part of Administrator group during installation still need to input passwords while changing even the minor printer settings (like unpausing).

Re: Escalation - better desktop printing policy (over two years old issue)

On Sat, 2012-06-16 at 15:12 +0200, valent.turko...@gmail.com wrote: OK, but why isn't this easy fix via new policy done, why is it sitting in bugzilla for over two years? I really don't know. I don't maintain the cups-pk-helper package. Tim. */ signature.asc Description: This is a

Re: Mass rebuild for Fedora 18 Complete

On Sun, 2012-07-22 at 14:33 -0600, Kevin Fenzi wrote: Yep: http://fedorapeople.org/~ausil/f18-failures.html I've fixed diffutils and built it. Tim. */ signature.asc Description: This is a digitally signed message part -- devel mailing list devel@lists.fedoraproject.org

Changes coming for CUPS 1.6

Hi, Although the latest version of CUPS is 1.5.0, development is continuing apace on 1.6. There are some important changes coming in 1.6 which deserve to be pointed out. Some time ago CUPS became an Apple project, and now some of the features that are not relevant to Mac OS are being orphaned.

Re: Changes coming for CUPS 1.6

On Wed, 2012-01-18 at 17:11 +, Ben Boeckel wrote: For those of us that just have static printer setups, would it be possible to make a cups-browse (or similar) subpackage which brings in Avahi? The dependency will be on libavahi-client and libavahi-common, which are part of avahi-libs.

Re: Changes coming for CUPS 1.6

On Wed, 2012-01-18 at 18:14 +0100, Kevin Kofler wrote: What's the story about the PPD stuff Till is talking about there? That scares me the most when I read that mail. Will this be supported by a patch from openprinting.org? Seeing how Apple upstream is dropping features we need, I wonder

Re: Changes coming for CUPS 1.6

On Wed, 2012-01-18 at 17:28 +, Jóhann B. Guðmundsson wrote: Has it been considered to ditch cups altogether ( or keep what's worth keeping from it ) and coming up with a native printer client/server for GNU/Linux? It's been considered, yes. For the time being it isn't beneficial to do

Re: Changes coming for CUPS 1.6

On Thu, 2012-01-19 at 11:38 +, Richard W.M. Jones wrote: I'm still using a very servicable HP LaserJet 5M from ca.1996. Quite -- which is why I believe that CUPS 1.6 will still support PPDs, and why I didn't mention it in my original email. Tim. */ signature.asc Description: This is a

Re: Changes coming for CUPS 1.6

On Thu, 2012-01-19 at 15:50 -0800, Adam Williamson wrote: What a great idea! We could call one of them 'Postscript'... Not likely. :-) I think the current candidate for the optional vector format is PDF 1.4/1.5. Tim. */ signature.asc Description: This is a digitally signed message part --

Re: Requesting a change to the BugStatusWorkFlow: Closed/UPSTREAM

On Fri, 2012-01-20 at 08:39 +0100, Marcela Mašláňová wrote: I use closed/upstream, when I already fixed it in upstream. This bug should be closed with number of release, where it is fixed or with the link to the commit. I wouldn't blame this state for not fixing bug in some projects. I

Orphaning pyusb

I don't have the time to maintain pyusb, and it isn't used by any other package I maintain. $ repoquery -q --whatrequires pyusb garmin-sync-0:0.3-4.fc16.noarch nxt_python-0:0.7-8.fc15.noarch Tim. */ signature.asc Description: This is a digitally signed message part -- devel mailing list

Re: Torvalds:requiring root password for mundane things is moronic

On Fri, 2012-03-02 at 05:21 -0600, Conan Kudo (ニール・ゴンパ) wrote: For printers, currently installing printers does not require superuser privileges, but managing those printers installed by that user does. Is it possible to make it so that printers installed by that user can be managed by the

User session printing

(changing the subject line since this is a bit different from the original topic) On Sun, 2012-03-04 at 00:22 +0100, Miloslav Trmač wrote: Another way to look at this issue is - if printers were maintained per-user (per-user, unprivileged cups daemon, per-user configuration, per-user print

Re: User session printing

Can't we just get the policy right so that users can add queues? Tim. */ signature.asc Description: This is a digitally signed message part -- devel mailing list devel@lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/devel

Re: root password considered harmful, and other security policies. (was Re: Torvalds:requiring root password for mundane things is moronic

On Wed, 2012-03-07 at 11:05 -0800, Scott Doty wrote: /etc/polkit-1/localauthority.conf.d/60-desktop-policy.conf Regarding this situation: turns out that if system-config-printer doesn't establish proper contact with cups-pk-helper, it will fall back to a mode that pops up the root password

Re: User session printing

On Mon, 2012-03-05 at 12:02 -0500, Bill Nottingham wrote: Tim Waugh (twa...@redhat.com) said: For things like cloud printing, where the print server is a hosted service somewhere out in the Internet, I think the applications should be talking directly to it (via the print dialog

Re: User session printing

On Thu, 2012-03-08 at 09:52 -0900, Jef Spaleta wrote: 2012/3/8 Miloslav Trmač m...@volny.cz: The lazy answer to both is fail, or not, the same way as cups currently fails, or not (in fact, could the session printing service simply be cups that treats the system instance as another remote

Re: User session printing

On Fri, 2012-03-09 at 08:21 -0900, Jef Spaleta wrote: Back to the use case of a primarily single user laptop touching multiple networks on a daily basis. For that situation is it expected that the default print server will still be the laptop's own cup server for networked printers?

Privilege escalation policy and desktop_admin_r

I have a question about how our privilege escalation policy interacts with the desktop_admin_r group. Is a member user of desktop_admin_r considered an unprivileged user? Tim. */ signature.asc Description: This is a digitally signed message part -- devel mailing list

Re: Privilege escalation policy and desktop_admin_r

On Thu, 2010-05-27 at 08:23 -0700, Adam Williamson wrote: The relevant bit here is the last sentence, which was intended to cover the whole desktop_admin_r stuff. Let me know if it's factually off. Seeing as desktop_admin_r is actually part of the default spin, can we add some text which

Re: [HEADS-UP] The systemd unit files I'll post

On Wed, 2010-07-14 at 21:41 -0400, Bill Nottingham wrote: Re: cups, if the entire point is to reserve the sockets early with systemd, why would portrelease still be required? Also, re: this comment: # This is evil stuff. CUPS should use proper enumeration instead of # retriggering these

Re: [HEADS-UP] The systemd unit files I'll post

Another question about the cups config: [Install] # This is activated via any of these three triggers: # 1. Somebody connects to its sockets # 2. A file is in the spool directory # 3. A printer is plugged in # This follows the same scheme MacOS uses to spawn CUPS only when necessary

Re: [HEADS-UP] The systemd unit files I'll post

On Thu, 2010-07-15 at 15:32 +0200, Lennart Poettering wrote: The right approach here is to enumerate existing devices when CUPS starts up. All programs that care about devices should do that: But CUPS has no interest in what devices are currently attached. It only cares what queues are

Re: [HEADS-UP] The systemd unit files I'll post

On Thu, 2010-07-15 at 17:25 +0200, Lennart Poettering wrote: Extend the binary you call from the udev rules so that it also can be called outside of the rules and in that case enumerates what is already there. Then, call that after cupsd is started (for example from a ExecStartPost= line in

ghostscript changing license from GPLv3+

In Ghostscript 9.07, the license for the majority of the package is changing from GPLv3+ to AGPLv3+ (the Affero General Public License). I intend to update to 9.07 in rawhide shortly. Tim. */ signature.asc Description: This is a digitally signed message part -- devel mailing list

Re: ghostscript changing license from GPLv3+ to AGPLv3+

In Ghostscript 9.07, the license for the majority of the package is changing from GPLv3+ to AGPLv3+ (the Affero General Public License). I intend to update to 9.07 in rawhide shortly. Tim. */ [Fixed subject line to include new license shortname] signature.asc Description: This is a digitally

Re: ghostscript changing license from GPLv3+ to AGPLv3+

On Fri, 2013-02-22 at 11:48 +0100, Florian Weimer wrote: Is there some exception (like for the database with the unspeakable name), or does this affect CUPS? Will CUPS be extended to allow downloading the Ghostscript source code? Good question: CUPS is licensed as GPLv2, which is listed on

Re: ps2pdf not finding Times-Italic font - where should it be?

On Wed, 2013-08-07 at 18:53 +0100, Paul Howarth wrote: Error: /invalidfont in /findfont Generally ghostscript will substitute another font if it can't find what you're after. This is /invalidfont though, which I think means it tried reading the font you asked for but that font was invalid.

Re: F21 system GCC changed to 4.9.0 prerelease

This new checking looks really powerful. Unfortunately, I'm seeing a build failure for libgphoto2 that I'm having a hard time making sense of: http://kojipkgs.fedoraproject.org//work/tasks/7196/6727196/root.log DEBUG util.py:331: Executing command: ['fedpkg', 'sources'] with env {'LANG':

Re: Problems with Ghostscript license switched to AGPL?

On Tue, 2014-07-29 at 22:40 -0400, Adam Goode wrote: I know this is old news, but Ghostscript switched to AGPL with version 9.07 (Feb 2013). I was not able to find any announcement of this on the Fedora lists. Here's the discussion from this list at the time:

On-demand launching via socket activation

Hi, I'd like to have the default cups presets be: enable cups.socket enable cups.path disable cups.service In other words, I'd like cupsd to start when accessed locally via /var/run/cups/cups.socket, and when there are unprocessed files in the spool directory, but not otherwise. It looks like

Re: On-demand launching via socket activation

On Wed, 2014-09-10 at 14:10 +0200, drago01 wrote: As written today you should ask for an exception ... but I agree that the policy needs to be revised. A good start to revising it is here: https://fedorahosted.org/fpc/ticket/208 e.g. == If a service is enabled by default after installation

Re: On-demand launching via socket activation

On Wed, 2014-09-10 at 12:55 -0400, Matthias Clasen wrote: I think its a great idea. If you want to propose it, we can discuss it in the next WG meeting (I sadly saw this too late for the one that just ended...). OK. I've filed this: https://fedorahosted.org/workstation/ticket/8 Tim. */

Packaging ghostscript's X11 support separately

Hi, I'd like to move %{_libdir}/ghostscript/9.15/X11.so into its own package so that ghostscript can be used without pulling in libX11 etc. All that needs to be done is to package X11.so separately, and if gs can load it at runtime it can provide x11* drivers. If not, it won't. I could package

patch(1) no longer applies patches for symbolic links with .. components in the target

Last week, patch-2.7.3 was released fixing CVE-2015-1196. Both Fedora 20 and Fedora 21 have testing updates: https://admin.fedoraproject.org/updates/FEDORA-2015-1165 https://admin.fedoraproject.org/updates/FEDORA-2015-1134 The fix prevents patches applying if they are for symbolic links with a

patch(1): symbolic links with .. components in the target accepted again

The problem with accepting symbolic links with target pathnames containing .. components has been fixed in patch-2.7.4. Updates are in testing for Fedora 20 and 21. https://bugzilla.redhat.com/show_bug.cgi?id=1185928 Tim. */ signature.asc Description: This is a digitally signed message part

Re: RFC: Round 2 review of Fedora Docker Layered Image Guidelines

On Thu, 2016-08-18 at 09:28 -0400, Tomas Tomecek wrote: >  * Guidelines suggest to use "BZComponent" but upstream label > guidelines mention >    "com.redhat.component"; I would suggest using the latter one > (disclaimer: I >    participated actively in the early history of changes in the label >

Re: CUPS will change license since 2.3 version - now incompatible with GPLv2

On 8 November 2017 at 09:42, Zdenek Dohnal wrote: > CUPS upstream changed license of project to Apache license 2.0, which is > now incompatible with GPLv2. This change will be in new minor release of > CUPS - 2.3.0, which is currently in developing phase (not in Fedora for >