This debdiff fixes a regression in cups-pk-helper on Ubuntu 24.04 after upgrading CUPS/libcups2t64 to a version containing the CVE-2025-61915 fix.
Ubuntu runs the main cups-pk-helper D-Bus mechanism as the unprivileged cups-pk-helper user. After the CUPS security fix, updating cupsd.conf through the local CUPS socket requires root peer credentials. As a result, ServerSetSettings fails and server-setting changes from system-config-printer are not applied. The debdiff keeps the existing unprivileged frontend and adds a restricted root-owned internal D-Bus backend for ServerSetSettings only. The backend accepts requests only from the cups-pk-helper frontend service account. It also restores the intended authorization behavior: * ServerSetSettings requires administrator authentication. * ServerGetSettings remains unprivileged because it is read-only. * On Ubuntu 24.04 and later, an early JavaScript Polkit rule overrides Ubuntu's broad cups-pk-helper allow rule for ServerSetSettings only. * A PKLA policy is installed as a compatibility fallback for older Polkit implementations. No public cups-pk-helper D-Bus API is changed. Existing clients, including system-config-printer, continue to use org.opensuse.CupsPkHelper.Mechanism.ServerSetSettings. ** Patch added: "cups-pk-helper-server-settings.debdiff" https://bugs.launchpad.net/ubuntu/+source/cups-pk-helper/+bug/2167414/+attachment/6000743/+files/cups-pk-helper-server-settings.debdiff -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2167414 Title: ServerSetSettings fails after CVE-2025-61915: non-root cups-pk-helper cannot PUT cupsd.conf To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/cups-pk-helper/+bug/2167414/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
