[SOLVED] Running cupsd without root permission.

mrallaire · 2013-08-26 20:52:21

Hello,

This is a newbie question about running the CUPS daemon as a regular user.

The Arch Wiki page on CUPS said to "start the cups ... daemon" but did not say how.

I searched the web and found that you can start it as a root user with the following command:

# cupsd

At this point, I can setup a printer, and everythings prints properly. However, I have to restart cupsd each time I reboot. Being a root only command, I can't add it to my startup script.

What do I do?

Here are some more details:

I installed 64 bit arch a few days ago.

I'm not using a desktop environment, just openbox window manager. The startup script I am using is the openbox-session autostart script.

If I run the command "cupsd" as a regular user, I get bash: /usr/bin/cupsd: Permission denied. This is how I know it will not work. This rules out a typo in the startup script.

Here is a list of all the steps/commands used to install cups:

Turn printer on
$ su
enter root password
# pacman -S cups
# pacman -S cups-filters
# pacman -S ghostscript
# pacman -S gsfonts
# pacman -S gutenprint
# cupsd
# exit
$ firefox -new-window http://localhost:631
Adding Printers and Classes
Add Printer
Login as root with the root password
Select the local printer detected
Default Name, Description, Location
Select the model: Canon PIXMA MP510
Default options
Printed a test page.
Got excited.
Spent 4 hours trying to run cupsd in a startup script.

I tried to add my regular user to the lp group.

$ su
enter root password
# gpasswd -a michael lp
$ exit
$ groups michael
confirmed that I'm added to lp
$ cupsd

I tried to chmod /usr/bin/cupsd, but got a weird error message "Child exited on signal 15". I used pacman to uninstall then reinstall cups undo this attempt.

$ su
enter root password
# chmod a+rwx /usr/bin/cupsd
# exit
$ cupsd

Some sites said to edit /etc/cups/cupsd.conf and comment out some lines. However, none of the lines mentioned exist in my /etc/cups/cupsd.conf file. I tried to comment out a few that looked close, but no success. I ended up commenting out everything and still no success. I used pacman to uninstall then reinstall cups undo this attempt, returning /etc/cups/cupsd.conf to it's original condition. Here is the file:

#
# "$Id: cupsd.conf.in 7888 2008-08-29 21:16:56Z mike $"
#
# Sample configuration file for the CUPS scheduler.  See "man cupsd.conf" for a
# complete description of this file.
#

# Log general information in error_log - change "warn" to "debug"
# for troubleshooting...
LogLevel warn

# Only listen for connections from the local machine.
Listen localhost:631
Listen /run/cups/cups.sock

# Show shared printers on the local network.
Browsing On
BrowseLocalProtocols dnssd

# Default authentication type, when authentication is required...
DefaultAuthType Basic

# Web interface setting...
WebInterface Yes

# Restrict access to the server...
<Location />
  Order allow,deny
</Location>

# Restrict access to the admin pages...
<Location /admin>
  Order allow,deny
</Location>

# Restrict access to configuration files...
<Location /admin/conf>
  AuthType Default
  Require user @SYSTEM
  Order allow,deny
</Location>

# Set the default printer/job policies...
<Policy default>
  # Job/subscription privacy...
  JobPrivateAccess default
  JobPrivateValues default
  SubscriptionPrivateAccess default
  SubscriptionPrivateValues default

  # Job-related operations must be done by the owner or an administrator...
  <Limit Create-Job Print-Job Print-URI Validate-Job>
    Order deny,allow
  </Limit>

  <Limit Send-Document Send-URI Hold-Job Release-Job Restart-Job Purge-Jobs Set-Job-Attributes Create-Job-Subscription Renew-Subscription Cancel-Subscription Get-Notifications Reprocess-Job Cancel-Current-Job Suspend-Current-Job Resume-Job Cancel-My-Jobs Close-Job CUPS-Move-Job CUPS-Get-Document>
    Require user @OWNER @SYSTEM
    Order deny,allow
  </Limit>

  # All administration operations require an administrator to authenticate...
  <Limit CUPS-Add-Modify-Printer CUPS-Delete-Printer CUPS-Add-Modify-Class CUPS-Delete-Class CUPS-Set-Default CUPS-Get-Devices>
    AuthType Default
    Require user @SYSTEM
    Order deny,allow
  </Limit>

  # All printer operations require a printer operator to authenticate...
  <Limit Pause-Printer Resume-Printer Enable-Printer Disable-Printer Pause-Printer-After-Current-Job Hold-New-Jobs Release-Held-New-Jobs Deactivate-Printer Activate-Printer Restart-Printer Shutdown-Printer Startup-Printer Promote-Job Schedule-Job-After Cancel-Jobs CUPS-Accept-Jobs CUPS-Reject-Jobs>
    AuthType Default
    Require user @SYSTEM
    Order deny,allow
  </Limit>

  # Only the owner or an administrator can cancel or authenticate a job...
  <Limit Cancel-Job CUPS-Authenticate-Job>
    Require user @OWNER @SYSTEM
    Order deny,allow
  </Limit>

  <Limit All>
    Order deny,allow
  </Limit>
</Policy>

# Set the authenticated printer/job policies...
<Policy authenticated>
  # Job/subscription privacy...
  JobPrivateAccess default
  JobPrivateValues default
  SubscriptionPrivateAccess default
  SubscriptionPrivateValues default

  # Job-related operations must be done by the owner or an administrator...
  <Limit Create-Job Print-Job Print-URI Validate-Job>
    AuthType Default
    Order deny,allow
  </Limit>

  <Limit Send-Document Send-URI Hold-Job Release-Job Restart-Job Purge-Jobs Set-Job-Attributes Create-Job-Subscription Renew-Subscription Cancel-Subscription Get-Notifications Reprocess-Job Cancel-Current-Job Suspend-Current-Job Resume-Job Cancel-My-Jobs Close-Job CUPS-Move-Job CUPS-Get-Document>
    AuthType Default
    Require user @OWNER @SYSTEM
    Order deny,allow
  </Limit>

  # All administration operations require an administrator to authenticate...
  <Limit CUPS-Add-Modify-Printer CUPS-Delete-Printer CUPS-Add-Modify-Class CUPS-Delete-Class CUPS-Set-Default>
    AuthType Default
    Require user @SYSTEM
    Order deny,allow
  </Limit>

  # All printer operations require a printer operator to authenticate...
  <Limit Pause-Printer Resume-Printer Enable-Printer Disable-Printer Pause-Printer-After-Current-Job Hold-New-Jobs Release-Held-New-Jobs Deactivate-Printer Activate-Printer Restart-Printer Shutdown-Printer Startup-Printer Promote-Job Schedule-Job-After Cancel-Jobs CUPS-Accept-Jobs CUPS-Reject-Jobs>
    AuthType Default
    Require user @SYSTEM
    Order deny,allow
  </Limit>

  # Only the owner or an administrator can cancel or authenticate a job...
  <Limit Cancel-Job CUPS-Authenticate-Job>
    AuthType Default
    Require user @OWNER @SYSTEM
    Order deny,allow
  </Limit>

  <Limit All>
    Order deny,allow
  </Limit>
</Policy>

#
# End of "$Id: cupsd.conf.in 7888 2008-08-29 21:16:56Z mike $".
#

Thanking those in advance that can help.

Last edited by mrallaire (2013-10-20 05:37:52)

jasonwryan · 2013-08-26 20:59:51

What don't you just enable the cups service?

polson136 · 2013-08-26 21:02:30

+1 for what jasonwryan said. Take a look at systemctl.

# systemctl enable cups

mrallaire · 2013-08-27 01:14:15

Enabling the cups service with systemctl does not work either.

I tried:

$ su
root password
# systemctl enable cups
the command ran with no error message
# exit
tried to print something, no printer
$ cupsd
error message still said access denied

systemctl will only work with root.

cfr · 2013-08-27 01:36:10

# systemctl enable cups.service
# systemctl start cups.service

You don't need to start the daemon as your regular user.

jocheem67 · 2013-08-27 04:22:12

After enabling any service ( as root btw ), you need a restart I believe. Besides , you might possibly need an aur driver for your canon.

cfr · 2013-08-27 20:29:19

jocheem67 wrote:

After enabling any service ( as root btw ), you need a restart I believe. Besides , you might possibly need an aur driver for your canon.

What grounds do you have for that belief?

If you enable the service but do not start it, it will not be started until you reboot. But the start command starts the service immediately.

mrallaire · 2013-10-20 05:33:07

Well, the problem is now resolved. After using my wife's printer for 1.5 months I finally had the time to try it again. I got it working. I entered a lot of different commands, but the following is what finally did the trick. The ideas came from ThomasR on another forum post: https://bbs.archlinux.org/viewtopic.php?id=35567

<code>
# killall cupsd
# groupadd printadmin
# usermod -aG printadmin myusername
# nano /etc/cups/cupsd.conf
Add the following to the bottom of the file and save:
SystemGroup printadmin
# cupsd
Add the printer using the web-based administration interface (in the web browser, go to URL http://localhost:631)
</code>

I looks like the lp group stuff that I entered in my first post was a few commands short of being effective. The printadmin group commands worked wonderfully. After rebooting the computer the change stuck, so I never had to restart the cups daemon each time I rebooted the computer.

I don't know what way is better to start the cups daemon, cupsd or systemctl.

<code>
# cupsd

vs.

# systemctl enable cups.service
# systemctl start cups.service
</code>

WonderWoofy · 2013-10-20 06:35:14

You know that this functionality is provided by the existent 'sys' group? See here, in this chart you can see the various commonly used groups and what function they provide.

cfr · 2013-10-20 15:43:44

This is only necessary at all if you want to be able to e.g. add printers as a regular user. If you just want to be able to print as a normal user, you just authenticate in the web interface when you need to add/modify/delete printers. Am I missing something here?

It is better to use systemctl to start cupsd because systemd will monitor and manage the daemon.

WonderWoofy · 2013-10-20 15:49:53

cfr wrote:

This is only necessary at all if you want to be able to e.g. add printers as a regular user. If you just want to be able to print as a normal user, you just authenticate in the web interface when you need to add/modify/delete printers. Am I missing something here?
It is better to use systemctl to start cupsd because systemd will monitor and manage the daemon.

No I don't think you're missing anything here. From the post above mine, it appeared as though he/she was creating a whole new group, etc. to gain the functionality that the sys group already provides.

And yes, it is silly to start the daemon from the command line. I use the cups.socket so that I get socket activation. The only issue with that is that navigating to localhost:631 does not seem to start the daemon (at least it didn't the last time I tried), so if you want to configure anything via the web interface you have to actually start the service.

cfr · 2013-10-20 16:24:27

OK. You're absolutely right about not needing to create a new group. I'm just not sure from earlier posts that the OP really needed to add themselves to any group. But it is definitely better to use e.g. sys if that functionality is required.

I've never tried socket activation with cups. I would probably get annoyed at the need to start it to access the web interface, though. (Also, I use networked printers as well as USB printers and I'm not sure their presence would activate it.)

Cups can be a pain. It doesn't always notice things, for example, which I think it should!

WonderWoofy · 2013-10-20 16:45:34

I have not had any problem with it starting when it actually needs to print something. I only had to start the service when I wanted to get to the web interface. There is also a cups.path that specifies PathExistsGlob=/var/spool/cups/d* but I have never actually tried that. Nor have I actually looked to see what kinds of files are actually created in the spool when printing. In fact, I don't even know if these are actually volatile files or if they just signify that a printer is set up... meh, cups.socket works fine for me.

Arch Linux

#1 2013-08-26 20:52:21

[SOLVED] Running cupsd without root permission.

#2 2013-08-26 20:59:51

Re: [SOLVED] Running cupsd without root permission.

#3 2013-08-26 21:02:30

Re: [SOLVED] Running cupsd without root permission.

#4 2013-08-27 01:14:15

Re: [SOLVED] Running cupsd without root permission.

#5 2013-08-27 01:36:10

Re: [SOLVED] Running cupsd without root permission.

#6 2013-08-27 04:22:12

Re: [SOLVED] Running cupsd without root permission.

#7 2013-08-27 20:29:19

Re: [SOLVED] Running cupsd without root permission.

#8 2013-10-20 05:33:07

Re: [SOLVED] Running cupsd without root permission.

#9 2013-10-20 06:35:14

Re: [SOLVED] Running cupsd without root permission.

#10 2013-10-20 15:43:44

Re: [SOLVED] Running cupsd without root permission.

#11 2013-10-20 15:49:53

Re: [SOLVED] Running cupsd without root permission.

#12 2013-10-20 16:24:27

Re: [SOLVED] Running cupsd without root permission.

#13 2013-10-20 16:45:34

Re: [SOLVED] Running cupsd without root permission.

Board footer