Arch Linux

marceloneil

Member

Registered: 2016-12-06

Posts: 4

CUPS "Filter Failed" with "Error: /invalidfileaccess in --run--"

Hey all! CUPS recently started acting up whenever I try printing something (on any printer), with a "Filter Failed". I suspect this has something to do with the 2.2.6-2 upgrade, as the cups user/group were added. I still have the lp group on my system, if that has any relevance. Here is a snippet of the error_log which I believe is most relevant, although I can provide much more if needed.

D [29/Aug/2018:22:01:45 -0400] [Job 16] Error: /invalidfileaccess in --run--
D [29/Aug/2018:22:01:45 -0400] [Job 16] Operand stack:
D [29/Aug/2018:22:01:45 -0400] [Job 16] true   (/var/spool/cups/tmp/gs_biZRW4)
D [29/Aug/2018:22:01:45 -0400] [Job 16] Execution stack:
D [29/Aug/2018:22:01:45 -0400] [Job 16] %interp_exit   .runexec2   --nostringval--   --nostringval--   --nostringval--   2   %stopped_push   --nostringval--   --nostringval--   --nostringval--   false   1   %stopped_push   2015   2   3   %oparray_pop   2014   2   3   %oparray_pop   1998   2   3   %oparray_pop
D [29/Aug/2018:22:01:45 -0400] [Job 16] Dictionary stack:
D [29/Aug/2018:22:01:45 -0400] [Job 16] --dict:996/1684(ro)(G)--   --dict:1/20(G)--   --dict:78/200(L)--
D [29/Aug/2018:22:01:45 -0400] [Job 16] Current allocation mode is local
D [29/Aug/2018:22:01:45 -0400] [Job 16] Last OS error: No such file or directory
D [29/Aug/2018:22:01:45 -0400] [Job 16] GPL Ghostscript 9.23: Unrecoverable error, exit code 1
D [29/Aug/2018:22:01:45 -0400] [Job 16] Rendering completed

If this is a file permission error, here is what /var/spool/cups/tmp looks like:

$ sudo ls -l /var/spool/cups/tmp
total 3252
-rw------- 1 cups cups 1109633 Aug 29 22:16 gs_awcIvU
-rw------- 1 cups cups 1109633 Aug 29 22:01 gs_biZRW4
-rw------- 1 cups cups 1109633 Aug 29 22:18 gs_pW4gON

Last edited by marceloneil (2018-08-30 02:28:43)

marceloneil

Member

Registered: 2016-12-06

Posts: 4

Re: CUPS "Filter Failed" with "Error: /invalidfileaccess in --run--"

I was able to fix this by downgrading ghostscript from 9.23-3 to 9.23-2

tomeaton17

Member

Registered: 2018-09-01

Posts: 1

Re: CUPS "Filter Failed" with "Error: /invalidfileaccess in --run--"

Looks like it may be a result of this change

+From a054156d425b4dbdaaa9fda4b5f1182b27598c2b Mon Sep 17 00:00:00 2001
+From: Chris Liddell <chris.liddell@artifex.com>
+Date: Tue, 21 Aug 2018 20:17:51 +0100
+Subject: [PATCH] Bug 699658: Fix handling of pre-SAFER opened files.
+
+Temp files opened for writing before SAFER is engaged are not subject to the
+SAFER restrictions - that is handled by recording in a dictionary, and
+checking that as part of the permissions checks.
+
+By adding a custom error handler for invalidaccess, that allowed the filename
+to be added to the dictionary (despite the attempted open throwing the error)
+thus meaning subsequent accesses were erroneously permitted.
+---
+ Resource/Init/gs_init.ps | 17 ++++++++++++++++-
+ 1 file changed, 16 insertions(+), 1 deletion(-)
+
+diff --git a/Resource/Init/gs_init.ps b/Resource/Init/gs_init.ps
+index a6e49f0..5a5a428 100644
+--- a/Resource/Init/gs_init.ps
++++ b/Resource/Init/gs_init.ps
+@@ -2036,6 +2036,19 @@ readonly def
+             concatstrings concatstrings .generate_dir_list_templates
+         } if
+       ]
++      /PermitFileWriting [
++          currentuserparams /PermitFileWriting get aload pop
++          (TMPDIR) getenv not
++          {
++            (TEMP) getenv not
++            {
++              (TMP) getenv not
++              {
++                (/temp) (/tmp)
++              } if
++            } if
++          } if
++      ]
+       /LockFilePermissions //true
+     >> setuserparams
+   }
+@@ -2122,7 +2135,9 @@ readonly def
+ % the file can be deleted later, even if SAFER is set.
+ /.tempfile {
+   .tempfile	% filename file
+-  //SAFETY /tempfiles get 2 .argindex //true .forceput
++    //SAFETY /safe get not { % only add the filename if we're not yet safe
++    //SAFETY /tempfiles get 2 .argindex //true .forceput
++  } if
+ } .bind executeonly odef
+ 
+ % If we are running in SAFER mode, lock things down
+-- 
+2.9.1
+

torehund

Member

Registered: 2018-05-03

Posts: 12

Re: CUPS "Filter Failed" with "Error: /invalidfileaccess in --run--"

Ghostscript 9.24.1 has the same error.

./base/gsicc_manage.c:1244: gsicc_open_search(): Could not find default_rgb.icc
./base/gsicc_manage.c:2025: gsicc_set_device_profile(): cannot find device profile
GPL Ghostscript 9.24: Unrecoverable error, exit code 1
./base/gsicc_manage.c:1244: gsicc_open_search(): Could not find default_gray.icc
| ./base/gsicc_manage.c:2025: gsicc_set_device_profile(): cannot find device profile
PID 11973 (gs) stopped with status 1!

Downgrading ghostscript from 9.24-1 to 9.23-2 also helps in this case.

Tested with CUPS 2.2.8.

I double checked but the *icc files are on the system:
./ghostscript/9.24/iccprofiles/default_gray.icc
./ghostscript/9.24/iccprofiles/default_rgb.icc

Last edited by torehund (2018-09-05 07:48:12)

lm808

Member

Registered: 2018-08-31

Posts: 4

Re: CUPS "Filter Failed" with "Error: /invalidfileaccess in --run--"

Bug reported on Ghostscript but could someone submit a ghostscript command that demonstrates this problem? I am not familiar with ghostscript.

https://bugs.ghostscript.com/show_bug.cgi?id=699721

Last edited by lm808 (2018-09-05 15:13:09)

loqs

Member

Registered: 2014-03-06

Posts: 17,421

Re: CUPS "Filter Failed" with "Error: /invalidfileaccess in --run--"

Still an issue with ghostscript 9.24-2  ?

raavas

Member

Registered: 2011-10-21

Posts: 86

Re: CUPS "Filter Failed" with "Error: /invalidfileaccess in --run--"

I have the "filter failed" issue with the new version of ghostscript (9.24-2).

lm808

Member

Registered: 2018-08-31

Posts: 4

Re: CUPS "Filter Failed" with "Error: /invalidfileaccess in --run--"

The error has disappeared on my system after upgrading to ghostscrit 9.24-2.
Current cups version is 2.2.8-3 and cups-filters 1.21.2-1.
If you still have a problem and can produce the error in ghostscript, submit those to https://bugs.ghostscript.com/show_bug.cgi?id=699721

blufinney

Member

Registered: 2014-08-26

Posts: 59

Re: CUPS "Filter Failed" with "Error: /invalidfileaccess in --run--"

FWIW the error did not disappear on my system with 9.24-2 after running a full upgrade.

Until it's fixed or there is some type of workaround I'll be running the following after each full upgrade:

pacman -U /var/cache/pacman/pkg/ghostscript-9.23-2-x86_64.pkg.tar.xz

torehund

Member

Registered: 2018-05-03

Posts: 12

Re: CUPS "Filter Failed" with "Error: /invalidfileaccess in --run--"

cups 2.2.8-3
cups-filters-1.21.2-1
ghostscript-9.24-2

The Error is still prevalent on my system.

@bluefinny
pacman -Syu --ignore=ghostscript

This way you ignore ghostscript during your updates.

You can also add
IgnorePkg   = ghostscript
in your
/etc/pacman.conf

But I would recommend the first option since you tend to forget about ignored packets in your pacman.conf.

I also tried the command from CUPS that fails to reproduce the error:
gs -q -dNOPAUSE -dBATCH -dSAFER -dNOMEDIAATTRS -sDEVICE=ps2write -dShowAcroForm -sOUTPUTFILE=%stdout -dLanguageLevel=3 -r600 -dCompressFonts=false -dNoT3CCITT -dNOINTERPOLATE -c \'save pop\' -f /var/spool/cups/tmp/00df35b9a0c7d

Ich habe versucht ein beliebiges *.ps mit dem Befeh zu verarbeiten mit ghostscript und bekomme leider den Fehler bei beiden Versionnen nicht.
gs -q -dNOPAUSE -dBATCH -dSAFER -dNOMEDIAATTRS -sDEVICE=ps2write -dShowAcroForm -sOUTPUTFILE=test -dLanguageLevel=3 -r600 -dCompressFonts=false -dNoT3CCITT -dNOINTERPOLATE -c save -c pop -f test.ps

Derzeit noch keine Ahnung wie ich den Fehler nach stellen soll mittels ghostscript cmd line.

Last edited by torehund (2018-09-07 07:40:58)

forumache

Member

From: Netherlands

Registered: 2011-09-02

Posts: 55

Re: CUPS "Filter Failed" with "Error: /invalidfileaccess in --run--"

Another case where downgrading from 9.24-2 to 9.23-2 proved to be the "solution". After downgrading, I simply restarted the job and this time it printed.
The good news is that in the bug report linked in this thread, 9.25 seems to solve the problem.

By the way, my printer is a Kyocera, but it seems also Canon printers are affected.

luser

Member

Registered: 2016-08-27

Posts: 114

Re: CUPS "Filter Failed" with "Error: /invalidfileaccess in --run--"

On my system, everything was up to date, and ghostscript 9.24-2 caused the filter failed message and a failure to print. Reverting ghostscript to version 9.23-3 immediately solved the problem with my Canon printer with all 3 machines I am using it with. This morning, I tried ghostscript 9.24-5 in the Testing repo, and it seems to work all right.

Note that so far, I've only tested one machine. I expect I'll wait till it's moved out of Testing before installing it on the other machines.

Update: Well, that didn't take long. It's out of Testing and works just fine on all 3 machines. I'd say the problem is solved.

Last edited by luser (2018-09-07 18:50:54)

---

luser: an epithet applied by Windows users to linux users

Salkay

Member

Registered: 2014-05-22

Posts: 619

Re: CUPS "Filter Failed" with "Error: /invalidfileaccess in --run--"

FWIW I just installed ghostscript-git (9.25.r6011.g232c2bf9d-1) and printing is working again, so that is another option.