From 9fb0f21becad96ac8046c7055ecfb6e2a1b14c05 Mon Sep 17 00:00:00 2001 From: Denis Chevalier Date: Thu, 6 Aug 2026 14:37:26 +0200 Subject: finish cups fix --- etc/cups/cupsd.conf | 208 ++++++++++++++++++++++++ etc/systemd/system/cups.service.d/override.conf | 3 +- 2 files changed, 210 insertions(+), 1 deletion(-) create mode 100644 etc/cups/cupsd.conf (limited to 'etc') diff --git a/etc/cups/cupsd.conf b/etc/cups/cupsd.conf new file mode 100644 index 0000000..6a08eb8 --- /dev/null +++ b/etc/cups/cupsd.conf @@ -0,0 +1,208 @@ +# +# Configuration file for the CUPS scheduler. See "man cupsd.conf" for a +# complete description of this file. +# + +# Log general information in error_log - change "warn" to "debug" +# for troubleshooting... +LogLevel warn +ErrorLog syslog +AccessLog syslog +PageLog syslog +#PageLogFormat + +# Specifies the maximum size of the log files before they are rotated. The value "0" disables log rotation. +MaxLogSize 0 + +# Default error policy for printers +ErrorPolicy stop-printer + +# Only listen for connections from the local machine. +Listen localhost:631 +Listen /run/cups/cups.sock + +# Show shared printers on the local network. +Browsing Yes +BrowseLocalProtocols dnssd + +# Default authentication type, when authentication is required... +DefaultAuthType Basic + +# Web interface setting... +WebInterface Yes + +# Timeout after cupsd exits if idle (applied only if cupsd runs on-demand - with -l) +IdleExitTimeout 60 + +# Restrict access to the server... + + Order allow,deny + + +# Restrict access to the admin pages... + + AuthType Default + Require user @SYSTEM + Order allow,deny + + +# Restrict access to configuration files... + + AuthType Default + Require user @SYSTEM + Order allow,deny + + +# Restrict access to log files... + + AuthType Default + Require user @SYSTEM + Order allow,deny + + +# Set the default printer/job policies... + + # Job/subscription privacy... + JobPrivateAccess default + JobPrivateValues default + SubscriptionPrivateAccess default + SubscriptionPrivateValues default + + # Job-related operations must be done by the owner or an administrator... + + Order deny,allow + + + + Require user @OWNER @SYSTEM + Order deny,allow + + + + AuthType Default + Require user @OWNER @SYSTEM + Order deny,allow + + + # All administration operations require an administrator to authenticate... + + AuthType Default + Require user @SYSTEM + Order deny,allow + + + # All printer operations require a printer operator to authenticate... + + AuthType Default + Require user @SYSTEM + Order deny,allow + + + # Only the owner or an administrator can cancel or authenticate a job... + + Require user @OWNER @SYSTEM + Order deny,allow + + + + AuthType Default + Require user @OWNER @SYSTEM + Order deny,allow + + + + Order deny,allow + + + +# Set the authenticated printer/job policies... + + # Job/subscription privacy... + JobPrivateAccess default + JobPrivateValues default + SubscriptionPrivateAccess default + SubscriptionPrivateValues default + + # Job-related operations must be done by the owner or an administrator... + + AuthType Default + Order deny,allow + + + + AuthType Default + Require user @OWNER @SYSTEM + Order deny,allow + + + # All administration operations require an administrator to authenticate... + + AuthType Default + Require user @SYSTEM + Order deny,allow + + + # All printer operations require a printer operator to authenticate... + + AuthType Default + Require user @SYSTEM + Order deny,allow + + + # Only the owner or an administrator can cancel or authenticate a job... + + AuthType Default + Require user @OWNER @SYSTEM + Order deny,allow + + + + Order deny,allow + + + +# Set the kerberized printer/job policies... + + # Job/subscription privacy... + JobPrivateAccess default + JobPrivateValues default + SubscriptionPrivateAccess default + SubscriptionPrivateValues default + + # Job-related operations must be done by the owner or an administrator... + + AuthType Negotiate + Order deny,allow + + + + AuthType Negotiate + Require user @OWNER @SYSTEM + Order deny,allow + + + # All administration operations require an administrator to authenticate... + + AuthType Default + Require user @SYSTEM + Order deny,allow + + + # All printer operations require a printer operator to authenticate... + + AuthType Default + Require user @SYSTEM + Order deny,allow + + + # Only the owner or an administrator can cancel or authenticate a job... + + AuthType Negotiate + Require user @OWNER @SYSTEM + Order deny,allow + + + + Order deny,allow + + diff --git a/etc/systemd/system/cups.service.d/override.conf b/etc/systemd/system/cups.service.d/override.conf index d12b406..d8bc314 100644 --- a/etc/systemd/system/cups.service.d/override.conf +++ b/etc/systemd/system/cups.service.d/override.conf @@ -2,7 +2,8 @@ NoNewPrivileges=yes ProtectSystem=strict ProtectHome=yes -ReadWritePaths=/var/spool/cups /var/cache/cups /var/run/cups /etc/cups +ReadWritePaths=/var/log/cups /var/spool/cups /var/cache/cups /var/run/cups /etc/cups +LogsDirectory=cups PrivateTmp=yes ProtectKernelTunables=yes ProtectKernelModules=yes -- cgit