Unable to open print file: Permission denied

[rdtennent]

On a Linux Mint system, I can't print as an ordinary user to either a network printer or to a shared USB printer connected to another host on the local network. What's baffling is that I can print to both printers as the superuser. Here's what I get after a failed attempt to print by doing ls -l /var/spool/cups/*:

-r-------- 1 root root 331 Oct 14 18:51 a00711 -rw------- 1 root lp 1539 Oct 14 19:02 c00711 -rw-r----- 1 root lp 50966 Oct 14 18:51 d00711-001

and exactly the same after a successful print as root.

What is going on?

% apt version cups 2.4.1op1-1ubuntu4.7

% cat os-release NAME="Linux Mint" VERSION="21.2 (Victoria)" ID=linuxmint ID_LIKE="ubuntu debian" PRETTY_NAME="Linux Mint 21.2" VERSION_ID="21.2"

% ls -ld /var/spool/cups drwx--x--- 3 root lp 4096 Oct 15 00:00 /var/spool/cups

ps -eadf | grep cups root 254733 1 0 00:00 ? 00:00:00 /usr/sbin/cupsd -l lp 254735 254733 0 00:00 ? 00:00:00 /usr/lib/cups/notifier/dbus dbus:// root 254736 1 0 00:00 ? 00:00:00 /usr/sbin/cups-browsed lp 254825 254733 0 00:00 ? 00:00:00 /usr/lib/cups/notifier/dbus dbus://

$ groups rdt adm lp ...

[rdtennent]

Trying to attach a cut-down and gzipped error_log for a failed print of a text file (temp):

cups_error_log.gz

[zdohnal]

Hi,

I cannot reproduce this with cups-browsed 2.0.0+cups-2.4.7 - I would check the permissions on /usr/lib/cups/backend/ipp and /usr/lib/cups/backend/implicitclass:

$ ll /usr/lib/cups/backend/{ipp,implicitclass}
-rwxr--r--. 1 root root 24080 Oct  4 02:00 /usr/lib/cups/backend/implicitclass
-rwxr--r--. 1 root root 85808 Sep 20 02:00 /usr/lib/cups/backend/ipp

either way, it looks like platform issue.

[rdtennent]

Permissions on /usr/lib/cups/backend/ipp would seem to have been the problem. Thanks for the suggestions.

I'm surprised I couldn't find the problem even at the debug level of the log.

[zdohnal]

If a process cannot open a file, it usually means one of two things - the file does not exist or the process doesn't have the correct permissions (and on SELinux enabled systems it might not have a correct context) to access/open/read/execute the file - so that's usually what I check if I get an error like this. I could check the permissions on every binary shipped with CUPS, but it would caused bogus warnings in environments where packagers want different permissions than we can say as default - I'm sorry.