4 ms·
And, for some utterly and completely absurd reason, CUPS runs as a system daemon instead of a highly sandboxed user program.
by amluto 2y ago
And, for some utterly and completely absurd reason, CUPS runs as a system daemon instead of a highly sandboxed user program.
- bshipp 2y agoThis is the worry. It seems like a really unnecessary privilege escalation.
- jeffbee 2y agoIt's because of the frankly idiotic idea of persistent print queues. If you want to have this artifact that survives a user session, then the print subsystem needs super-user abilities. ChromeOS does away with the whole idea. There are no persistent printer queues or jobs. Artifacts of the printing subsystem have lifetime tied to the user session.
- funcDropShadow 2y agoNo, persistent print queues can be implemented without cups running as super-user.
- gordonfish 2y agoI'm a little confused why this is even an issue. Persistent queues have been an option since the days of Windows 9x. Maybe it's a Gnome problem. KDE let's me see what I had previously printed if I want to see it, or reprint something. I also know many people in pre-press who make good use of that.
- amluto 2y agoWindows 9x printing was every bit as bad as CUPS.
- gordonfish 2y agoThe point was about the retention of print jobs in queue, that it was a concept and option since the mid 90s.
- throwanem 2y agoIt's a spooler for a printing system that supports concurrent job submission, potentially among multiple users. It's going to have to achieve serialization some kind of way.
- aftbit 2y agoWhy does it need to run as `root` user and not `cups`?
- stevekemp 2y agoBinding to ports under 1024 traditionally requires root privileges. (These days of course that isn't quite as true as it used to be.)
- amluto 2y agoWhy on Earth do ordinary systems need CUPS binding to a port at all?
- a96 2y agoThey don't need. Want, for listening to network printers announcing themselves. It's a very bad system, even then.
- amluto 2y agoHave you ever seen a network printer announce itself by talking to a print daemon on port 631? I’ve seen network printers announce themselves over DNS-SD/mDNS and over NetBIOS, AppleTalk, etc. All of those are a layer beneath the print daemon.
- yrro 2y agoThey don't. cups-browsed is a legacy component that isn't needed on ordinary systems, which outsource printer discovery to an mDNS service such as avahi.
- edelbitter 2y agoOn Ubuntu, both. A system daemon with interesting interactions with avahi-daemon and colord, and a somewhat sandboxed user program, just so Chrome is not overly inconvenienced by its snap sandboxing. But wait, there is more: The login & lock screen also runs the whole glory of GNOME.. to query printer settings. So you can have those sweet, sweet "new printer" notifications overlaid while inputting your password. Or whatever else "your" printer needs to add there.
- jmclnx 2y agoFWIW, on OpenBSD, cups-browsed is not on my system, but there are some cups files. But cups-browsed is installed when you install packages "net/avahi" and "print/libppd" which I do not know what either of them are. So I guess on Linux avahi needs cups-browsed.