#1110135 cups: apparmor profile is missing <abi/3.0> stanza

Package:
cups
Source:
cups
Description:
Common UNIX Printing System(tm) - PPD/driver support, web interface
Submitter:
Maximiliano
Date:
2025-07-30 14:37:01 UTC
Severity:
normal
#1110135#5
Date:
2025-07-30 14:21:25 UTC
From:
To:
Dear Maintainer,

When running kernel 6.14 in trixie one can see the following errors in the journal for cupsd:

kernel: audit: type=1400 audit(1753166958.042:270): apparmor="DENIED" operation="create" class="net" info="failed protocol match" error=-13 profile="/usr/sbin/cupsd" pid=32844 comm="cupsd" family="unix" sock_type="stream" protocol=0 requested="create" denied="create" addr=none
kernel: audit: type=1400 audit(1753166958.042:271): apparmor="DENIED" operation="create" class="net" info="failed protocol match" error=-13 profile="/usr/sbin/cupsd" pid=32844 comm="cupsd" family="unix" sock_type="stream" protocol=0 requested="create" denied="create" addr=none
kernel: audit: type=1400 audit(1753166958.042:272): apparmor="DENIED" operation="create" class="net" info="failed protocol match" error=-13 profile="/usr/sbin/cupsd" pid=32844 comm="cupsd" family="unix" sock_type="stream" protocol=0 requested="create" denied="create" addr=none
kernel: audit: type=1400 audit(1753166958.042:273): apparmor="DENIED" operation="create" class="net" info="failed protocol match" error=-13 profile="/usr/sbin/cupsd" pid=32844 comm="cupsd" family="unix" sock_type="stream" protocol=0 requested="create" denied="create" addr=none
kernel: audit: type=1400 audit(1753166958.042:274): apparmor="DENIED" operation="open" class="file" profile="/usr/sbin/cupsd" name="/etc/paperspecs" pid=32844 comm="cupsd" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
kernel: audit: type=1400 audit(1753166958.044:275): apparmor="DENIED" operation="create" class="net" info="failed protocol match" error=-13 profile="/usr/sbin/cupsd" pid=32844 comm="cupsd" family="unix" sock_type="stream" protocol=0 requested="create" denied="create" addr=none
kernel: audit: type=1400 audit(1753166958.045:276): apparmor="DENIED" operation="create" class="net" info="failed protocol match" error=-13 profile="/usr/sbin/cupsd" pid=32844 comm="cupsd" family="unix" sock_type="dgram" protocol=0 requested="create" denied="create" addr=none
kernel: audit: type=1400 audit(1753166958.046:277): apparmor="DENIED" operation="create" class="net" info="failed protocol match" error=-13 profile="/usr/sbin/cupsd" pid=32845 comm="dbus" family="unix" sock_type="stream" protocol=0 requested="create" denied="create" addr=none
kernel: audit: type=1400 audit(1753166958.046:278): apparmor="DENIED" operation="create" class="net" info="failed protocol match" error=-13 profile="/usr/sbin/cupsd" pid=32845 comm="dbus" family="unix" sock_type="stream" protocol=0 requested="create" denied="create" addr=none
kernel: audit: type=1400 audit(1753166958.046:279): apparmor="DENIED" operation="create" class="net" info="failed protocol match" error=-13 profile="/usr/sbin/cupsd" pid=32845 comm="dbus" family="unix" sock_type="stream" protocol=0 requested="create" denied="create" addr=none

and for cups-browsed:

kernel: audit: type=1400 audit(1753775569.414:2708): apparmor="DENIED" operation="create" class="net" info="failed protocol match" error=-13 profile="/usr/sbin/cups-browsed" pid=58964 comm="cups-browsed" family="unix" sock_type="stream" protocol=0 requested="create" denied="create" addr=none

The two cups profiles /etc/apparmor.d/{usr.sbin.cups-browsed,usr.sbin.cupsd} are missing a:

abi <abi/3.0>,

stanza at the start of the file. After adding that line and restarting the
services there are no more such errors.
#1110135#10
Date:
2025-07-30 14:25:22 UTC
From:
To:
I should mention this happens with the 6.14.8 kernel build used in
Proxmox VE (based on Ubuntu's kernel).