Dear Maintainer,

When running kernel 6.14 in trixie one can see the following errors in the journal for cupsd:

kernel: audit: type=1400 audit(1753166958.042:270): apparmor="DENIED" operation="create" class="net" info="failed protocol match" error=-13 profile="/usr/sbin/cupsd" pid=32844 comm="cupsd" family="unix" sock_type="stream" protocol=0 requested="create" denied="create" addr=none
kernel: audit: type=1400 audit(1753166958.042:271): apparmor="DENIED" operation="create" class="net" info="failed protocol match" error=-13 profile="/usr/sbin/cupsd" pid=32844 comm="cupsd" family="unix" sock_type="stream" protocol=0 requested="create" denied="create" addr=none
kernel: audit: type=1400 audit(1753166958.042:272): apparmor="DENIED" operation="create" class="net" info="failed protocol match" error=-13 profile="/usr/sbin/cupsd" pid=32844 comm="cupsd" family="unix" sock_type="stream" protocol=0 requested="create" denied="create" addr=none
kernel: audit: type=1400 audit(1753166958.042:273): apparmor="DENIED" operation="create" class="net" info="failed protocol match" error=-13 profile="/usr/sbin/cupsd" pid=32844 comm="cupsd" family="unix" sock_type="stream" protocol=0 requested="create" denied="create" addr=none
kernel: audit: type=1400 audit(1753166958.042:274): apparmor="DENIED" operation="open" class="file" profile="/usr/sbin/cupsd" name="/etc/paperspecs" pid=32844 comm="cupsd" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
kernel: audit: type=1400 audit(1753166958.044:275): apparmor="DENIED" operation="create" class="net" info="failed protocol match" error=-13 profile="/usr/sbin/cupsd" pid=32844 comm="cupsd" family="unix" sock_type="stream" protocol=0 requested="create" denied="create" addr=none
kernel: audit: type=1400 audit(1753166958.045:276): apparmor="DENIED" operation="create" class="net" info="failed protocol match" error=-13 profile="/usr/sbin/cupsd" pid=32844 comm="cupsd" family="unix" sock_type="dgram" protocol=0 requested="create" denied="create" addr=none
kernel: audit: type=1400 audit(1753166958.046:277): apparmor="DENIED" operation="create" class="net" info="failed protocol match" error=-13 profile="/usr/sbin/cupsd" pid=32845 comm="dbus" family="unix" sock_type="stream" protocol=0 requested="create" denied="create" addr=none
kernel: audit: type=1400 audit(1753166958.046:278): apparmor="DENIED" operation="create" class="net" info="failed protocol match" error=-13 profile="/usr/sbin/cupsd" pid=32845 comm="dbus" family="unix" sock_type="stream" protocol=0 requested="create" denied="create" addr=none
kernel: audit: type=1400 audit(1753166958.046:279): apparmor="DENIED" operation="create" class="net" info="failed protocol match" error=-13 profile="/usr/sbin/cupsd" pid=32845 comm="dbus" family="unix" sock_type="stream" protocol=0 requested="create" denied="create" addr=none

and for cups-browsed:

kernel: audit: type=1400 audit(1753775569.414:2708): apparmor="DENIED" operation="create" class="net" info="failed protocol match" error=-13 profile="/usr/sbin/cups-browsed" pid=58964 comm="cups-browsed" family="unix" sock_type="stream" protocol=0 requested="create" denied="create" addr=none

The two cups profiles /etc/apparmor.d/{usr.sbin.cups-browsed,usr.sbin.cupsd} are missing a:

abi <abi/3.0>,

stanza at the start of the file. After adding that line and restarting the
services there are no more such errors.

I should mention this happens with the 6.14.8 kernel build used in
Proxmox VE (based on Ubuntu's kernel).

Hi,

I can confirm this on trixie with cups-daemon 2.4.10-3+deb13u2, and on
such a kernel it is more than log noise: cupsd never finishes starting.

System: Proxmox VE 9.2 on Debian 13, kernel 7.0.14-16-pve, apparmor
4.1.1-pmx1. /etc/apparmor/parser.conf pins policy-features to
/usr/share/apparmor-features/features, whose network_v8 af_mask lists
unix, and the profile has no abi stanza, so it is compiled against that.

cups.service is Type=notify. cupsd is denied creating AF_UNIX stream and
dgram sockets (the same "failed protocol match" lines as in the original
report), so it cannot notify systemd, the start job times out after 90 s,
systemd restarts it, and this repeats indefinitely. On this host cups has
not started once since the first boot of a Proxmox 7.0 kernel; on the
Debian 6.12 kernel before that it started normally.

Tested on the same host, each time reloading the profile and starting
cups.service:

   1. Package profile unchanged: stays "activating", 7 denials in 20 s.
   2. "unix," in /etc/apparmor.d/local/usr.sbin.cupsd: still denied.
   3. "network unix," in the local file: still denied.
   4. "network," in the local file: still denied.
   5. "abi <abi/3.0>," at the top of the profile: active (running) within
      10 s, no AppArmor denials, "lpstat -r" reports the scheduler running.

So it cannot be worked around in the local include; the stanza has to be
in the shipped profile. The patch below, against debian/main, adds it
with a comment. It also applies unchanged to debian/trixie, and both
patched profiles compile with apparmor_parser 4.1.1. I have only tested
with AppArmor 4.1.1 userspace; it is independent of the AppArmor 5
notify-socket change in #1142057.

The trixie profile additionally denies /etc/paperspecs and
CAP_NET_ADMIN at every start; both are already fixed in sid (#1096002,
#1132961). Since cups on trixie does not start at all on kernels that
mediate AF_UNIX, a stable update carrying all three would be welcome.

Note the bug is filed against cups while the profile ships in
cups-daemon.

Thanks,
Michael Neuffer

 From b247cb0292e4072a558c46a394c933f15683b674 Mon Sep 17 00:00:00 2001
From: Michael Neuffer <neuffer@neuffer.com>
Date: Mon, 14 Sep 2026 10:26:40 +0200
Subject: [PATCH] AppArmor profile: declare abi 3.0 so cupsd can start on
  kernels mediating AF_UNIX (Closes: #1110135)
---
  debian/local/apparmor-profile | 6 ++++++
  1 file changed, 6 insertions(+)

diff --git a/debian/local/apparmor-profile b/debian/local/apparmor-profile
index 693b550..20cd8e7 100644
--- a/debian/local/apparmor-profile
+++ b/debian/local/apparmor-profile
@@ -2,6 +2,12 @@
  # Last Modified: Thu Aug  2 12:54:46 2007
  # Author: Martin Pitt <martin.pitt@ubuntu.com>

+# Without an abi stanza the parser compiles this policy against the pinned
+# feature set, which mediates AF_UNIX. On kernels that enforce that
(e.g. the
+# Ubuntu-derived Proxmox VE kernels) cupsd cannot create the socket it
needs
+# for sd_notify and the Type=notify unit never starts. Closes: #1110135
+abi <abi/3.0>,
+
  #include <tunables/global>

  /usr/sbin/cupsd flags=(attach_disconnected) {
-- 
2.53.0