#1139268 [cups-daemon] AppArmor profile blocks cupsd from reading /etc/paperspecs

Package:
cups-daemon
Source:
cups-daemon
Description:
Common UNIX Printing System(tm) - daemon
Submitter:
Date:
2026-06-07 23:03:02 UTC
Severity:
normal
#1139268#5
Date:
2026-06-07 23:00:51 UTC
From:
To:
The AppArmor profile for cupsd (/usr/sbin/cupsd) is denying read access
to
/etc/paperspecs, resulting in the following audit log message:

audit: type=1400 audit(423:127): apparmor="DENIED"
operation="open" class="file" profile="/usr/sbin/cupsd"
name="/etc/paperspecs" pid=289134 comm="cupsd"
requested_mask="r" denied_mask="r" fsuid=0 ouuid=0

The cupsd process needs read access to /etc/paperspecs, but the current
AppArmor profile does not include this permission. This appears similar
to previous bugs #1100755 and #1110135 regarding missing AppArmor
stanzas
for cups.

Please add the appropriate rule to /etc/apparmor.d/usr.sbin.cupsd to
allow:
/usr/paperspecs r,

or the correct path for /etc/paperspecs:
/etc/paperspecs r,

System information:
- Debian release: forky
- Kernel version: 6.12.90

Thank you for your attention to this issue.