Description:

The CUPS AppArmor profile prevents CUPS from resolving local users managed by systemd-homed.

This causes repeated authentication prompts in KDE System Settings → Printers, even when the user enters valid credentials.

Symptoms:

CUPS repeatedly logs:

  User "rein" does not exist.
  pam_authenticate() returned 7 (Authentication failure)

The account resolves correctly outside the CUPS AppArmor profile:

  $ getent passwd rein
  rein:x:1000:1000:Rein Ketelaars:/home/rein:/bin/bash

However, the same lookup fails inside the CUPS profile:

  $ sudo aa-exec -p /usr/sbin/cupsd -- getent passwd rein
  $ echo $?
  2

The kernel audit log shows the cause:

  apparmor="DENIED" operation="open"
  profile="/usr/sbin/cupsd"
  name="/etc/machine-id"
  requested_mask="r"
  denied_mask="r"

Proposed fix:

Add read access to /etc/machine-id in /etc/apparmor.d/usr.sbin.cupsd:

  /etc/machine-id r,

Verification:

Adding the following rule to /etc/apparmor.d/local/usr.sbin.cupsd:

  /etc/machine-id r,

... resolves the issue.


Thank you!
Rein Ketelaars

Dear Maintainer,

I've prepared a proposed patch for this issue.

The patch adds read-only access to /etc/machine-id in the CUPS AppArmor
profile.

I've verified that adding this rule resolves the NSS user lookup failure under
the CUPS profile.

Patch attached.

Hope this helps.

Best regards,
Rein