https://bugzilla.novell.com/show_bug.cgi?id=857372 https://bugzilla.novell.com/show_bug.cgi?id=857372#c1 Horst Venzke changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |info@remsnet.de --- Comment #1 from Horst Venzke 2014-01-03 18:39:36 UTC --- I can Comfirm this as well for OSS13.1 i586 and OSS 13.1 ARM. Steps to Reproduce: 1. install default oss13.1 and up 2. install cups 3. netstat -an | grep -i 631 CUPS shuold on default ONLY listen on what been configured at /etc/cups/cupsd.conf This Confuse end users . FIX : - Change startup scripts for cups . - remove cups.socket ( delete ). - update /etc/cups/cupsd.conf, move socket stuff in the CUPSD config. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=857372 https://bugzilla.novell.com/show_bug.cgi?id=857372#c zhang jiajun changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jzhang@suse.com AssignedTo|bnc-team-screening@forge.pr |systemd-maintainers@suse.de |ovo.novell.com | -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=857372 https://bugzilla.novell.com/show_bug.cgi?id=857372#c4 --- Comment #4 from Daniel Pecka 2014-01-07 10:57:29 UTC --- @systemd maintainers: please don't be touched that you've been added to CC .. JFMI who created this cups.socket configuration ? is it upstream default cfg ? if so i think, that this default should be changed and if it is upstream configuration systemd maintainers should change it .. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=857372 https://bugzilla.novell.com/show_bug.cgi?id=857372#c6 --- Comment #6 from Horst Venzke 2014-01-07 11:40:59 UTC --- Werner, as i reviewed this not only happen for cups. This type of changeing adding security issues opening Permanent udp sovkes that the end-user or system admin havent ever configuired bevor. Thus , i wuold call this way of change that SuSE staff / maintainers do with systemd opend sockets an CVE revelant system wide issue . -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=857372 https://bugzilla.novell.com/show_bug.cgi?id=857372#c Marcus Meissner changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |security-team@suse.de Summary|systemd makes cups.socket |VUL-0: cups: cups.socket is |listening on 0.0.0.0 |listening on 0.0.0.0 -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=857372 https://bugzilla.novell.com/show_bug.cgi?id=857372#c10 --- Comment #10 from Marcus Meissner 2014-01-07 13:18:43 UTC --- see also bug 769346, CVE-2012-6094 -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=857372 https://bugzilla.novell.com/show_bug.cgi?id=857372#c12 Frederic Crozat changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEEDINFO |NEW CC| |fcrozat@suse.com InfoProvider|fcrozat@suse.com | --- Comment #12 from Frederic Crozat 2014-01-07 14:02:28 UTC --- cups.socket was grabbed from Fedora but it looks like they changed it to only listen to the unix socket since the initial import :( We should probably do the same (see http://pkgs.fedoraproject.org/cgit/cups.git ) -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=857372 https://bugzilla.novell.com/show_bug.cgi?id=857372#c15 Johannes Meixner changed: What |Removed |Added ---------------------------------------------------------------------------- Platform|Other |All Found By|--- |Community User OS/Version|Other |openSUSE 13.1 --- Comment #15 from Johannes Meixner 2014-01-07 15:47:53 CET --- I have no knowledge how the systemd functionality works and/or how it is implemented in CUPS nor do I know how the systemd functionality for CUPS is meant to work (i.e. the policy behind how it should work). The whole systemd functionality for the openSUSE cups package was contributed by Cristian Rodríguez, see the cups RPM changelog entries. I would appreciate it if those who know about systemd could work together with CUPS upstream to get official support for systemd in upstream CUPS, see also https://bugzilla.novell.com/show_bug.cgi?id=734703#c11 Regarding the systemd policy for CUPS I would appreciate it if those who know about systemd could work together with other Linux distributions to get a common systemd policy for CUPS so that CUPS would behave the same by default for all users. For systemd support there are the CUPS upstream feature requests STR#3917 and STR#3955 http://www.cups.org/str.php?L3917 http://www.cups.org/str.php?L3955 This feature was sitting in "license limbo" at Apple for a long time because the copyright agreement with Apple was missing for STR#3917. But it seems this has changed recently according to http://www.cups.org/str.php?L3917 which reads in particular: ------------------------------------------------------------------------- 3 Days Ago by Michael Sweet : Didier, I think we have a good patch from Tim we can incorporate. I'm taking care of some other infrastructure changes in cupsd now, and once that is done I will work on integrating this. ------------------------------------------------------------------------ This means official support for systemd in upstream CUPS could be expected for a future CUPS 1.7.x version or later (e.g. CUPS 1.8). -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=857372 https://bugzilla.novell.com/show_bug.cgi?id=857372#c17 --- Comment #17 from Daniel Pecka 2014-01-07 23:52:55 UTC --- Johannes Meixner: Hello, let me drop one point: in real, /usr/lib/systemd/system/cups.socket has actually nothing to do with cups itself . it's just support piece of cups to systemd and that's good .. fact, that this file is deployed by cups package is also okay, thanks to cups maintainers/devels that they did it at all .. i started with this bug just because i think, that this file should change its settings not cups .. there's actually no need to touch real cups at all, only what we need to fix is needless listening of cups.socket (alias systemd) on certain ports .. the fix is easy and i did it via this: # cat /usr/lib/systemd/system/cups.socket [Unit] Description=CUPS Printing Service Sockets [Socket] ListenStream=/var/run/cups/cups.sock ListenStream=127.0.0.1:631 ListenStream=[::1]:631 ListenDatagram=127.0.0.1:631 ListenDatagram=[::1]:631 BindIPv6Only=ipv6-only [Install] WantedBy=sockets.target ^^ nothing more, this fixes in my opinion this issue and no need for changing other cups parts .. this change is reasonable and won't hurt literally anything Horst Venzke: i really have no clue what you're talking about .. please point us to corresponding bugreports .. i'm sure that this won't be new for you but i need to mention, that "certain services need certain ports open and listening on them to work" :D regards, daniel -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=857372 https://bugzilla.novell.com/show_bug.cgi?id=857372#c19 --- Comment #19 from Johannes Meixner 2014-01-08 11:18:08 CET --- If anyone who has sufficient knowledge about systemd files an OBS submitrequest for the cups package with appropriate changes according to the openSUSE policies under what circumstances the cupsd should be enabled/disabled/started/stopped in what particular way (actual activation versus on demand activation or whatever), I would just accept it. That "/usr/lib/systemd/system/cups.socket has actually nothing to do with cups itself" is exactly my point of view. Explanation and reasoning - from my pont of view: I would appreciate it if the decision under what circumstances what service should be enabled/disabled/started/stopped in what way (e.g. actual activation or on demand activation) could be kept strictly separated from the package that provides the actual software for that service. In particular for CUPS: I would appreciate it if the cups package would not need to contain anything regarding enabling/disabling/starting/stopping the cupsd and anything regarding in what particular way the cupsd is enabled/disabled/started/stopped (cups.service versus cups.socket versus cups.path). Reason: It is a different task to maintain the actual software for a service versus to maintain under what circumstances a service should be enabled/disabled/started/stopped in what particular way (e.g. on a home-user system versus on an enterprise system or depending on whatever kind of product openSUSE/SLES/SLED or depending on whatever else...). In the end what I would like to have is that the package that provides the actual software for a service only needs to provide the plain software (e.g. /usr/sbin/cupsd) but all what belongs to using that plain software as a service should be maintained strictly separated from the plain software. The reason behind from my point of view is: I can maintain the plain CUPS software but I cannot maintain the policy under what circumstances the cupsd should be enabled/disabled/started/stopped. Therefore I cannot maintain the content of systemd unit files for CUPS and therefore I would prefer when those files are not in the cups package. In particular - as far as I see - it seems practically impossible to maintain such a policy in a hardcoded way at package build-time via the RPM spec file (various 'suse_version' conditions that need to be continuously updated are no practically possible way). Another example regarding CUPS: In cups.service there is "WantedBy=printer.target". According to the man page "systemd.special" section printer.target the printer.target is started automatically as soon as a printer is plugged in or becomes available at boot. The "WantedBy=printer.target" will cause cupsd (or the cupsd on demand activation) to be started when a printer is plugged in or available at boot.

From my point of view this proves that the content in cups.service belongs mostly to "policy".

For me it is a policy to define whether or not the cupsd will be started when a printer device is plugged in or available at boot. In this particular case, when plug in an USB printer starts the cupsd it means any user who can plug in a USB device that claims to be an USB printer can start a daemon process that runs as root. I assume many home-users may like that automatism but perhaps in business environments such automatisms could be scaring? I cannot make such decisions and therefore I cannot maintain the content of systemd unit configuration files for CUPS and accordingly I like to split those files out of the cups package. I am thinking about a new separated source package "cups-systemd" or "systemd-cups" to even more indicate that its content belongs to systemd and not to the actual CUPS software. Basically cups-systemd/systemd-cups should contain as much as possible regarding systemd for CUPS. I think cups-systemd/systemd-cups must have a RPM requirement for cups but cups must not have a RPM requirement for cups-systemd/systemd-cups because the plain CUPS software can run without systemd (without systemd it is up to the admin how to launch cupsd). For cups a RPM recommends for cups-systemd/systemd-cups could be correct or even better only a "Supplements: cups" in cups-systemd/systemd-cups should be sufficient. A more general example why the systemd support pieces should be strictly separated form the actual software: Assume there is an openSUSE contributor who makes a package for his software with an executable /usr/bin/something_useful. Now the openSUSE community decides that /usr/bin/something_useful is great software that should be run as a service. Why does the openSUSE contributor who just made that package now need to worry about systemd and services and openSUSE policies and do all that work to get all what is needed by openSUSE to run his /usr/bin/something_useful as a service into his package? Why cannot openSUSE make a strictly separated package "something_useful-systemd" or "systemd-something_useful" that provides the systemd support pieces for "something_useful"? Even if the one who made the "something_useful" package wants to care about systemd and services and openSUSE policies and do all that work, I think it would be nice when he keeps the systemd support pieces separated form the actual software in a separated package. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=857372 https://bugzilla.novell.com/show_bug.cgi?id=857372#c21 --- Comment #21 from Daniel Pecka 2014-01-08 10:47:54 UTC --- and please guys, don't forget, that scope of this bugreport is to fix needless listening of cups.socket .. i'd not dive here too deep to discussions like we do right now .. let's open another bugreport, let's start another discussion elsewhere :) for resolving reported behaviour right now is just pretty enough to change cups.socket service as I described above -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=857372 https://bugzilla.novell.com/show_bug.cgi?id=857372#c23 Daniel Pecka changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEEDINFO |NEW InfoProvider|nettezzaumanaa@gmail.com | --- Comment #23 from Daniel Pecka 2014-01-08 12:42:04 UTC --- Created an attachment (id=573696) --> (http://bugzilla.novell.com/attachment.cgi?id=573696) my actual cups.socket hello johannes, here it is .. it is file from my system which in my opinion fixes this needless listening .. i've already provided other validation outputs like `lsof -i | egrep ipp\|cups\|^systemd' and `netstat -tulnp | grep 631' .. i have this configuration up and loaded and it seems like working flawlessly as expected .. regards, daniel -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=857372 https://bugzilla.novell.com/show_bug.cgi?id=857372#c25 --- Comment #25 from Daniel Pecka 2014-01-08 13:07:25 UTC --- oh god .. i'm very unsastisfated how ****** systemd is .. i also suggest (and it's worth to another bugreport) to move /usr/lib/systemd to etc/ to enable rpmsave backup while providing package is patched .. well, it's offtopic in this bugreport but i hope that some responsible adult will review systemd state in suse and will make some adult decisions, i'm really not sure that systemd implementation (or re-used upstream defaults) is sane (at least in suse) @Johannes - i feel your pain and i need to express admirations that you (or anybody doing with you on cups with you) created native systemd setup for cups, JFYI: https://bugzilla.novell.com/show_bug.cgi?id=857542 -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=857372 https://bugzilla.novell.com/show_bug.cgi?id=857372#c27 Johannes Meixner changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |ASSIGNED --- Comment #27 from Johannes Meixner 2014-01-08 15:24:43 CET --- Regarding my comment#22: I confused myself because I mixed up /usr/lib/systemd/system/cups.service that contains "WantedBy=printer.target" with /usr/lib/systemd/system/cups.socket that does not contain it. Daniel Pecka, very many thanks for your /usr/lib/systemd/system/cups.socket. According to comment#18 I will use it in our cups package. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=857372 https://bugzilla.novell.com/show_bug.cgi?id=857372#c29 --- Comment #29 from Johannes Meixner 2014-01-08 16:34:45 CET --- Bruno Friedmann, I am not at all a systemd expert but I think for running CUPS on a real print server you should not rely on systemd's socket activation but instead launch the real cupsd during booting, see bnc#802132. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=857372 https://bugzilla.novell.com/show_bug.cgi?id=857372#c31 Johannes Meixner changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |RESOLVED Resolution| |FIXED --- Comment #31 from Johannes Meixner 2014-01-08 16:57:37 CET --- Submitted fixed cups package to its OBS devel project "Printing" together with a fix for bnc#856731 via submitrequest 213204 and forwarded this to openSUSE:Factory as submitrequest 213206. FYI: The matching RPM changelog entry is: -------------------------------------------------------------------------- - cups-0002-systemd-listen-only-on-localhost-for-socket-activation.patch fixes the systemd cups.socket file so that systemd listens only on localhost (bnc#857372). -------------------------------------------------------------------------- -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=857372 https://bugzilla.novell.com/show_bug.cgi?id=857372#c33 Marcus Meissner changed: What |Removed |Added ---------------------------------------------------------------------------- Status|RESOLVED |REOPENED Resolution|FIXED | --- Comment #33 from Marcus Meissner 2014-01-08 16:02:26 UTC --- please fix opensuse 12.2 , 12.3 and 13.1 too. patch should apply as-is -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=857372 https://bugzilla.novell.com/show_bug.cgi?id=857372#c35 Johannes Meixner changed: What |Removed |Added ---------------------------------------------------------------------------- Component|Printing |Security AssignedTo|jsmeix@suse.com |security-team@suse.de QAContact|jsmeix@suse.com |qa-bugs@suse.de --- Comment #35 from Johannes Meixner 2014-01-14 14:09:35 CET --- Submitted as maintenancerequest 213874: ------------------------------------------------------------------------------ jsmeix@host:/obs/home:jsmeix:branches:OBS_Maintained:cups $ osc \ maintenancerequest -m 'CUPS security update to fix bnc#857372 \ (VUL-0: cups: cups.socket is listening on 0.0.0.0) for openSUSE_12.2 \ openSUSE_12.3 openSUSE_13.1' Using target project 'openSUSE:Maintenance' 213874 ------------------------------------------------------------------------------ Marcus Meissner, because 'VUL-0' indicates it is a security issue, I re-assign it to the Bugzilla component "Security" default assignee for further processing. Is this correct or should I just close it as "fixed"? -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=857372 https://bugzilla.novell.com/show_bug.cgi?id=857372#c Swamp Workflow Management changed: What |Removed |Added ---------------------------------------------------------------------------- Status Whiteboard| |obs:running:2484:moderate -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=857372 https://bugzilla.novell.com/show_bug.cgi?id=857372#c40 --- Comment #40 from Swamp Workflow Management 2014-01-22 16:04:36 UTC --- openSUSE-SU-2014:0119-1: An update that contains security fixes can now be installed. Category: security (moderate) Bug References: 857372 CVE References: Sources used: openSUSE 13.1 (src): cups-1.5.4-12.4.1 openSUSE 12.3 (src): cups-1.5.4-5.5.1 openSUSE 12.2 (src): cups-1.5.3-2.8.1 -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=857372 https://bugzilla.novell.com/show_bug.cgi?id=857372#c42 --- Comment #42 from Horst Venzke 2014-01-24 07:58:34 UTC --- @dear bernhard Change the socket config from Default ( localhost only ) : [Socket] ListenStream=/var/run/cups/cups.sock ListenStream=127.0.0.1:631 ListenStream=[::1]:631 ListenDatagram=127.0.0.1:631 +ListenDatagram=[::1]:631 BindIPv6Only=ipv6-only to i.e ( network assumed here : 10.10.10.0/255.255.255.0 aka /24 ) or let it only listing on the host [Socket] ListenStream=/var/run/cups/cups.sock ListenStream=127.0.0.1:631 +ListenStream=10.10.10.0/24:631 ListenStream=[::1]:631 +ListenDatagram=127.0.0.1:631 ListenDatagram=10.10.10.0/24:631 ListenDatagram=[::1]:631 BindIPv6Only=ipv6-only or let it only listing on the host - if you don´t require the cups network broadcasts: [Socket] ListenStream=/var/run/cups/cups.sock ListenStream=127.0.0.1:631 +ListenStream=10.10.10.10:631 ListenStream=[::1]:631 +ListenDatagram=127.0.0.1:631 ListenDatagram=10.10.10.10:631 ListenDatagram=[::1]:631 BindIPv6Only=ipv6-only In the long term i may assume the yast-cups module shuold be updated to handel that config stuff to manage content of cups.conf and cups socket . -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=857372 https://bugzilla.novell.com/show_bug.cgi?id=857372#c44 --- Comment #44 from Bruno Friedmann 2014-01-24 12:12:17 UTC --- I've tried the proposed patch to get a network daemon running again as it was before but fail systemd[1]: [/etc/systemd/system/cups.socket:8] Failed to parse address value, ignoring: 10.26.8.0/25:631 systemd[1]: [/etc/systemd/system/cups.socket:9] Failed to parse address value, ignoring: [2001:1620:f7c::1]/64:631 systemd[1]: [/etc/systemd/system/cups.socket:11] Failed to parse address value, ignoring: 10.26.8.0/25:631 ystemd[1]: [/etc/systemd/system/cups.socket:13] Failed to parse address value, ignoring: [2001:1620:f7c::1]/64:631 so /netmask isn't supported if I change cat /etc/systemd/system/cups.socket [Unit] Description=CUPS Printing Service Sockets [Socket] ListenStream=/var/run/cups/cups.sock ListenStream=127.0.0.1:631 ListenStream=[::1]:631 ListenStream=10.26.8.1:631 ListenStream=[2001:1620:f7c::1]:631 ListenDatagram=127.0.0.1:631 ListenDatagram=10.26.8.1:631 ListenDatagram=[::1]:631 ListenDatagram=[2001:1620:f7c::1]:631 BindIPv6Only=ipv6-only [Install] WantedBy=sockets.target then the system start and seems to be listening. netstat -anp | grep 631 tcp 0 0 10.26.8.1:631 0.0.0.0:* LISTEN 1/systemd tcp 0 0 127.0.0.1:631 0.0.0.0:* LISTEN 1/systemd tcp 0 0 2001:1620:f7c::1:631 :::* LISTEN 1/systemd tcp 0 0 ::1:631 :::* LISTEN 1/systemd udp 0 0 10.26.8.1:631 0.0.0.0:* 1/systemd udp 0 0 127.0.0.1:631 0.0.0.0:* 1/systemd udp 0 0 2001:1620:f7c::1:631 :::* 1/systemd udp 0 0 ::1:631 :::* 1/systemd lpstat -a on this cups server show the printer as expected lpstat -a BRFAX accepting requests since ven 22 fév 2013 18:11:16 CET coruscant accepting requests since jeu 23 jan 2014 18:41:53 CET coruscant_photo accepting requests since sam 18 jan 2014 17:13:29 CE on client side socket is activated for 0.0.0.0 and [::] but an lpstat -a never show up the printer on the server even if a connection seems to take place. netstat -anp | grep ":631" tcp 0 0 0.0.0.0:631 0.0.0.0:* LISTEN 1/init tcp 0 0 :::631 :::* LISTEN 1/init udp 0 0 0.0.0.0:631 0.0.0.0:* 1/init udp 0 0 :::631 :::* 1/init c-3po:~ # lpstat -a murtensee accepting requests since Mon Aug 5 11:21:54 2013 c-3po:~ # netstat -anp | grep ":631" tcp 0 0 0.0.0.0:631 0.0.0.0:* LISTEN 1/init tcp 0 0 10.26.8.100:36834 10.26.8.1:631 ESTABLISHED 26173/cups-polld tcp 0 0 :::631 :::* LISTEN 1/init udp 3840 0 0.0.0.0:631 0.0.0.0:* 1/init udp 0 0 :::631 :::* 1/init :-( -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=857372 https://bugzilla.novell.com/show_bug.cgi?id=857372#c46 --- Comment #46 from Daniel Pecka 2014-01-24 13:03:23 UTC --- hmm .. well, i just tested your setup and cups.socket works very bad .. i'd vote for kicking it out .. if you have disabled cups.socket and you just change cups.conf to listen wherever you need (eg Listen variable) and start the service without socket it works expectably # netstat -tulnp | grep -v 915 Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 0.0.0.0:631 0.0.0.0:* LISTEN 17186/cupsd udp 0 0 0.0.0.0:631 0.0.0.0:* 17186/cupsd # systemctl status cups* cups.service - CUPS Printing Service Loaded: loaded (/usr/lib/systemd/system/cups.service; enabled) Active: active (running) since Fri 2014-01-24 14:00:02 CET; 2min 53s ago Main PID: 17186 (cupsd) CGroup: /system.slice/cups.service └─17186 /usr/sbin/cupsd -f Jan 24 14:00:02 caligula.adicz systemd[1]: Started CUPS Printing Service. Jan 24 14:00:02 caligula.adicz cupsd[17186]: No limit for Validate-Job defined in policy allowallforanybody and no suitable template found. Jan 24 14:00:02 caligula.adicz cupsd[17186]: No limit for Cancel-Jobs defined in policy allowallforanybody and no suitable template found. Jan 24 14:00:02 caligula.adicz cupsd[17186]: No limit for Cancel-My-Jobs defined in policy allowallforanybody and no suitable template found. Jan 24 14:00:02 caligula.adicz cupsd[17186]: No limit for Close-Job defined in policy allowallforanybody and no suitable template found. Jan 24 14:00:02 caligula.adicz cupsd[17186]: No limit for CUPS-Get-Document defined in policy allowallforanybody and no suitable template found. Jan 24 14:00:02 caligula.adicz cupsd[17186]: No JobPrivateAccess defined in policy allowallforanybody - using defaults. Jan 24 14:00:02 caligula.adicz cupsd[17186]: No JobPrivateValues defined in policy allowallforanybody - using defaults. Jan 24 14:00:02 caligula.adicz cupsd[17186]: No SubscriptionPrivateAccess defined in policy allowallforanybody - using defaults. Jan 24 14:00:02 caligula.adicz cupsd[17186]: No SubscriptionPrivateValues defined in policy allowallforanybody - using defaults. cups.socket - CUPS Printing Service Sockets Loaded: loaded (/usr/lib/systemd/system/cups.socket; enabled) Active: inactive (dead) since Fri 2014-01-24 13:59:41 CET; 3min 14s ago Listen: /var/run/cups/cups.sock (Stream) 127.0.0.1:631 (Stream) [::1]:631 (Stream) 127.0.0.1:631 (Datagram) [::1]:631 (Datagram) Jan 24 13:58:50 caligula.adicz systemd[1]: Starting CUPS Printing Service Sockets. Jan 24 13:58:50 caligula.adicz systemd[1]: Listening on CUPS Printing Service Sockets. Jan 24 13:59:28 caligula.adicz systemd[1]: Listening on CUPS Printing Service Sockets. Jan 24 13:59:41 caligula.adicz systemd[1]: Stopping CUPS Printing Service Sockets. Jan 24 13:59:41 caligula.adicz systemd[1]: Closed CUPS Printing Service Sockets. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=857372 https://bugzilla.novell.com/show_bug.cgi?id=857372#c48 --- Comment #48 from Johannes Meixner 2014-01-24 14:36:37 CET --- FYI regarding the "policy allowallforanybody" warnings: Those are some kind of false alarm, see https://bugzilla.novell.com/show_bug.cgi?id=802132#c3 -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=857372 https://bugzilla.novell.com/show_bug.cgi?id=857372#c50 --- Comment #50 from Johannes Meixner 2014-01-24 15:23:02 CET --- Regarding "cups.socket starts cupsd under hood on demand, but who wants it ?" The only answer I know is: "systemd" wants it. Of course not the plain systemd software but those who advertise systemd software features by "just enabling all of them" ;-) I do not say that those systemd software features are wrong. But I wonder if enabling them by default is "the right thing". But I am not an usual user. I don't know what is "the right thing" for usual users nowadays so that I cannot decide about systemd's cups/print services (see my various comments about that problem for me above). Regarding "cupsd server says 'forbidden'": <Location /> Order allow,deny Allow 127.0.0.2 </Location> is insufficient, see http://en.opensuse.org/SDB:CUPS_in_a_Nutshell the section "Configuring CUPS <= 1.5 in the Network" in particular "Configuration of the print queues on a CUPS <= 1.5 server" therein "II) Allow the clients to access the queues." To configure that use "Share Printers" in the YaST printer module. FYI: Regarding enabling/disabling/starting/stopping cupsd from the YaST printer module, see bnc#769946 In short: The YaST printer module does not implement own code for enabling/disabling/starting/stopping cupsd. Instead the YaST printer module calls YaST functions that are meant to be used to do that correctly... ;-) -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=857372 https://bugzilla.novell.com/show_bug.cgi?id=857372#c52 --- Comment #52 from Daniel Pecka 2014-01-24 14:47:22 UTC --- would you consider re-opening this bug as sane ? i'd reopen it with NEEDINFO if completely disabling cups.socket is solution .. i made few more investigations. 1) it seems that if cups.service is disabled, it is started anyway just by cups.socket (when something tries to access it), is it expectable bahaviour: # systemctl list-unit-files | grep cups cups.path disabled cups.service disabled cups.socket enabled # systemctl status cups.service cups.service - CUPS Printing Service Loaded: loaded (/usr/lib/systemd/system/cups.service; disabled) Active: active (running) since Fri 2014-01-24 15:38:29 CET; 1min 2s ago Main PID: 18650 (cupsd) CGroup: /system.slice/cups.service └─18650 /usr/sbin/cupsd -f # netstat -tulnp | grep 631 tcp 0 0 0.0.0.0:631 0.0.0.0:* LISTEN 1/init udp 0 0 0.0.0.0:631 0.0.0.0:* 1/init 2) in the light of my point #1 cups.socket and cups.service should have negative dependency, so if runs one, second must be stopped .. what do you think specifically about my point #2 ? it sounds to me sane .. You EITHER have cups.service running OR cups.socket starting cupsd under hood on demand .. regards, d -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=857372 https://bugzilla.novell.com/show_bug.cgi?id=857372#c54 --- Comment #54 from Johannes Meixner 2014-01-24 16:28:41 CET --- I submitted bnc#860331 - systemd: have only cups.service enabled by default as systemd printing related unit Why I did not submit one with subject only "dropping cups.socket"? Because that "printer.target" also is one where I think it should be carefully and thoroughly evaluated under what exact circumstance it should be enabled, see comment#19 And I have no idea at all what magic (perhaps unwanted) things could happen because of "configure-printer@.service"... -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=857372 https://bugzilla.novell.com/show_bug.cgi?id=857372#c56 --- Comment #56 from Bruno Friedmann 2014-01-25 12:32:22 UTC --- Just to confirm : disabling totally cups.path & cups.socket systemctl disable + systemctl mask the two systemctl enable cups.service make the system able to run cupsd as configured (allow printing on the local network) For easier life, I've done the same on client, they are configured to point to the cups server, nothing less, nothing more. Now printing invoices again :-) -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=857372 https://bugzilla.novell.com/show_bug.cgi?id=857372#c58 --- Comment #58 from Johannes Meixner 2014-01-28 12:56:41 CET --- Regarding comment#55: See also https://bugzilla.novell.com/show_bug.cgi?id=860481#c4 Regarding "add a secure cupsd.conf": What do you mean? What is insecure in our current default cupsd.conf? Please attach a diff (as MIME type text/plain) of your own "secure cupsd.conf" compared to our /etc/cupscupsd.conf.default so that we could discuss real things instead of only talking about vague ideas. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=857372 https://bugzilla.novell.com/show_bug.cgi?id=857372#c60 Johannes Meixner changed: What |Removed |Added ---------------------------------------------------------------------------- Status|RESOLVED |REOPENED Resolution|FIXED | --- Comment #60 from Johannes Meixner 2014-01-28 16:39:23 CET --- What a mess this socket activation thingy causes - now there is also bnc#860834 "After update openSUSE-2014-73 - update for cups (bnc#857372) CUPS doesen't start at boot time." -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=857372 https://bugzilla.novell.com/show_bug.cgi?id=857372#c Swamp Workflow Management changed: What |Removed |Added ---------------------------------------------------------------------------- Status Whiteboard|obs:running:2484:moderate | -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=857372 https://bugzilla.novell.com/show_bug.cgi?id=857372#c63 Johannes Meixner changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |ptesarik@suse.com --- Comment #63 from Johannes Meixner 2014-01-28 17:09:49 CET --- *** Bug 860481 has been marked as a duplicate of this bug. *** http://bugzilla.novell.com/show_bug.cgi?id=860481 -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=857372 https://bugzilla.novell.com/show_bug.cgi?id=857372#c65 Johannes Meixner changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |diego.ercolani@gmail.com --- Comment #65 from Johannes Meixner 2014-01-29 09:16:09 CET --- *** Bug 860940 has been marked as a duplicate of this bug. *** http://bugzilla.novell.com/show_bug.cgi?id=860940 -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=857372 https://bugzilla.novell.com/show_bug.cgi?id=857372#c67 Christian Boltz changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |suse-beta@cboltz.de --- Comment #67 from Christian Boltz 2014-01-29 14:22:50 CET --- (In reply to comment #66)

Now it even seems it is completely impossible to provide systemd unit files for socket activation with default values that are secure and "just work" in a real network.

For a network: yes, it would be (nearly) impossible to havesomething that "just works" and is secure. I'd propose to ship a cups.socket listening only to localhost. Reasons: - it works for average home users who have the printer directly attached to their computer (which is probably the majority of users) - people who want to setup a print server can still enable cups.service In comparison (to comment 61), removing cups.socket completely would mean everybody has to enable cups.service (which means cups is running all the time) - I'd call that a disadvantage for users with the printer attached to their own computer. As far as I understand cups.path (/var/spool/cups/d* are pending print jobs?), I'd say you should also keep it.

Now I am waiting for the first one who demands "YaST" to "fix" it... ;-)

YaST? How boring ;-) If you want a really good solution, write a systemd generator that creates the cups.socket with ListenDatagram=<the network allowed in the cups config> (I don't really need that - but you asked for that type of joke ;-)) -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=857372 https://bugzilla.novell.com/show_bug.cgi?id=857372#c69 --- Comment #69 from Bruno Friedmann 2014-01-29 13:47:02 UTC ---

In comparison (to comment 61), removing cups.socket completely would mean everybody has to enable cups.service (which means cups is running all the time) - I'd call that a disadvantage for users with the printer attached to their own computer.

Take a breath, and read again the whole thread : keeping that *.socket make normaly network printing a pain in ass, cause it doesn't work or interfere. What you propose is keep grandma happy and bother all network administrator. I'm not sure which one of those two target we have the most. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=857372 https://bugzilla.novell.com/show_bug.cgi?id=857372#c71 --- Comment #71 from Petr Tesařík 2014-01-29 14:19:55 UTC --- (In reply to comment #67)

- people who want to setup a print server can still enable cups.service

This doesn't even work. Since systemd binds to 127.0.0.1:631, cupsd cannot create a UDP socket on 0.0.0.0:631 to announce shared printer. It will get EADDRINUSE from the kernel. BTW this is also reported already, see bnc 857778. FWIW the solution proposed by Johannes works for me. Remove cups.socket and cups.path (or disable them by default), and enable cups.service. Please explain what bugs would be introduced by doing exactly that. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=857372 https://bugzilla.novell.com/show_bug.cgi?id=857372#c73 Dr. Werner Fink changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |NEEDINFO InfoProvider| |ptesarik@suse.com --- Comment #73 from Dr. Werner Fink 2014-01-29 14:57:17 UTC --- (In reply to comment #71) Q: Is cups able to handle a forwarded socket, that is not to create one but simply reuse it? Even the old syslogd can do this as I've patched to do. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=857372 https://bugzilla.novell.com/show_bug.cgi?id=857372#c75 --- Comment #75 from Johannes Meixner 2014-01-29 16:57:20 CET --- Submitted hopefully fixed cups package to its openSUSE build system (OBS) development project "Printing" via OBS submitrequest 215537 Now the cups package in OBS project "Printing" contains /usr/lib/systemd/system/cups.service /usr/share/doc/packages/cups/systemd/cups.path /usr/share/doc/packages/cups/systemd/cups.socket /usr/lib/systemd/system/cups.service is -------------------------------------------------------------------------- [Unit] Description=CUPS Printing Service After=network.target [Service] ExecStart=/usr/sbin/cupsd -f [Install] WantedBy=multi-user.target -------------------------------------------------------------------------- To make systemd using only that cups.service file one may have to do # systemctl disable cups.service # systemctl enable cups.service What I have now on my openSUSE 13.1 system (after a reboot): -------------------------------------------------------------------------- # systemctl list-unit-files | egrep -i 'print|cups' configure-printer@.service static cups.service enabled printer.target static # systemctl list-units | egrep -i 'print|cups' cups.service loaded active running CUPS Printing Service -------------------------------------------------------------------------- For me printing on my HP LaserJet 1220 USB printer still works and I still get CUPS Browsing information from our CUPS server and I can still print to such a remote queue. To all who listen here: You could do me a big favour and install the cups package from the OBS project "Printing" on your systems and please provide feedback whether or not it works for you. Check with "rpm -q --changelog cups | head" that you actually have the fixed cups packages. The topmost RPM changelog entry of the fixed cups package is: -------------------------------------------------------------------------- * Wed Jan 29 2014 jsmeix@suse.de - cups-0003-systemd-secure-cups.service-unit-file.patch changes the cups.service systemd unit file to be more secure and to let the cupsd again work as it did all the time for printing in a network (bnc#857372 in particular comment #61 therein). - cups-1.5-additional_policies.patch was updated to avoid cupsd warning messages of the form "No limit for ... defined in policy allowallforanybody and no suitable template found" (bnc#857372 in particular comment #48 therein). -------------------------------------------------------------------------- Very many thanks in advance for your valuable feedback! I need sufficiently positive feedback before I will submit this to openSUSE:Factory, openSUSE:13.1,... General information for packages from the OBS project "Printing": I provide CUPS as RPM packages "cups", "cups-client", and "cups-libs" for various openSUSE and Suse Linux Enterprise versions in the "Printing" development project in the openSUSE build service for 32-bit i586 and 64-bit x86_64 architecture. E.g. for openSUSE 13.1 32-bit i586 from this direct URL http://download.opensuse.org/repositories/Printing/openSUSE_13.1/i586/ Please read https://build.opensuse.org/project/show?project=Printing -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=857372 https://bugzilla.novell.com/show_bug.cgi?id=857372#c77 Dean Martin changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |deano_ferrari@hotmail.com --- Comment #77 from Dean Martin 2014-01-30 05:03:44 UTC ---

To all who listen here:

You could do me a big favour and install the cups package from the OBS project "Printing" on your systems and please provide feedback whether or not it works for you.

Very many thanks in advance for your valuable feedback!

I need sufficiently positive feedback before I will submit this to openSUSE:Factory, openSUSE:13.1,...

Hi Johannes I've just updated via the Printing repo, and can confirm that the changes work for me ie I have access to local printers and a CUPS print server using cupsd.conf settings. FWIW, previously with socket-activation, I had to have cups.socket configured as follows: [Unit] Description=CUPS Printing Service Sockets [Socket] ListenStream=/var/run/cups/cups.sock ListenStream=0.0.0.0:631 ListenDatagram=0.0.0.0:631 BindIPv6Only=ipv6-only [Install] WantedBy=sockets.target -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=857372 https://bugzilla.novell.com/show_bug.cgi?id=857372#c79 Johannes Meixner changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |bwiedemann@suse.com --- Comment #79 from Johannes Meixner 2014-01-30 09:20:35 CET --- *** Bug 795624 has been marked as a duplicate of this bug. *** http://bugzilla.novell.com/show_bug.cgi?id=795624 -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=857372 https://bugzilla.novell.com/show_bug.cgi?id=857372#c81 --- Comment #81 from Felix Miata 2014-01-30 09:05:09 UTC --- (In reply to comment #75)

You could do me a big favour and install the cups package from the OBS project "Printing" on your systems and please provide feedback whether or not it works for you.

Host gx62b with cups-1.5.4-14.2 was not subject to bug 860394 until upgrade to cups-1.5.4-15.1. Upgrading to cups-1.5.4-137.1 from Printing repo eliminated bug 860394. Impact on printing unknown/untested. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=857372 https://bugzilla.novell.com/show_bug.cgi?id=857372#c84 Sascha Peilicke changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |speilicke@suse.com Johannes Meixner changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |u.michel@t-online.de --- Comment #84 from Sascha Peilicke 2014-02-03 15:14:41 CET --- Running with only cups.service, no cups.socket including "Listen 127.0.0.1:631 ; Browsing on" in /etc/cups/cupsd.conf: % systemctl | grep cups cups.path loaded active waiting CUPS Printer Service Spool cups.service loaded active running CUPS Printing Service % netstat -nl | grep 631 tcp 0 0 127.0.0.1:631 0.0.0.0:* LISTEN udp 0 0 0.0.0.0:631 0.0.0.0:* As you can see, cups still listens for external UDP connections. Otherwise the "CUPS Browsing" feature won't work. With the current cups.socket, the situation looks like this: % netstat -nl | grep 631 tcp 0 0 127.0.0.1:631 0.0.0.0:* LISTEN tcp 0 0 ::1:631 :::* LISTEN udp 0 0 127.0.0.1:631 0.0.0.0:* udp 0 0 ::1:631 :::* In other words, both cups-0002-$BLA and cups-0003-$BLUB patches are wrong. This is the actually desired result: % netstat -nl | grep 631 tcp 0 0 127.0.0.1:631 0.0.0.0:* LISTEN tcp 0 0 ::1:631 :::* LISTEN udp 10688 0 0.0.0.0:631 0.0.0.0:* udp 0 0 :::631 :::* See sr#220694 -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=857372 https://bugzilla.novell.com/show_bug.cgi?id=857372#c86 --- Comment #86 from Sascha Peilicke 2014-02-04 09:34:00 UTC --- The simple fact the cups.socket still has "wanted-by: socket.target" causing it be enabled regardless on your recent spec-file experiments. Of course I can get it to work if I follow what you had in mind: disable cups.socket and just use cups.service. I could have used the ages-old init script for the same results. But this is defeating the purpose of systemd, you want socket activation. Therefore it's best to just fix cups.socket and rather than rambling about "secure defaults". BTW. this is magically matching what other users have proposed so far. So could we please stop the prose proliferation and discuss my submit request inside OBS? I don't want 30 more useless comments nor decline reasons that show lacking understanding. So it couldn't hurt if others take a look at it too. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=857372 https://bugzilla.novell.com/show_bug.cgi?id=857372#c87 --- Comment #87 from Johannes Meixner 2014-02-04 10:59:54 CET --- *** Bug 861734 has been marked as a duplicate of this bug. *** http://bugzilla.novell.com/show_bug.cgi?id=861734 -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=857372 https://bugzilla.novell.com/show_bug.cgi?id=857372#c89 Sascha Peilicke changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEEDINFO |ASSIGNED InfoProvider|speilicke@suse.com | --- Comment #89 from Sascha Peilicke 2014-02-04 10:19:11 UTC --- AFAIK or do you know for sure? I didn't test (nor currently care about) IPv6. I want to print. And that doesn't work with cups by default ATM. Regardless of the tons of other issues that the cups package currently suffers from. About the generator, I'm sure that would simply life for people unaware about how systemd works. So currently changing 'Listen: $bla" and "Browse: on" just have no effect on cups.socket. Instead, the user has to provide a custom cups.socket in /etc/systemd/system (the recommended way). I don't think we want a generator. Instead we want to cups to take command-line arguments (host, port) which you could then source from /etc/sysconfig/cups and provide to the init script, the systemd services and the conf file. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=857372 https://bugzilla.novell.com/show_bug.cgi?id=857372#c91 --- Comment #91 from Ludwig Nussel 2014-02-04 12:04:42 CET --- I think cups.socket should only care for the unix domain socket. This would result in cups starting up as soon as you want to print, then cupsd's config determines whether it listens on IP sockets as well. # cat /usr/lib/systemd/system/cups.socket [Unit] Description=CUPS Printing Service Sockets [Socket] ListenStream=/var/run/cups/cups.sock [Install] WantedBy=sockets.target -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=857372 https://bugzilla.novell.com/show_bug.cgi?id=857372#c93 --- Comment #93 from Michal Svec 2014-02-04 12:16:40 CET --- (In reply to comment #91)

I think cups.socket should only care for the unix domain socket. This would result in cups starting up as soon as you want to print, then cupsd's config determines whether it listens on IP sockets as well.

Just make sure that "as soon as you want to print" is not too late, applications need to get a list of printers first, etc and they would not often get it without restart if it was not early enough (LO, FF). -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=857372 https://bugzilla.novell.com/show_bug.cgi?id=857372#c95 --- Comment #95 from Sascha Peilicke 2014-02-04 11:34:22 UTC --- (In reply to comment #92)

(In reply to comment #91)

Indeed if this does work together with the configuration in cups.conf then this is OK if we enable cups in the case that cups.conf causes cups to listen and/or broadcast on the external network interfaces.

I agree, that would be the best solution, I'll give it a try. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=857372 https://bugzilla.novell.com/show_bug.cgi?id=857372#c97 --- Comment #97 from Sascha Peilicke 2014-02-04 12:24:49 UTC --- I have heard of submit requests that address multiple issues at once. That's why such submit requests usually refer to several bugs. If you want to see some more of such submit requests I invite you to take a look at the Factory submission queue. They sum up to around 95%. This is not a maintenance update. And even those do fix several bugs at once :-) -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=857372 https://bugzilla.novell.com/show_bug.cgi?id=857372#c100 Johannes Meixner changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |NEEDINFO InfoProvider| |lnussel@suse.com --- Comment #100 from Johannes Meixner 2014-02-07 12:57:37 CET --- Ludwig Nussel, regarding your comment#91 "cups.socket should only care for the unix domain socket": Is your proposal for cups.socket meant to also have CUPS Browsing working on client systems out-of-the-box? To have CUPS Browsing on client systems working out-of-the-box, the cupsd on the client system must receive CUPS Browsing packages on UDP port 631 (i.e. something must listen on UDP port 631). But as far as I understand your proposal for cups.socket, a local printing activity (i.e. something that uses /var/run/cups/cups.sock) is required to get the cupsd started. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=857372 https://bugzilla.novell.com/show_bug.cgi?id=857372#c102 --- Comment #102 from Johannes Meixner 2014-02-07 15:25:48 CET --- This means your proposal for cups.socket plus an automated "lpstat -h /run/cups/cups.sock -r" during user log in could implement cupsd socket activation with static cups.socket that is secure and works also in a real network. FYI: CUPS <= 1.5 on Linux has no built-in support for DNS-SD. CUPS >= 1.6 has built-in support for DNS-SD on Linux but CUPS >= 1.6 has major incompatible changes, see bnc#735404 -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=857372 https://bugzilla.novell.com/show_bug.cgi?id=857372#c104 --- Comment #104 from Armin Herbert 2014-02-07 15:27:56 UTC --- Also, there are setups where no user ever logs in, but cupsd has to run nevertheless. I don't see a use for socket activating a single service on a single standardized socket that can't be parallelized but has to assemble a state while listening on the local interface for an indefinite time and requires so little resources. On the other hand, I configured cups to do exactly that, but for weeks now, it doesn't, and this bug is, although easily fixed, still open. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=857372 https://bugzilla.novell.com/show_bug.cgi?id=857372#c106 Don Hughes changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |support@microtechniques.com --- Comment #106 from Don Hughes 2014-02-08 15:49:32 UTC --- My CUPS printing from networked servers has stopped working since upgrading to openSUSE 13.1. I tried modifying the .socket file to listen to the correct network address as suggested above, but that only works about 50% of the time. The rest of the time the sockets are started before the network is completely up and can not bind to the network address. E [08/Feb/2014:10:22:58 -0500] Unable to bind socket for address 10.168.1.10:631 - Cannot assign requested address. When I tried to add a network.target requirement, the system went into a systemd loop at start up and failed to start. As the original poster, I was also distressed to find CUPS listening on a bunch of ports that I has specifically disabled in the cups.conf file. For now, I have to start CUPS manually after a reboot. This does not seem like progress. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=857372 https://bugzilla.novell.com/show_bug.cgi?id=857372#c108 Ludwig Nussel changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |lnussel@suse.com --- Comment #108 from Ludwig Nussel 2014-02-10 13:09:55 CET --- (In reply to comment #103)

On the other hand:

Doesn't an automated "lpstat -h /run/cups/cups.sock -r" during log in plus cupsd socket activation result basically the same as an automated cupsd start at system boot?

Yes, but that is up to the desktop then. If you have a desktop that doesn't fiddle with the printing cups won't be started. In that case you have to wait for printers to appear indeed. Or if you know your workstation is in a cups enabled network you just enable cups.service. Same for servers, just enable cups.service. Still cups.socket should only have the unix domain socket. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=857372 https://bugzilla.novell.com/show_bug.cgi?id=857372#c Johannes Meixner changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugzilla.novell.com | |/show_bug.cgi?id=861084 -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=857372 https://bugzilla.novell.com/show_bug.cgi?id=857372#c110 --- Comment #110 from Andreas Mach 2014-02-14 09:53:36 UTC --- just a test - ignore please (In reply to comment #109)

I submitted bnc#863570 regarding "systemd cups.socket listening only on unix domain socket plus using desktop magic for remote queue browsing" to get it separated from this issue here because currently there is no such "desktop magic for remote queue browsing".

-- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=857372 https://bugzilla.novell.com/show_bug.cgi?id=857372#c112 --- Comment #112 from Johannes Meixner 2014-02-14 15:43:13 CET --- *** Bug 783379 has been marked as a duplicate of this bug. *** http://bugzilla.novell.com/show_bug.cgi?id=783379 -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=857372 https://bugzilla.novell.com/show_bug.cgi?id=857372#c114 --- Comment #114 from Bernhard Wiedemann 2014-02-19 17:00:23 CET --- This is an autogenerated message for OBS integration: This bug (857372) was mentioned in https://build.opensuse.org/request/show/223100 Factory / cups -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=857372 https://bugzilla.novell.com/show_bug.cgi?id=857372#c119 --- Comment #119 from Johannes Meixner 2014-02-20 10:26:38 CET --- For what calling Service.Stop("cups") [was Service::Stop("cups") in YCP] should result in YaST see bnc#800492 in particular see https://bugzilla.novell.com/show_bug.cgi?id=800492#c8 I assume the actual issue in YaST:Service was not at all solved. Note the distinction: Calling Service.Stop("cups.service") should only stop cups.service but calling Service.Stop("cups") should stop "the whole CUPS thing". -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=857372 https://bugzilla.novell.com/show_bug.cgi?id=857372#c121 --- Comment #121 from Bernhard Wiedemann 2014-02-20 15:00:18 CET --- This is an autogenerated message for OBS integration: This bug (857372) was mentioned in https://build.opensuse.org/request/show/223233 Factory / cups -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=857372 https://bugzilla.novell.com/show_bug.cgi?id=857372#c123 --- Comment #123 from Don Hughes 2014-02-21 01:07:29 UTC --- The updates from Johannes posted by Dieter Meixner in comment 113 above fixed my Cups startup problems. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=857372 https://bugzilla.novell.com/show_bug.cgi?id=857372#c125 Johannes Meixner changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |NEEDINFO InfoProvider| |maintenance@opensuse.org --- Comment #125 from Johannes Meixner 2014-02-21 14:27:33 CET --- openSUSE maintenance team, if I do not get negative feedback about the current CUPS in the OBS project "Printing" (see comment#122) until Monday next week (24. Feb. 2014), I would like to provide its clean up of systemd units as follow-up maintenance update for all openSUSE versions that were affected by our last official update (see comment#35) which made it secure but no longer working (i.e. for openSUSE 12.2, 12.3, and 13.1 according to "osc request show 213874"). Would you agree to such a follow-up maintenance update? -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=857372 https://bugzilla.novell.com/show_bug.cgi?id=857372#c127 Marcus Meissner changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEEDINFO |ASSIGNED InfoProvider|maintenance@opensuse.org | --- Comment #127 from Marcus Meissner 2014-02-21 14:46:22 UTC --- yes, we can take it for maintenance. 12.2 is out of maintenance, yes, sio only 12.3 and 13.1 do not forget factory. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=857372 https://bugzilla.novell.com/show_bug.cgi?id=857372#c129 Johannes Meixner changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |duwe@suse.com --- Comment #129 from Johannes Meixner 2014-02-25 16:15:29 CET --- Torsten Duwe, please update CUPS with the RPMs from the OBS project "Printing" and provide feedback whether or not it then works for you. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=857372 https://bugzilla.novell.com/show_bug.cgi?id=857372#c131 Johannes Meixner changed: What |Removed |Added ---------------------------------------------------------------------------- AssignedTo|jsmeix@suse.com |maintenance@opensuse.org --- Comment #131 from Johannes Meixner 2014-02-25 17:46:45 CET --- Submitted fix for the fix in comment#35 as OBS maintenancerequest 223848 ------------------------------------------------------------------------------ $ osc maintenancerequest -m 'Fix the fix for bnc#857372: This update fixes the last CUPS update which made it secure but CUPS Browsing did no longer work for printing in the network. With this update CUPS Browsing in the network should again work. This is done by using only a simple and secure systemd unit file cups.service while cups.socket and cups.path are stopped and disabled. This way the cupsd is again used directly so that CUPS works again and can be configured with YaST as it worked all the time in the past.' Using target project 'openSUSE:Maintenance' 223848 ------------------------------------------------------------------------------ I tested it on openSUSE 12.3 and on openSUSE 13.1. In both cases CUPS Browsing stopped to work for me after the first fix in comment#35 and CUPS Browsing worked again after this fix here. For openSUSE:Factory it was already submitted, see comment#121

From my point of view the issue is now fixed.

I re-assign it for further processing to maintenance@opensuse.org (I hope this is o.k.). -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=857372 https://bugzilla.novell.com/show_bug.cgi?id=857372#c133 --- Comment #133 from Johannes Meixner 2014-02-26 08:41:53 CET --- Robert Schweikert (in reply to comment#130), see comment#61 comment#120 and comment#122. If you like that it "just works" as it did in the past, use only cups.service and nothing else. If you know well about systemd, you can manually adapt cups.socket as you need it in your particular case (cf. the various comments above) and use systemd directly to manage it but then you can no longer use YaST (same for cups.path). -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=857372 https://bugzilla.novell.com/show_bug.cgi?id=857372#c135 --- Comment #135 from Johannes Meixner 2014-02-26 09:56:07 CET --- Using your own insulting wording: What is "insane" is the idea that openSUSE provides a service to the users that cannot be managed with YaST. Very most users do not want to be enforced to learn systemd. Expert users who know systemd still can manually set up any special systemd stuff they like to have. If and only if YaST can easily (easily for end-users) manage units that have .socket, .path, and whatever else, then I might rethink about it. Alternatively: You Ludwig Nussel become maintainer and bugowner of CUPS. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=857372 https://bugzilla.novell.com/show_bug.cgi?id=857372#c137 --- Comment #137 from Don Hughes 2014-02-27 15:50:06 UTC --- As a user, printing is just a commodity function, and something that I use everyday. I do not get any joy out of treaking settings, installing drivers, and tracking down print filters. I would like to be able to just attach a printer to the network and have it work, but, unfortunately there are too many moving parts, and I rely on yast to get things working. When I print something it is usually because I have some system issue and I need to print logs, and configuration files, and it is very frustrating to have to stop working on one problem and figure out why I can not print. And with every new release a bunch of things break including CUPS and I find that I end up moving my logs to a Windows machine to print them while I am trying to get things up and running. How annoying. Systemd is still a mystery to me where what seem to be minor changes make my system un-bootable and where I find tracing problems almost impossible. I have had some systemd issues for over a year that I have spent too much time on trying to fix on and have just learned to live with them (CUPS being one). So, if getting remote printing to work again takes creating another bug, then lets do it. On the original issue, I now have similar CUPS configuration information in ./sysconfig/cups, ../cups/cupsd.conf, and various /systemd/system/cups.* files, and when I initially got reports of CUPS listening on a bunch of new ports, it did not occur to me to look for systemd .socket files. If systemd is going to bring up various ports, I would expect it to respect the information in the existing configuration files. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=857372 https://bugzilla.novell.com/show_bug.cgi?id=857372#c139 Benjamin Brunner changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |bbrunner@suse.com --- Comment #139 from Benjamin Brunner 2014-03-03 12:57:10 CET --- @Johannes, Marcus and I also agree that enabling cups per default would be over the top. So we have to find another solution. (even if I already accepted the sr, the update is currently stopped) -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=857372 https://bugzilla.novell.com/show_bug.cgi?id=857372#c141 --- Comment #141 from Don Hughes 2014-03-03 16:57:13 UTC --- I support Robert's request in Comment 140. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=857372 https://bugzilla.novell.com/show_bug.cgi?id=857372#c143 --- Comment #143 from Felix Miata 2014-03-04 06:14:33 EST --- (In reply to comment #75)

You could do me a big favour and install the cups package from the OBS project "Printing" on your systems and please provide feedback whether or not it works for you.

On 32 bit 13.2 host hs80e upgrading to cups-1.5.4-146.5 from Printing repo failed to eliminate bug 860394. About one minute init stall after 10.759720 LVM: Activation generator successfully completed, then another minute with 71.###### systemd[1]: cannot add dependency job for unit cups.socket, ignoring: Unit cups.socket failed to load: no such file or directory, and another like it for cups.path, then another for network-remotefs.service. Total boot time: >5 minutes. Head of systemd-analyze blame: 8.206s systemd-fsck@dev-disk-by\x2dlabel-os121hs80.service 8.062s systemd-fsck@dev-disk-by\x2dlabel-os122hs80.service 6.269s systemd-fsck@dev-disk-by\x2dlabel-os123hs80.service 4.259s nmb.service 3.647s systemd-fsck@dev-disk-by\x2dlabel-os131hs80.service 3.591s wicked.service 3.460s nfsserver.service 3.113s systemd-fsck-root.service 2.810s systemd-fsck@dev-disk-by\x2dlabel-HS80\x2d07boot.service 2.762s systemd-vconsole-setup.service 2.404s systemd-udev-root-symlink.service 2.327s nfs.service 2.321s wickedd-dhcp4.service 2.217s systemd-logind.service 2.163s wickedd.service 2.023s kmod-static-nodes.service 1.975s rsyslog.service 1.931s wickedd-dhcp6.service 1.836s rpcbind.service 1.825s systemd-fsck@dev-disk-by\x2dlabel-HS80\x2d14home.service 1.812s systemd-fsck@dev-disk-by\x2dlabel-HS80\x2dusrlcl.service 1.774s systemd-modules-load.service 1.748s sys-kernel-debug.mount 1.743s dev-mqueue.mount 1.572s cifs.service 1.539s mdmonitor.service 1.533s systemd-fsck@dev-disk-by\x2dlabel-HS80\x2dpub.service 1.246s wickedd-auto4.service 1.174s wickedd-nanny.service 1.024s smb.service It looks to me like systemd-analyze blame is missing some big time gobblers. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=857372 https://bugzilla.novell.com/show_bug.cgi?id=857372#c145 Johannes Meixner changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jnelson-suse@jamponi.net --- Comment #145 from Johannes Meixner 2014-03-18 08:49:22 CET --- *** Bug 864312 has been marked as a duplicate of this bug. *** http://bugzilla.novell.com/show_bug.cgi?id=864312 -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=857372 --- Comment #148 from Daniel Pecka --- I reread after quite some time what course discussion here plots now .. I'm almost completely with johannes (and his kind of voices) .. the only sane solution is to not overcomplicating it by trying to do it systemd-smart (what is not probably exactly "smart" for everyone) until this part of systemd gets some design improvements (and this rule can by apply generally on every second systemd feature) .. just plain cupsd.service (like in good old times) spawning cupsd process reading its own configuration in cupsd.conf works and is clear enough .. I don't really catch what all have happened here during the life of this bugreport .. regards, d -- You are receiving this mail because: You are on the CC list for the bug.