Merge pull request #8627 from mdisec/security/harden-cups-browsed

Harden CUPS printer discovery

(cherry picked from commit 169ad00a84)

etc/cups/cups-browsed.conf

@@ -1,4 +1,8 @@
-# Omarchy override of cups-browsed's shipped config. The only behavioural
-# change vs the upstream default (all-commented) is enabling auto-registration
-# of remote IPP printers discovered via Avahi/mDNS.
-CreateRemotePrinters Yes
+# Keep state away from /var/cache/cups, which is writable by the account CUPS
+# uses for print filters. cups-browsed is the only writer to this directory.
+CacheDir /var/cache/cups-browsed
+
+# Auto-create queues only for modern driverless IPP printers. Remote queues
+# exported by another CUPS server can still be added manually when needed.
+CreateIPPPrinterQueues Driverless
+CreateRemoteCUPSPrinterQueues No

etc/cups/cups-files.conf

@@ -0,0 +1,90 @@
+#
+# File/directory/user/group configuration file for the CUPS scheduler.
+# See "man cups-files.conf" for a complete description of this file.
+#
+
+# List of events that are considered fatal errors for the scheduler...
+#FatalErrors config
+
+# Strip domain in local username?
+#StripUserDomain No
+
+# Do we call fsync() after writing configuration or status files?
+#SyncOnClose No
+
+# Default user and group for filters/backends/helper programs; this cannot be
+# any user or group that resolves to ID 0 for security reasons...
+User 209
+Group 209
+
+# Administrator user group, used to match @SYSTEM in cupsd.conf policy rules...
+# This cannot contain the Group value for security reasons...
+SystemGroup cups-browsed sys root
+
+
+# Are Unix domain socket peer credentials used for authorization?
+PeerCred on
+
+# User that is substituted for unauthenticated (remote) root accesses...
+#RemoteRoot remroot
+
+# Do we allow file: device URIs other than to /dev/null?
+#FileDevice No
+
+# Permissions for configuration and log files...
+#ConfigFilePerm 0640
+#LogFilePerm 0644
+
+# Location of the file logging all access to the scheduler; may be the name
+# "syslog". If not an absolute path, the value of ServerRoot is used as the
+# root directory.  Also see the "AccessLogLevel" directive in cupsd.conf.
+AccessLog /var/log/cups/access_log
+
+# Location of cache files used by the scheduler...
+#CacheDir /var/cache/cups
+
+# Location of data files used by the scheduler...
+#DataDir /usr/share/cups
+
+# Location of the static web content served by the scheduler...
+#DocumentRoot /usr/share/cups/doc
+
+# Location of the file logging all messages produced by the scheduler and any
+# helper programs; may be the name "syslog". If not an absolute path, the value
+# of ServerRoot is used as the root directory.  Also see the "LogLevel"
+# directive in cupsd.conf.
+ErrorLog /var/log/cups/error_log
+
+# Location of the file logging all pages printed by the scheduler and any
+# helper programs; may be the name "syslog". If not an absolute path, the value
+# of ServerRoot is used as the root directory.  Also see the "PageLogFormat"
+# directive in cupsd.conf.
+PageLog /var/log/cups/page_log
+
+# Location of the file listing all of the local printers...
+#Printcap /etc/printcap
+
+# Format of the Printcap file...
+#PrintcapFormat bsd
+#PrintcapFormat plist
+#PrintcapFormat solaris
+
+# Location of all spool files...
+#RequestRoot /var/spool/cups
+
+# Location of helper programs...
+#ServerBin /usr/lib/cups
+
+# SSL/TLS keychain for the scheduler...
+#ServerKeychain ssl
+
+# Location of other configuration files...
+#ServerRoot /etc/cups
+
+# Location of scheduler state files...
+#StateDir /run/cups
+
+# Location of scheduler/helper temporary files. This directory is emptied on
+# scheduler startup and cannot be one of the standard (public) temporary
+# directory locations for security reasons...
+#TempDir /var/spool/cups/tmp

etc/systemd/system/cups-browsed.service.d/10-omarchy.conf

@@ -0,0 +1,11 @@
+[Service]
+User=cups-browsed
+Group=cups-browsed
+CacheDirectory=cups-browsed
+CacheDirectoryMode=0750
+UMask=0027
+NoNewPrivileges=yes
+ProtectSystem=strict
+ProtectHome=yes
+PrivateTmp=yes
+RestrictSUIDSGID=yes

etc/sysusers.d/omarchy-cups-browsed.conf

@@ -0,0 +1 @@
+u cups-browsed - "CUPS printer discovery" / -