Harden CUPS printer discovery

0 Fork 0

Run cups-browsed as a locked service account with a dedicated cache and a focused systemd sandbox. Restrict automatic queues to driverless IPP printers, remove wheel from passwordless CUPS administration, replace cups-pdf with Polkit-backed setup, and migrate existing systems safely.

Reported-By: Erik Hunstad (Bad Sector Labs)

Co-Authored-By: Daybreak Blue <noreply@openai.com>

This commit is contained in:

Mehmet InceandDaybreak Blue committed 2026-08-27 18:00:12 +01:00

1 parent 946704f309

commit 5c336885d2

9 files changed

+375 -6

No files matched your search

etc/sysusers.d/omarchy-cups-browsed.conf

View File

				`@@ -0,0 +1 @@`
				`u cups-browsed - "CUPS printer discovery" / -`