Merge pull request #8627 from mdisec/security/harden-cups-browsed

Harden CUPS printer discovery
2026-08-29 02:19:53 -04:00
parent f0672772d2 74997fd523
commit 169ad00a84
11 changed files with 465 additions and 12 deletions
@@ -0,0 +1,57 @@
+echo "Separate printer discovery from root and print-filter access"
+
+machine_marker="${OMARCHY_CUPS_MIGRATION_MARKER:-/var/lib/omarchy/migrations/1787815267}"
+
+[[ ! -e $machine_marker ]] || exit 0
+
+# Existing releases allowed a desktop user or shared group named cups-browsed,
+# which systemd-sysusers would silently reuse for passwordless CUPS access.
+if omarchy-pkg-present cups; then
+  cups_browsed_account=$(getent passwd cups-browsed || true)
+  cups_browsed_group=$(getent group cups-browsed || true)
+
+  if [[ -n $cups_browsed_account || -n $cups_browsed_group ]]; then
+    IFS=: read -r _ _ cups_browsed_uid cups_browsed_gid cups_browsed_description cups_browsed_home cups_browsed_shell <<<"$cups_browsed_account"
+    IFS=: read -r _ _ cups_browsed_group_gid cups_browsed_group_members <<<"$cups_browsed_group"
+    other_primary_user=$(getent passwd | awk -F: -v gid="$cups_browsed_gid" '$1 != "cups-browsed" && $4 == gid { print $1; exit }')
+
+    if [[ ! $cups_browsed_uid =~ ^[0-9]+$ || ! $cups_browsed_group_gid =~ ^[0-9]+$ ]] ||
+      ((cups_browsed_uid <= 0 || cups_browsed_uid >= 1000)) ||
+      [[ $cups_browsed_gid != $cups_browsed_group_gid ]] ||
+      [[ $cups_browsed_description != "CUPS printer discovery" || $cups_browsed_home != "/" || $cups_browsed_shell != "/usr/bin/nologin" ]] ||
+      [[ -n $cups_browsed_group_members || -n $other_primary_user ]]; then
+      echo "Cannot harden printer discovery: the existing cups-browsed user or group is not a dedicated system account." >&2
+      false
+    fi
+  fi
+fi
+
+# CUPS-PDF accepts a job-controlled post-processing command in a backend that
+# CUPS launches as root. Native application print-to-file support replaces it.
+omarchy-pkg-drop cups-pdf
+
+# system-config-printer uses this helper to request printer administration
+# through Polkit now that the desktop user's wheel group is no longer @SYSTEM.
+if omarchy-pkg-present cups; then
+  omarchy-pkg-add cups-pk-helper
+fi
+
+# Stop the root-running daemon before changing the authorization it relies on.
+if systemctl is-active --quiet cups-browsed.service 2>/dev/null; then
+  sudo systemctl stop cups-browsed.service
+fi
+
+if omarchy-pkg-present cups; then
+  sudo systemctl daemon-reload
+  sudo systemctl try-reload-or-restart cups.service
+fi
+
+# Resume on whether the unit is enabled, not on whether it was running when this
+# run started: an interrupted earlier run leaves it stopped, and a retry that
+# recomputed that would skip the restart and still write the marker below. A
+# masked or disabled unit reports not-enabled and is left alone.
+if systemctl is-enabled --quiet cups-browsed.service 2>/dev/null; then
+  sudo systemctl restart cups-browsed.service
+fi
+
+sudo install -Dm644 /dev/null "$machine_marker"