From 521f1ae9acfd01a62d11ef8cd8b9479b2f9d6e9a Mon Sep 17 00:00:00 2001 From: omabot Date: Thu, 27 Aug 2026 19:45:27 +0200 Subject: [PATCH] Resume cups-browsed on whether it is enabled, not on whether it was running The migration recomputed whether cups-browsed was active at the start of every run, after an earlier run may already have stopped it. A run interrupted between that stop and the completion marker left the service down, and the retry that followed read it as inactive, skipped the restart, and wrote the marker anyway: printer discovery stayed off until the next reboot with no migration left to bring it back. Keying the restart to whether the unit is enabled survives the interruption, and reports not-enabled for a unit the user masked or disabled, which restarting would fail on and abort the migration short of its marker. Co-Authored-By: Claude Opus 5 (1M context) Co-Authored-By: Codex XHigh --- migrations/1787815267.sh | 9 +++-- test/shell.d/cups-hardening-test.sh | 55 +++++++++++++++++++++++++++++ 2 files changed, 61 insertions(+), 3 deletions(-) diff --git a/migrations/1787815267.sh b/migrations/1787815267.sh index c5b89c2f..31a8e797 100644 --- a/migrations/1787815267.sh +++ b/migrations/1787815267.sh @@ -14,9 +14,8 @@ if omarchy-pkg-present cups; then omarchy-pkg-add cups-pk-helper fi -cups_browsed_was_active=0 +# Stop the root-running daemon before changing the authorization it relies on. if systemctl is-active --quiet cups-browsed.service 2>/dev/null; then - cups_browsed_was_active=1 sudo systemctl stop cups-browsed.service fi @@ -27,7 +26,11 @@ if omarchy-pkg-present cups; then sudo systemctl try-reload-or-restart cups.service fi -if (( cups_browsed_was_active )) && omarchy-pkg-present cups-browsed; then +# Resume on whether the unit is enabled, not on whether it was running when this +# run started: an interrupted earlier run leaves it stopped, and a retry that +# recomputed that would skip the restart and still write the marker below. A +# masked or disabled unit reports not-enabled and is left alone. +if systemctl is-enabled --quiet cups-browsed.service 2>/dev/null; then sudo systemctl restart cups-browsed.service fi diff --git a/test/shell.d/cups-hardening-test.sh b/test/shell.d/cups-hardening-test.sh index 7ba8fea3..f5c92e44 100644 --- a/test/shell.d/cups-hardening-test.sh +++ b/test/shell.d/cups-hardening-test.sh @@ -167,3 +167,58 @@ PATH="$mock_bin:$PATH" \ fail "the machine-wide migration repeats privileged work" pass "the migration safely converts an active existing installation once" + +# An interrupted earlier run leaves cups-browsed stopped, so the retry that +# follows finds it inactive. It must still be restarted: the retry records the +# machine-wide marker either way, so a restart skipped here would leave printer +# discovery off until the next reboot with nothing left to run. +cat >"$mock_bin/systemctl" <<'SH' +#!/bin/bash +printf 'systemctl\t%s\n' "$*" >>"$OMARCHY_CUPS_TEST_LOG" +[[ $1 == "is-active" ]] && exit 1 +exit 0 +SH +chmod +x "$mock_bin/systemctl" + +retry_log="$test_tmp/retry.log" +retry_marker="$test_tmp/var/lib/omarchy/migrations/1787815267-retry" + +OMARCHY_CUPS_TEST_LOG="$retry_log" \ + PATH="$mock_bin:$PATH" \ + OMARCHY_PATH="$ROOT" \ + OMARCHY_CUPS_FILES_CONF="$authorization_conf" \ + OMARCHY_CUPS_BROWSED_SYSUSERS_CONF="$sysusers_conf" \ + OMARCHY_CUPS_MIGRATION_MARKER="$retry_marker" \ + bash -euo pipefail "$ROOT/migrations/1787815267.sh" + +grep -qxF $'systemctl\trestart cups-browsed.service' "$retry_log" || + fail "the retry resumes cups-browsed after an interrupted earlier run" + +pass "a run following an interrupted one still resumes printer discovery" + +# A unit the user masked or disabled reports not-enabled, and restarting it +# would fail and abort the migration before it records completion. +cat >"$mock_bin/systemctl" <<'SH' +#!/bin/bash +printf 'systemctl\t%s\n' "$*" >>"$OMARCHY_CUPS_TEST_LOG" +[[ $1 == "is-active" || $1 == "is-enabled" ]] && exit 1 +exit 0 +SH +chmod +x "$mock_bin/systemctl" + +masked_log="$test_tmp/masked.log" +masked_marker="$test_tmp/var/lib/omarchy/migrations/1787815267-masked" + +OMARCHY_CUPS_TEST_LOG="$masked_log" \ + PATH="$mock_bin:$PATH" \ + OMARCHY_PATH="$ROOT" \ + OMARCHY_CUPS_FILES_CONF="$authorization_conf" \ + OMARCHY_CUPS_BROWSED_SYSUSERS_CONF="$sysusers_conf" \ + OMARCHY_CUPS_MIGRATION_MARKER="$masked_marker" \ + bash -euo pipefail "$ROOT/migrations/1787815267.sh" + +! grep -qxF $'systemctl\trestart cups-browsed.service' "$masked_log" || + fail "the migration leaves a masked or disabled cups-browsed alone" +[[ -f $masked_marker ]] || fail "the migration completes with cups-browsed masked" + +pass "a masked or disabled cups-browsed is left alone and does not fail the migration"