ZacharyZhang-NY/omarchycn
3
4
Fork 0
Code Issues Pull Requests 2 Actions Packages Projects Releases 5 Wiki Activity

Harden CUPS printer discovery

Browse Source 
Run cups-browsed as a locked service account with a dedicated cache and a focused systemd sandbox. Restrict automatic queues to driverless IPP printers, remove wheel from passwordless CUPS administration, replace cups-pdf with Polkit-backed setup, and migrate existing systems safely.

Reported-By: Erik Hunstad (Bad Sector Labs)

Co-Authored-By: Daybreak Blue <noreply@openai.com>
This commit is contained in:
Mehmet Ince
2026-08-27 18:00:12 +01:00
co-authored by Daybreak Blue
parent 946704f309
commit 5c336885d2
9 changed files with 375 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
etc/systemd/system/cups-browsed.service.d/10-omarchy.conf
+11
View File
@@ -0,0 +1,11 @@
[Service]
User=cups-browsed
Group=cups-browsed
CacheDirectory=cups-browsed
CacheDirectoryMode=0750
UMask=0027
NoNewPrivileges=yes
ProtectSystem=strict
ProtectHome=yes
PrivateTmp=yes
RestrictSUIDSGID=yes