From bb5b178e5f5d26fa2059c552ec2aac38a1e25fe5 Mon Sep 17 00:00:00 2001 From: Ryan Hughes Date: Sat, 29 Aug 2026 14:24:05 -0400 Subject: [PATCH] Remove unused cups-browsed install override --- install/post-install/pacman.sh | 15 ++------------- test/acceptance.d/system-test.sh | 12 +++++++++++- test/shell.d/cups-hardening-test.sh | 18 ++++++++---------- 3 files changed, 21 insertions(+), 24 deletions(-) diff --git a/install/post-install/pacman.sh b/install/post-install/pacman.sh index 22422820..da84975b 100644 --- a/install/post-install/pacman.sh +++ b/install/post-install/pacman.sh @@ -3,22 +3,11 @@ cp -f "$OMARCHY_PATH/default/pacman/pacman-${OMARCHY_MIRROR:-stable}.conf" /etc/pacman.conf cp -f "$OMARCHY_PATH/default/pacman/mirrorlist-${OMARCHY_MIRROR:-stable}" /etc/pacman.d/mirrorlist -# Each override waits for the package that owns the file it replaces, the way -# omarchy-settings does, so pacman does not turn it into a .pacnew during ISO -# package installation. +# Wait for CUPS to own the file, the way omarchy-settings does, so pacman does +# not turn the override into a .pacnew during ISO package installation. if [[ -f $OMARCHY_PATH/etc-overrides/cups-cups-files.conf && -f /etc/cups/cups-files.conf ]]; then install -m 0640 -o root -g cups "$OMARCHY_PATH/etc-overrides/cups-cups-files.conf" /etc/cups/cups-files.conf rm -f /etc/cups/cups-files.conf.pacnew fi -# cups-browsed is no longer part of the default install, so this waits for a -# machine that adds discovery back by hand. Writing the override before then -# would leave a configuration file for a package nothing installed, and pacman -# would later land the package's own copy beside it as a .pacnew. -if [[ -f $OMARCHY_PATH/etc-overrides/cups-cups-browsed.conf && -f /etc/cups/cups-browsed.conf ]]; then - systemd-sysusers /etc/sysusers.d/omarchy-cups-browsed.conf - cp -f "$OMARCHY_PATH/etc-overrides/cups-cups-browsed.conf" /etc/cups/cups-browsed.conf - rm -f /etc/cups/cups-browsed.conf.pacnew -fi - source "$OMARCHY_INSTALL/hardware/pacman.sh" diff --git a/test/acceptance.d/system-test.sh b/test/acceptance.d/system-test.sh index deb42f4e..75e9ac81 100644 --- a/test/acceptance.d/system-test.sh +++ b/test/acceptance.d/system-test.sh @@ -65,7 +65,7 @@ verify_services() { } verify_printing_security() { - local lpinfo_output + local lpinfo_output path ! pacman -Q cups-pdf >/dev/null 2>&1 || fail "CUPS-PDF is absent" pass "the root CUPS-PDF backend is not installed" @@ -80,6 +80,16 @@ verify_printing_security() { fail "no discovery service is enabled" ! systemctl is-active --quiet cups-browsed.service 2>/dev/null || fail "no discovery service is running" + + for path in \ + /etc/cups/cups-browsed.conf \ + /usr/bin/cups-browsed \ + /usr/lib/cups/backend/implicitclass \ + /usr/lib/systemd/system/cups-browsed.service \ + /etc/systemd/system/multi-user.target.wants/cups-browsed.service; do + [[ ! -e $path && ! -L $path ]] || + fail "automatic printer discovery leaves no installed package files" "$path still exists" + done pass "automatic printer discovery is absent from a stock install" systemctl is-active --quiet cups.service || fail "CUPS is running" diff --git a/test/shell.d/cups-hardening-test.sh b/test/shell.d/cups-hardening-test.sh index d60e156f..a8aefb94 100644 --- a/test/shell.d/cups-hardening-test.sh +++ b/test/shell.d/cups-hardening-test.sh @@ -19,8 +19,8 @@ grep -qxF cups-pk-helper "$packages" || fail "Polkit printer administration is i ! grep -qxF cups-pdf "$packages" || fail "the root CUPS-PDF backend is removed" # Automatic discovery is temporarily out of the default install while it is -# reworked. The hardened configuration below still ships: it is what a -# hand-installed cups-browsed gets, and what discovery comes back onto. +# reworked. The hardened configuration below stays as the baseline discovery +# comes back onto. ! grep -qxF cups-browsed "$packages" || fail "automatic printer discovery is out of the base package set" ! grep -q 'cups-browsed' "$ROOT/install/config/enable-services.sh" || fail "a fresh install does not enable a discovery service it no longer installs" @@ -29,19 +29,17 @@ grep -qxF cups-pk-helper "$packages" || fail "Polkit printer administration is i pass "the base install keeps CUPS and Polkit administration, without automatic discovery" -# The install-time override for a file has to wait for the package that owns -# it. CUPS still ships /etc/cups/cups-files.conf, so a guard on that file no -# longer says anything about cups-browsed: writing its override on a machine -# without the package leaves a configuration file for a package nothing -# installed, and pacman lands its own copy beside it as a .pacnew later. +# CUPS still ships /etc/cups/cups-files.conf, so its authorization override is +# applied after the ISO installs that package. cups-browsed is absent, so the +# installer must not write any of its package-owned configuration. post_install_pacman="$ROOT/install/post-install/pacman.sh" -grep -q 'cups-cups-browsed.conf && -f /etc/cups/cups-browsed.conf' "$post_install_pacman" || - fail "the discovery override waits for the package that owns the file it replaces" +! grep -q 'cups-cups-browsed.conf' "$post_install_pacman" || + fail "a fresh install does not write configuration for absent printer discovery" grep -q 'cups-cups-files.conf && -f /etc/cups/cups-files.conf' "$post_install_pacman" || fail "the CUPS authorization override waits for the file it replaces" -pass "install-time overrides wait for the packages that own their files" +pass "the fresh install applies CUPS hardening without writing discovery configuration" grep -qxF 'CacheDir /var/cache/cups-browsed' "$cups_browsed_conf" || fail "cups-browsed keeps state outside the print-filter cache"