Mehmet InceandDaybreak Blue
5c336885d2
Run cups-browsed as a locked service account with a dedicated cache and a focused systemd sandbox. Restrict automatic queues to driverless IPP printers, remove wheel from passwordless CUPS administration, replace cups-pdf with Polkit-backed setup, and migrate existing systems safely. Reported-By: Erik Hunstad (Bad Sector Labs) Co-Authored-By: Daybreak Blue <noreply@openai.com>
9 lines
407 B
Plaintext
9 lines
407 B
Plaintext
# Keep state away from /var/cache/cups, which is writable by the account CUPS
|
|
# uses for print filters. cups-browsed is the only writer to this directory.
|
|
CacheDir /var/cache/cups-browsed
|
|
|
|
# Auto-create queues only for modern driverless IPP printers. Remote queues
|
|
# exported by another CUPS server can still be added manually when needed.
|
|
CreateIPPPrinterQueues Driverless
|
|
CreateRemoteCUPSPrinterQueues No
|