Mehmet InceandDaybreak Blue
5c336885d2
Run cups-browsed as a locked service account with a dedicated cache and a focused systemd sandbox. Restrict automatic queues to driverless IPP printers, remove wheel from passwordless CUPS administration, replace cups-pdf with Polkit-backed setup, and migrate existing systems safely. Reported-By: Erik Hunstad (Bad Sector Labs) Co-Authored-By: Daybreak Blue <noreply@openai.com>
12 lines
203 B
Plaintext
12 lines
203 B
Plaintext
[Service]
|
|
User=cups-browsed
|
|
Group=cups-browsed
|
|
CacheDirectory=cups-browsed
|
|
CacheDirectoryMode=0750
|
|
UMask=0027
|
|
NoNewPrivileges=yes
|
|
ProtectSystem=strict
|
|
ProtectHome=yes
|
|
PrivateTmp=yes
|
|
RestrictSUIDSGID=yes
|