58 lines
2.7 KiB
Bash
58 lines
2.7 KiB
Bash
echo "Separate printer discovery from root and print-filter access"
|
|
|
|
machine_marker="${OMARCHY_CUPS_MIGRATION_MARKER:-/var/lib/omarchy/migrations/1787815267}"
|
|
|
|
[[ ! -e $machine_marker ]] || exit 0
|
|
|
|
# Existing releases allowed a desktop user or shared group named cups-browsed,
|
|
# which systemd-sysusers would silently reuse for passwordless CUPS access.
|
|
if omarchy-pkg-present cups; then
|
|
cups_browsed_account=$(getent passwd cups-browsed || true)
|
|
cups_browsed_group=$(getent group cups-browsed || true)
|
|
|
|
if [[ -n $cups_browsed_account || -n $cups_browsed_group ]]; then
|
|
IFS=: read -r _ _ cups_browsed_uid cups_browsed_gid cups_browsed_description cups_browsed_home cups_browsed_shell <<<"$cups_browsed_account"
|
|
IFS=: read -r _ _ cups_browsed_group_gid cups_browsed_group_members <<<"$cups_browsed_group"
|
|
other_primary_user=$(getent passwd | awk -F: -v gid="$cups_browsed_gid" '$1 != "cups-browsed" && $4 == gid { print $1; exit }')
|
|
|
|
if [[ ! $cups_browsed_uid =~ ^[0-9]+$ || ! $cups_browsed_group_gid =~ ^[0-9]+$ ]] ||
|
|
((cups_browsed_uid <= 0 || cups_browsed_uid >= 1000)) ||
|
|
[[ $cups_browsed_gid != $cups_browsed_group_gid ]] ||
|
|
[[ $cups_browsed_description != "CUPS printer discovery" || $cups_browsed_home != "/" || $cups_browsed_shell != "/usr/bin/nologin" ]] ||
|
|
[[ -n $cups_browsed_group_members || -n $other_primary_user ]]; then
|
|
echo "Cannot harden printer discovery: the existing cups-browsed user or group is not a dedicated system account." >&2
|
|
false
|
|
fi
|
|
fi
|
|
fi
|
|
|
|
# CUPS-PDF accepts a job-controlled post-processing command in a backend that
|
|
# CUPS launches as root. Native application print-to-file support replaces it.
|
|
omarchy-pkg-drop cups-pdf
|
|
|
|
# system-config-printer uses this helper to request printer administration
|
|
# through Polkit now that the desktop user's wheel group is no longer @SYSTEM.
|
|
if omarchy-pkg-present cups; then
|
|
omarchy-pkg-add cups-pk-helper
|
|
fi
|
|
|
|
# Stop the root-running daemon before changing the authorization it relies on.
|
|
if systemctl is-active --quiet cups-browsed.service 2>/dev/null; then
|
|
sudo systemctl stop cups-browsed.service
|
|
fi
|
|
|
|
if omarchy-pkg-present cups; then
|
|
sudo systemctl daemon-reload
|
|
sudo systemctl try-reload-or-restart cups.service
|
|
fi
|
|
|
|
# Resume on whether the unit is enabled, not on whether it was running when this
|
|
# run started: an interrupted earlier run leaves it stopped, and a retry that
|
|
# recomputed that would skip the restart and still write the marker below. A
|
|
# masked or disabled unit reports not-enabled and is left alone.
|
|
if systemctl is-enabled --quiet cups-browsed.service 2>/dev/null; then
|
|
sudo systemctl restart cups-browsed.service
|
|
fi
|
|
|
|
sudo install -Dm644 /dev/null "$machine_marker"
|