68fc0cf6e6
cupsd compares directive names with _cups_strcasecmp, so a hand-edited "systemgroup sys root wheel" is live configuration, but matching $1 against the canonical spelling skipped it and appended a second directive at the end of the file. parse_groups accumulates the groups of every SystemGroup directive it reads rather than replacing them, so both lines took effect and wheel kept the passwordless administration this is meant to remove, with the migration reporting success. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-Authored-By: Codex XHigh <noreply@openai.com>
84 lines
2.4 KiB
Bash
84 lines
2.4 KiB
Bash
# cups-browsed manages queues through CUPS and does not need Unix root. Give
|
|
# only its locked service account passwordless CUPS administration; interactive
|
|
# users go through cups-pk-helper and Polkit instead.
|
|
cups_files_conf="${OMARCHY_CUPS_FILES_CONF:-/etc/cups/cups-files.conf}"
|
|
cups_browsed_sysusers_conf="${OMARCHY_CUPS_BROWSED_SYSUSERS_CONF:-/etc/sysusers.d/omarchy-cups-browsed.conf}"
|
|
|
|
if [[ -f $cups_browsed_sysusers_conf ]]; then
|
|
systemd-sysusers "$cups_browsed_sysusers_conf"
|
|
fi
|
|
|
|
if [[ -L $cups_files_conf ]]; then
|
|
echo "Refusing to rewrite symlinked CUPS authorization config: $cups_files_conf" >&2
|
|
false
|
|
elif [[ -f $cups_files_conf ]]; then
|
|
staged_conf=$(mktemp --tmpdir="${cups_files_conf%/*}" ".${cups_files_conf##*/}.XXXXXX")
|
|
|
|
if ! awk '
|
|
NR == FNR {
|
|
if (tolower($1) == "systemgroup") {
|
|
for (i = 2; i <= NF; i++) {
|
|
if (substr($i, 1, 1) == "#")
|
|
break
|
|
if ($i != "wheel" && !seen_group[$i]) {
|
|
system_groups[++system_group_count] = $i
|
|
seen_group[$i] = 1
|
|
}
|
|
}
|
|
}
|
|
next
|
|
}
|
|
|
|
tolower($1) == "systemgroup" {
|
|
comment_start = index($0, "#")
|
|
if (!wrote_system_group) {
|
|
printf "SystemGroup"
|
|
for (i = 1; i <= system_group_count; i++)
|
|
printf " %s", system_groups[i]
|
|
if (!seen_group["cups-browsed"])
|
|
printf " cups-browsed"
|
|
if (comment_start)
|
|
printf " %s", substr($0, comment_start)
|
|
print ""
|
|
wrote_system_group = 1
|
|
} else if (comment_start) {
|
|
print substr($0, comment_start)
|
|
}
|
|
next
|
|
}
|
|
|
|
tolower($1) == "peercred" {
|
|
comment_start = index($0, "#")
|
|
if (!saw_peer_cred) {
|
|
printf "PeerCred on"
|
|
if (comment_start)
|
|
printf " %s", substr($0, comment_start)
|
|
print ""
|
|
} else if (comment_start) {
|
|
print substr($0, comment_start)
|
|
}
|
|
saw_peer_cred = 1
|
|
next
|
|
}
|
|
|
|
{ print }
|
|
|
|
END {
|
|
if (!wrote_system_group)
|
|
print "SystemGroup sys root cups-browsed"
|
|
if (!saw_peer_cred)
|
|
print "PeerCred on"
|
|
}
|
|
' "$cups_files_conf" "$cups_files_conf" >"$staged_conf"; then
|
|
rm -f "$staged_conf"
|
|
false
|
|
fi
|
|
|
|
if ! chmod --reference="$cups_files_conf" "$staged_conf" ||
|
|
! chown --reference="$cups_files_conf" "$staged_conf" ||
|
|
! mv -f "$staged_conf" "$cups_files_conf"; then
|
|
rm -f "$staged_conf"
|
|
false
|
|
fi
|
|
fi
|