Cups ipp backend permissions problem for legacy driverless printing support

[7underlines]

Cups-filters 1.26.0+ assumes 755 for the driverless printing fallback logic.
Ubuntu 19.10 already applies a distro specific patch to cups for this.

The issue was brought up here
#163.

I tried to get this into cups upstream here
apple/cups#5710

But, that was rejected because it would break Kerberized printing.

Any ideas how we can fix this without relying on distro specific patches?

[tillkamppeter]

CUPS needs the "ipp" backend to run as root so that it supports Kerberos authentication. To make a backend run as root under CUPS one removes its execution permissions for "group" and "others", this makes CUPS run the backend as root, otherwise it is run as the "lp" system user. Side effect is that no program (for example a wrapper backend) can run the backend as non-root user.
What we have to do is to run the "implicitclass" backend as root, so that it is able to run the root-only "ipp" backend. This we can simply do by installing it with the same permissions as "ipp": -rwx------. AFAIR we do this already with the "beh" backend.

[tillkamppeter]

@logTom, could you do a quick test by setting both the "ipp" and "implicitclass" backends to -rwx------ permissions and see whether this way the jobs also get printed?

[7underlines]

Yes, this does also work.

[tillkamppeter]

So I will change the install process of cups-filters to set root-mode permissions for the "implicitclass" backend.
Thank you very much.

[7underlines]

Thank you for your fast response :)

[tillkamppeter]

Fixed in commit b331924. Thank your for the report.