Clean up temporary directories by the run-cupsd script

CUPS cleans up its temporary directory right after starting, but it
does a simple recursive deletion of all files and directories as root,
which works fine in a classic installation of CUPS.

In the Snap CUPS has no CAP_DAC_OVERRIDE capability and so has to obey
the permissions and ownerships of each file or directory it removes,
even as root. Therefore we already clean in the run-cupsd script but
with an enhanced algorithm, doing recursive chown to root, recursive
chmod for the owner (now root) be have full access and the we
recursively delete the temporary directory. As sometimes the recursive
chown does reach the full depth due to file permissions we repeat this
sequence to get deepr with chown after a recursive chmod, until we
reach the end and succeed to delete the whole directory.

We also initialize new temp directories after that and set correct
ownerships and permissions.

After that CUPS does not need to clean up any more and so does not
cause any DENIED syslog messages on the CAP_DAC_OVERRIDE/dac_override
capability.

scripts/run-cupsd

@@ -15,10 +15,32 @@ mkdir -p $SNAP_COMMON/run
 export LC_ALL=C.UTF-8
 export LANG=C.UTF-8
 
-# Set a general TMPDIR
+# Set a general TMPDIR (for command line utilities)
 export TMPDIR=$SNAP_DATA/tmp
 mkdir -p $TMPDIR
 
+# The CUPS temp dir (for cupsd, filters, backends, CGI programs, ...)
+CUPSTMPDIR=$SNAP_DATA/var/spool/tmp
+
+# Clean up the temporary directories
+# We need to chown all files to root and make the files and directories
+# accessible for root, otherwise we cannot delete them inside a Snap
+for DIR in $TMPDIR $CUPSTMPDIR; do
+    while [ -d $DIR ]; do
+	chown -R root.root $DIR
+	chmod -R u+rwX $DIR
+	rm -rf $DIR
+    done
+done
+
+# Initialize the temp directories
+mkdir -p $TMPDIR
+chown -R root.root $TMPDIR
+chmod -R 1777 $TMPDIR
+mkdir -p $CUPSTMPDIR
+chown -R root.snap_daemon $CUPSTMPDIR
+chmod -R 1770 $CUPSTMPDIR
+
 # Activate full debug logging of cupsd and libcups
 # (Needs "- --enable-debug-printfs" be uncommented in CUPS' configflags
 #  in snapcraft.yaml)