CUPS out of a snap: Filters and backends do not have access to system resources

[Till Kamppeter]

Hi,

I have snapped cups (listening on port 10631 to not interfere with the 
system's CUPS) and cups-filters into one single snap. The CUPS web 
interface (http://localhost:10631/) works, one can set up print queues, 
kill jobs, ...

Printing jobs also works, at least when there is no need to access 
certain resources. For example I can print a PDF file on USB-connected 
HP inkjet (CUPS running the job through separate filter executables for 
turning PDF into PCL).

What does not work is:

- Printing plain text files as the texttopdf CUPS filter is not able to 
access the systems TTF fonts.

- Printing to a printer in the local network via JetDirect port 9100 as 
th "socket" CUPS backend is not able to access the printer through its 
IP address.

cupsd has the following definition in snapcraft.yaml:

    cupsd:
      command: ./run-cupsd
      daemon: simple
      plugs: [network, network-bind]

Are the permissions which cupsd gets in the sandbox also applied to 
programs which CUPS is calling, as the mentioned filters and backends?

Any help is appreciated.

     Till