[Bug 2028172] Re: Cups-browsed cannot bind to port 631 as non-root user on Ubuntu 23.04

[Till Kamppeter]

Thanks a lot for the patch.

The run-as-user I have indeed introduced only in Ubuntu, but I plan to
apply the patch to the upstream repo so that it gets the standard
configuration, at least for classic packaging (DEB, RPM, ...). In Snap
packaging the cups-browsed.service file is not used and system daemons
always run as root (which is not as critical here due to the
encapsulation).

As we have still reports that cups-browsed in Ubuntu sometimes gets
stuck with 100% CPU we must check whether it is cused by running as user
(via debug logs).

-- 
You received this bug notification because you are a member of Ubuntu
Sponsors, which is subscribed to the bug report.
https://bugs.launchpad.net/bugs/2028172

Title:
  Cups-browsed cannot bind to port 631 as non-root user on Ubuntu 23.04

Status in cups-browsed package in Ubuntu:
  Confirmed

Bug description:
  After upgrading to Ubuntu 23.04, my laptop failed to discover our print server.
  The problem seems to have been caused by a new change in cups-browsed that was added to Ubuntu 23.04.
  I looked into it and found a small fix that seems to solve my issue.

  Using the debug configuration for cupsd and cups-browsed, I looked through the logs and noticed the following line:
  failed to bind CUPS Browsing socket: Permission denied

  After reading more about printer advertisement and cups-browsed, I concluded that the printer is shared to my Ubuntu 23.04 laptop via CUPS on port 631.
  When I connected an Ubuntu 22.04 laptop to the WIFI network, I saw the printer really was being shared with CUPS on port 631.
  Cups-browsed was running as root on 22.04 while on 23.04 it is running as a new user - cups-browsed, but this new user didn't seem to have the necessary permissions to open a listening socket on port 631.
  The solution I tried was granting the relevant binding permissions to the binary with this command (on the 23.04):
  setcap cap_net_bind_service+ep /usr/sbin/cups-browsed

  After giving the permissions, my computer successfully discovered the printer, just like it used to on 22.04!
  I think the command should be added to the post install script or maybe the capability should be granted to the new cups-browsed user.
  I posted it as an issue in the CUPS project on github. They told me to post it here because its an Ubuntu issue: https://github.com/OpenPrinting/cups-browsed/issues/17

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/cups-browsed/+bug/2028172/+subscriptions