*** This bug is a security vulnerability ***
Public security bug reported:
Summary:
After the CUPS fix for CVE-2025-61915, ServerSetSettings fails when
cups-pk-helper is built with Ubuntu's run_as_cups-pk-helper.patch.
Impact:
Administrators cannot change CUPS server settings through the D-Bus helper
or desktop printer settings UI. cupsd returns HTTP 401.
Root cause:
Ubuntu runs org.opensuse.CupsPkHelper.Mechanism as the unprivileged
cups-pk-helper account. CVE-2025-61915 added PeerCred protection for
configuration PUT requests; PUT /admin/conf/cupsd.conf now accepts PeerCred
only for root.
Observed cupsd log:
User "cups-pk-helper" is not allowed to use peer credentials.
PUT /admin/conf/cupsd.conf
cupsdSendHeader: code=401
Why this is Ubuntu-specific:
Upstream cups-pk-helper runs the D-Bus mechanism as root. Ubuntu's downstream
run_as_cups-pk-helper.patch intentionally changed this to preserve CUPS job
authorization semantics for desktop users.
Proposed fix:
Keep the existing unprivileged mechanism and its Polkit checks. Add a
separate root-only D-Bus backend exposing only a server-settings operation.
The frontend forwards ServerSetSettings only after the existing
org.opensuse.cupspkhelper.mechanism.server-settings Polkit authorization.
The root backend must accept requests only from the cups-pk-helper UID and
must validate settings again before calling cupsAdminSetServerSettings.
This preserves Ubuntu's non-root handling for printer/job operations while
meeting CUPS's root-only PeerCred requirement for cupsd.conf PUT requests.
Regression test:
1. As a non-admin user, ServerSetSettings remains denied by Polkit.
2. As an authorized administrator, call ServerSetSettings with
{'_share_printers': '1'}.
3. Verify success and the corresponding cupsd.conf change.
4. Verify ordinary job operations still run through the unprivileged helper.
** Affects: cups-pk-helper (Ubuntu)
Importance: Undecided
Status: New
** Patch added: "root-server-settings-backend.patch"
https://bugs.launchpad.net/bugs/2167414/+attachment/6000486/+files/root-server-settings-backend.patch
** Information type changed from Public to Public Security
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2167414
Title:
ServerSetSettings fails after CVE-2025-61915: non-root cups-pk-helper
cannot PUT cupsd.conf
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/cups-pk-helper/+bug/2167414/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
