CUPS backends and filters do not recognize supplementary groups
Issue
We are running CUPS backends with a non-root user that is also not the default lp user. In /etc/cups/cupsd.conf, we have configured CUPS backends to run with a non-root user/group:
User lpfna
Group gpfna
lpfna belongs to a few groups among them gpfna:
$ id lpfna
uid=85825(lpfna) gid=1962(gpfna) groups=1962(gpfna),1359(gpfsa),1541(gpfra),2616(gpfma),1963(gpfra),1971(gpfqa)
However, when CUPS backend script /usr/lib/cups/backend/batch runs with lpfna user, all those user groups are not recognized. If we run the command id inside the backend script, we only get the following:
uid=85825(lpfna) gid=1962(gpfna) groups=1962(gpfna) context=unconfined_u:unconfined_r:unconfined_t:s0
This makes the backend fail when trying to access some resources belonging groups like gpfma, gpfsa, etc.
Environment
- Red Hat Enterprise Linux (RHEL)
- Common Unix Printing System (CUPS)
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.