Configure cups: `failed to validate`

[strarsis]

Describe the bug

The Configure cups task fails with: failed to validate

Playbook

---
--
- name: Additional features
  hosts: web:&{{ env }}
  become: yes
  roles:
    - { role: robertdebock.cups, tags: [printer] }

Output

TASK [robertdebock.cups : Configure cups] **************************************
fatal: [staging-2.localdomain]: FAILED! => {"changed": false, "checksum": "4bcc5dff4c0183708e300b6c69624ddbdb203991", "exit_status": 1, "msg": "failed to validate", "stderr": "", "stderr_lines": [], "stdout": "", "stdout_lines": []}

fatal: [staging-2.localdomain]: FAILED! => {
    "changed": false,
    "checksum": "4bcc5dff4c0183708e300b6c69624ddbdb203991",
    "diff": [],
    "exit_status": 1,
    "invocation": {
        "module_args": {
            "_original_basename": "cupsd.conf.j2",
            "attributes": null,
            "backup": false,
            "checksum": "4bcc5dff4c0183708e300b6c69624ddbdb203991",
            "content": null,
            "dest": "/etc/cups/cupsd.conf",
            "directory_mode": null,
            "follow": false,
            "force": true,
            "group": null,
            "local_follow": null,
            "mode": "0640",
            "owner": null,
            "remote_src": null,
            "selevel": null,
            "serole": null,
            "setype": null,
            "seuser": null,
            "src": "/home/admin/.ansible/tmp/ansible-tmp-1695691360.9995403-26245-83999800941144/source",
            "unsafe_writes": false,
            "validate": "cupsd -t -c %s"
        }
    },
    "msg": "failed to validate",
    "stderr": "",
    "stderr_lines": [],
    "stdout": "",
    "stdout_lines": []
}

Environment

• Control node OS: Ubuntu 22.04.3 LTS
• Control node Ansible version: ansible [core 2.15.0]
• Managed node OS: Ubuntu 20.04.5 LTS

[strarsis]

This is the generated file that is passed to cupsd -t -c for validation (which fails validation with non-zero exit code):

#
# Ansible managed
#

MaxLogSize 0
#
# Configuration file for the CUPS scheduler.  See "man cupsd.conf" for a
# complete description of this file.
#

# Log general information in error_log - change "warn" to "debug"
# for troubleshooting...
LogLevel warn

# PreserveJobHistory specifies whether metadata is preserved after a job is
# printed.
PreserveJobHistory Yes

# Only listen for connections from the local machine.
ServerAlias *
Listen localhost:631
Listen /run/cups/cups.sock

# Show shared printers on the local network.
Browsing Off
BrowseLocalProtocols dnssd

# Default authentication type, when authentication is required...
DefaultAuthType Basic

# Web interface setting...
WebInterface Yes

# Restrict access to the server...
<Location />
  Order allow,deny
  Allow @LOCAL
</Location>

<Location /admin>
  Order allow,deny
  Allow @LOCAL
</Location>

<Location /admin/conf>
  Order allow,deny
  AuthType Default
  require user @SYSTEM
  Allow @LOCAL
</Location>

<Location /admin/log>
  Order allow,deny
  AuthType Default
  require user @SYSTEM
</Location>


# Set the default printer/job policies...
<Policy default>
  # Job/subscription privacy...
  JobPrivateAccess default
  JobPrivateValues default
  SubscriptionPrivateAccess default
  SubscriptionPrivateValues default

  # Job-related operations must be done by the owner or an administrator...
  <Limit Create-Job Print-Job Print-URI Validate-Job>
    Order deny,allow
  </Limit>

  <Limit Send-Document Send-URI Hold-Job Release-Job Restart-Job Purge-Jobs Set-Job-Attributes Create-Job-Subscription Renew-Subscription Cancel-Subscription Get-Notifications Reprocess-Job Cancel-Current-Job Suspend-Current-Job Resume-Job Cancel-My-Jobs Close-Job CUPS-Move-Job CUPS-Get-Document>
    Require user @OWNER @SYSTEM
    Order deny,allow
  </Limit>

  # All administration operations require an administrator to authenticate...
  <Limit CUPS-Add-Modify-Printer CUPS-Delete-Printer CUPS-Add-Modify-Class CUPS-Delete-Class CUPS-Set-Default CUPS-Get-Devices>
    AuthType Default
    Require user @SYSTEM
    Order deny,allow
  </Limit>

  # All printer operations require a printer operator to authenticate...
  <Limit Pause-Printer Resume-Printer Enable-Printer Disable-Printer Pause-Printer-After-Current-Job Hold-New-Jobs Release-Held-New-Jobs Deactivate-Printer Activate-Printer Restart-Printer Shutdown-Printer Startup-Printer Promote-Job Schedule-Job-After Cancel-Jobs CUPS-Accept-Jobs CUPS-Reject-Jobs>
    AuthType Default
    Require user @SYSTEM
    Order deny,allow
  </Limit>

  # Only the owner or an administrator can cancel or authenticate a job...
  <Limit Cancel-Job CUPS-Authenticate-Job>
    Require user @OWNER @SYSTEM
    Order deny,allow
  </Limit>

  <Limit All>
    Order deny,allow
  </Limit>
</Policy>

# Set the authenticated printer/job policies...
<Policy authenticated>
  # Job/subscription privacy...
  JobPrivateAccess default
  JobPrivateValues default
  SubscriptionPrivateAccess default
  SubscriptionPrivateValues default

  # Job-related operations must be done by the owner or an administrator...
  <Limit Create-Job Print-Job Print-URI Validate-Job>
    AuthType Default
    Order deny,allow
  </Limit>

  <Limit Send-Document Send-URI Hold-Job Release-Job Restart-Job Purge-Jobs Set-Job-Attributes Create-Job-Subscription Renew-Subscription Cancel-Subscription Get-Notifications Reprocess-Job Cancel-Current-Job Suspend-Current-Job Resume-Job Cancel-My-Jobs Close-Job CUPS-Move-Job CUPS-Get-Document>
    AuthType Default
    Require user @OWNER @SYSTEM
    Order deny,allow
  </Limit>

  # All administration operations require an administrator to authenticate...
  <Limit CUPS-Add-Modify-Printer CUPS-Delete-Printer CUPS-Add-Modify-Class CUPS-Delete-Class CUPS-Set-Default>
    AuthType Default
    Require user @SYSTEM
    Order deny,allow
  </Limit>

  # All printer operations require a printer operator to authenticate...
  <Limit Pause-Printer Resume-Printer Enable-Printer Disable-Printer Pause-Printer-After-Current-Job Hold-New-Jobs Release-Held-New-Jobs Deactivate-Printer Activate-Printer Restart-Printer Shutdown-Printer Startup-Printer Promote-Job Schedule-Job-After Cancel-Jobs CUPS-Accept-Jobs CUPS-Reject-Jobs>
    AuthType Default
    Require user @SYSTEM
    Order deny,allow
  </Limit>

  # Only the owner or an administrator can cancel or authenticate a job...
  <Limit Cancel-Job CUPS-Authenticate-Job>
    AuthType Default
    Require user @OWNER @SYSTEM
    Order deny,allow
  </Limit>

  <Limit All>
    Order deny,allow
  </Limit>
</Policy>

# Set the kerberized printer/job policies...
<Policy kerberos>
  # Job/subscription privacy...
  JobPrivateAccess default
  JobPrivateValues default
  SubscriptionPrivateAccess default
  SubscriptionPrivateValues default

  # Job-related operations must be done by the owner or an administrator...
  <Limit Create-Job Print-Job Print-URI Validate-Job>
    AuthType Negotiate
    Order deny,allow
  </Limit>

  <Limit Send-Document Send-URI Hold-Job Release-Job Restart-Job Purge-Jobs Set-Job-Attributes Create-Job-Subscription Renew-Subscription Cancel-Subscription Get-Notifications Reprocess-Job Cancel-Current-Job Suspend-Current-Job Resume-Job Cancel-My-Jobs Close-Job CUPS-Move-Job CUPS-Get-Document>
    AuthType Negotiate
    Require user @OWNER @SYSTEM
    Order deny,allow
  </Limit>

  # All administration operations require an administrator to authenticate...
  <Limit CUPS-Add-Modify-Printer CUPS-Delete-Printer CUPS-Add-Modify-Class CUPS-Delete-Class CUPS-Set-Default>
    AuthType Default
    Require user @SYSTEM
    Order deny,allow
  </Limit>

  # All printer operations require a printer operator to authenticate...
  <Limit Pause-Printer Resume-Printer Enable-Printer Disable-Printer Pause-Printer-After-Current-Job Hold-New-Jobs Release-Held-New-Jobs Deactivate-Printer Activate-Printer Restart-Printer Shutdown-Printer Startup-Printer Promote-Job Schedule-Job-After Cancel-Jobs CUPS-Accept-Jobs CUPS-Reject-Jobs>
    AuthType Default
    Require user @SYSTEM
    Order deny,allow
  </Limit>

  # Only the owner or an administrator can cancel or authenticate a job...
  <Limit Cancel-Job CUPS-Authenticate-Job>
    AuthType Negotiate
    Require user @OWNER @SYSTEM
    Order deny,allow
  </Limit>

  <Limit All>
    Order deny,allow
  </Limit>
</Policy>

This cups configuration is correct.
When I copy the temporary file created by ansible to /etc/cups the configuration test actually works!
cupsd -t -c /etc/cups/cupsd.conf.ansible

"/etc/cups/cups-files.conf" is OK.
"/etc/cups/cupsd.conf" is OK.

(Exit code 0)

So cups does not like the given configuration file being outside of the usual directory,
hence it fails the configuration test right at the start.

[strarsis]

Related:
ansible/ansible#19232
ansible/ansible#19243

[robertdebock]

Let me check, thanks for the notification.

[robertdebock]

When I place a working config in /tmp:

cupsd -t -c /tmp/cupsd.conf 
"/tmp/cups-files.conf" is OK.
"/tmp/cupsd.conf" is OK.

Especially /tmp/cups-files.conf does not exist. This role does not place it.

Maybe a validate command that also point so /etc/cups/cups-files.confascupsd -t -s /etc/cups/cups-files.conf -c %s` works better. Let me try.

By the way; I can't reproduce the issue. Can you past the variables fed to the role by your playbook/inventory/(group|host)_vars?

[strarsis]

@robertdebock: Maybe this is an ansible version thing? The temporary file is shown when running ansible in verbose mode.
The issue is that ansible uses the path to the temporary file in validate.
I am using the variables that are shown in the README.

Edit: I also tried this on Ubuntu 22.04 LTS (minimal server installation), with the same issue.

[robertdebock]

Hm, the versions of Ansible. That sounds like a good lead.

I'm currently testing on Ansible 6, 7 & 8:

tox.ini:

    ansible6: ansible == 6.*
    ansible7: ansible == 7.*
    ansible8: ansible == 8.*

You're using Ansible-core 2.15.0, pretty recent.

And since you're using the default variable values, that's also what I'm testing. In other words, can't reproduce, so let's figure out what the differences are.

I'm not sure where to begin finding the difference between your setup and mine as you've explained all the details already.

I've added that cups-files.conf in the last push and converted some variables into booleans. (Was: "Yes", is yes).

[robertdebock]

Please try 3.0.0. Be are, some variables have changed type. Were string, are boolean.

[strarsis]

@robertdebock: I provisioned with 3.0.0, but the error persists.

Ubuntu 22.04 LTS Server minimal base is the system used for this.
It appears that the cups package has additional permission checks built in for the config file validation?
(Side note: I use become: yes for root user, as otherwise Configure cups would fail with Destination /etc/cups not writable.)

[robertdebock]

That could be a lead; permissions on the (temporary) files. Let me work that out. Thanks for getting back!

[strarsis]

Some testing on the system:
On Ubuntu LTS 22.04 LTS server minimal base system:

1. Create file with valid cupsd configuration as ansible would under /home/admin/.ansible/tmp/ansible-tmp-1696464574.0848813-31244-201540201837497/source.
2. Validate that file with the command ansible would use: cupsd -t -s /etc/cups/cups-files.conf -c /home/admin/.ansible/tmp/ansible-tmp-1696464574.0848813-31244-201540201837497/source
   Note that exit status is non-zero (1) and no success messages are printed.
3. Move that file into /etc and repeat the validation command.
   Note that validation still fails.
4. Move that file into /etc/cups - file name does not matter, it can still be just source, and repeat validation command.
   Note that validation now passes with zero exit status and success messages.

The actual validation code (upstream) for cups 2.4.1 (as used by Ubuntu 22.04 LTS ("jammy")):
https://github.com/OpenPrinting/cups/blob/v2.4.1/scheduler/main.c#L549

The validation code uses the return value from a general function for loading configuration files:
https://github.com/OpenPrinting/cups/blob/v2.4.1/scheduler/conf.c
As this function is apparently primarily used by cupsd daemon, error details during load are logged and not printed.

And finally, the syslog logs the following on a failed validation attempt (where the configuration file is outside of /etc/cups):

[...] audit[1964]: AVC apparmor="DENIED" operation="open" profile="/usr/sbin/cupsd" name="/tmp/source" pid=1964 comm="cupsd" requested_mask="r" denied_mask="r" fsuid=0 ouid=1002
[...]  cupsd[1964]: Unable to open "/tmp/source" - Permission denied
[...]  kernel: audit: type=1400 audit(1696465133.482:33): apparmor="DENIED" operation="open" profile="/usr/sbin/cupsd" name="/tmp/source" pid=1964 comm="cupsd" requested_mask="r" denied_mask="r" fsuid=0 ouid=1002

So apparmor denies cupsd access to files outside of /etc/cups.
On Ubuntu 22.04 LTS apparmor is installed and enabled by default.

After disabling apparmor (on a test system), the Configure cups step works, so apparmor was indeed the reason for this.
As apparmor should still be used, including cupsd, the challenge is to get around this issue with ansible template validation.

Discussion related to appamor blocking ansible template validation:

• https://www.reddit.com/r/ansible/comments/590201/template_validation_blocked_by_apparmor/
• https://www.mail-archive.com/apparmor@lists.ubuntu.com/msg10564.html

[robertdebock]

Super, that's good information and I am able to reproduce the issue now. Let me think of a solution. What comes up now:

• Disable Apparmor, configure cups, enable Apparmor
• Change the Apparmor profile for cups
• Don't validate.