This and all other interface security policy is located in the snapd source. For cups-control, see: https://github.com/snapcore/snapd/blob/master/interfaces/builtin/cups_control.go
This interface primarily uses the ‘cups-client’ apparmor abstraction in /etc/apparmor.d/abstractions/cups-client.
It is understood that applications that can print need to have the corresponding interface connected that allows it. The problem is that applications that use libcups end up requiring access to the /run/cups/cups.socket. This socket allows much more than just printing though (especially on single user system where the user is in the lpadmin group), which is why the interface is set for manual connection. This topic is about adding a snap declaration to auto-connect this interface for the libreoffice snap upon install since there isn’t a way to graphically display to the user the need for connection as part of install or at runtime. I’ve already given my +1 on this, and @evan should now have enough information to vote with your new comments.
Ideally cups would offer a ‘printing-only’ socket. If this were a unix socket, we could create a new ‘cups-print’ interface to allow connecting to that socket that would be auto-connected. I suspect that the network printing you are referring to is actually printing only (unless you authenticate through the web interface) so in theory snaps would only need the ‘network’ interface (which is auto-connected) to connect to this port and print. Unfortunately, this is not enough for many applications, which is why applications like LibreOffice are plugging the cups-control interface.
