Snapping CUPS Printing Stack: Avahi support, system users/groups

[ondra]

@till.kamppeter ups sorry does bot look like it’s yet in edge, but should be by tomorrow

[ondra]

@till.kamppeter new interface is now in edge, and new avahi is under manual review, once it’s passed, I will release it to edge

[jdstrand]

FYI, this is done now (I was waiting for a store pull for a newer review tools, which is why it took a little longer than usual).

[till.kamppeter]

Thanks.
I am trying it out now. What do I need to add to snapcraft.yaml that my CUPS package automatically connects to the interfaces of avahi? I need to connect to discover network printers advertised via Avahi and I also want to advertise printers via Avahi so that other machines discover them.
I also want that when installing the CUPS snaps all interface connections, including Avahi are done automatically.

[jdstrand]

You don’t need to do anything in your snapcraft.yaml beyond declaring the plugs and slots you want to use. When you have a snap in the store, you can request interfaces be auto-connected by following the process outlined in Process for reviewing aliases, auto-connections and track requests

[till.kamppeter]

The state of the art of my CUPS snap is always here:

git clone git@github.com:OpenPrinting/printing-stack-snap.git

I have taken the stable Core Snap on a Virtual Machine Manager VM (libvirt/QEMU), upgraded it to Edge and installed the Edge version of the Avahi Snap into it. Then I clean-built the CUPS snap based on said GIT repo, scp-ed it into the Ubuntu Core virtual machine, and installed it. Installation worked, cupsd and cups-browsed are running, and I can access with CUPS’ command line tools.
What does not work is Avahi, in the Core VM I do not see the printers of my host machine.
@ondra, can you have a look what is going wrong here?

[ondra]

hi @till.kamppeter
to be honest I’m not expert on avahi, I just snapped it and wrote interfaces.
I’d suggest to repeat same testing with classic + classic avahi and see if that works. If that does work, then we can focus on where snap confinement is breaking it.
Also are you sure this VM setup is supposed to work? From my experience it’s depends on network rules how well mdns works on given network.

[till.kamppeter]

I have now tried to install the snap on a classic system. For that I have used the snap as it is on the GitHub, changed the port in default.yaml to 10631 (so that the snap’s CUPS runs in parallel with the system’s CUPS, this worked formerly) and in snapcraft.yaml I removed daemon-dbus, avahi-observe, avahi-control from all the plugs; ... lines of all the apps: as the appropriate slots are not available on the classic system.

I can build and install the snap without problems, but cupsd and cups-browsed are not starting. /var/log/syslog shows the following:

Oct 26 10:41:37 till-x1carbon systemd[1]: Reloading.
Oct 26 10:41:37 till-x1carbon systemd[1]: Mounting Mount unit for cups...
Oct 26 10:41:37 till-x1carbon systemd[1]: Mounted Mount unit for cups.
Oct 26 10:41:37 till-x1carbon kernel: [ 2676.929194] audit: type=1400 audit(1509021697.696:150): apparmor="STATUS" operation="profile_replace" info="same as current profile, skipping" profile="unconfined" name="snap.cups.cups-browsed" pid=1807 comm="apparmor_parser"
Oct 26 10:41:37 till-x1carbon kernel: [ 2677.003170] audit: type=1400 audit(1509021697.770:151): apparmor="STATUS" operation="profile_replace" info="same as current profile, skipping" profile="unconfined" name="snap.cups.cupsd" pid=1809 comm="apparmor_parser"
Oct 26 10:41:37 till-x1carbon kernel: [ 2677.074978] audit: type=1400 audit(1509021697.842:152): apparmor="STATUS" operation="profile_replace" info="same as current profile, skipping" profile="unconfined" name="snap.cups.lp" pid=1811 comm="apparmor_parser"
Oct 26 10:41:37 till-x1carbon kernel: [ 2677.153521] audit: type=1400 audit(1509021697.920:153): apparmor="STATUS" operation="profile_replace" info="same as current profile, skipping" profile="unconfined" name="snap.cups.lpadmin" pid=1813 comm="apparmor_parser"
Oct 26 10:41:37 till-x1carbon kernel: [ 2677.229418] audit: type=1400 audit(1509021697.996:154): apparmor="STATUS" operation="profile_replace" info="same as current profile, skipping" profile="unconfined" name="snap.cups.lpinfo" pid=1815 comm="apparmor_parser"
Oct 26 10:41:38 till-x1carbon kernel: [ 2677.319463] audit: type=1400 audit(1509021698.086:155): apparmor="STATUS" operation="profile_replace" info="same as current profile, skipping" profile="unconfined" name="snap.cups.lpoptions" pid=1817 comm="apparmor_parser"
Oct 26 10:41:38 till-x1carbon kernel: [ 2677.394621] audit: type=1400 audit(1509021698.161:156): apparmor="STATUS" operation="profile_replace" info="same as current profile, skipping" profile="unconfined" name="snap.cups.lpstat" pid=1820 comm="apparmor_parser"
Oct 26 10:41:38 till-x1carbon snapd[983]: 2017/10/26 10:41:38.217609 cmd.go:133: exe doesn't have snap mount dir prefix: "/usr/lib/snapd/snapd" vs "/snap"
Oct 26 10:41:38 till-x1carbon kernel: [ 2677.448660] audit: type=1400 audit(1509021698.214:157): apparmor="STATUS" operation="profile_load" profile="unconfined" name="snap.cups.mutool" pid=1822 comm="apparmor_parser"
Oct 26 10:41:38 till-x1carbon kernel: [ 2677.750710] audit: type=1400 audit(1509021698.516:158): apparmor="STATUS" operation="profile_replace" info="same as current profile, skipping" profile="unconfined" name="/snap/core/3247/usr/lib/snapd/snap-confine" pid=1869 comm="apparmor_parser"
Oct 26 10:41:38 till-x1carbon kernel: [ 2677.750888] audit: type=1400 audit(1509021698.516:159): apparmor="STATUS" operation="profile_replace" info="same as current profile, skipping" profile="unconfined" name="/snap/core/3247/usr/lib/snapd/snap-confine//mount-namespace-capture-helper" pid=1869 comm="apparmor_parser"
Oct 26 10:41:38 till-x1carbon systemd[1]: Reloading.
Oct 26 10:41:38 till-x1carbon systemd[1]: Started Service for snap application cups.cups-browsed.
Oct 26 10:41:38 till-x1carbon systemd[1]: Started Service for snap application cups.cupsd.
Oct 26 10:41:39 till-x1carbon cups.cupsd[1914]: perl: /lib/x86_64-linux-gnu/libc.so.6: version `GLIBC_2.25' not found (required by /snap/cups/x1/lib/x86_64-linux-gnu/libcrypt.so.1)
Oct 26 10:41:39 till-x1carbon cups.cupsd[1914]: message repeated 3 times: [ perl: /lib/x86_64-linux-gnu/libc.so.6: version `GLIBC_2.25' not found (required by /snap/cups/x1/lib/x86_64-linux-gnu/libcrypt.so.1)]
Oct 26 10:41:39 till-x1carbon systemd[1]: snap.cups.cupsd.service: Main process exited, code=exited, status=1/FAILURE
Oct 26 10:41:39 till-x1carbon systemd[1]: snap.cups.cupsd.service: Unit entered failed state.
Oct 26 10:41:39 till-x1carbon systemd[1]: snap.cups.cupsd.service: Failed with result 'exit-code'.
Oct 26 10:41:39 till-x1carbon cups.cups-browsed[1901]: /snap/cups/x1/usr/sbin/cups-browsed: /lib/x86_64-linux-gnu/libc.so.6: version `GLIBC_2.25' not found (required by /snap/cups/x1/lib/x86_64-linux-gnu/libcrypt.so.1)
Oct 26 10:41:39 till-x1carbon cups.cups-browsed[1901]: /snap/cups/x1/usr/sbin/cups-browsed: /lib/x86_64-linux-gnu/libc.so.6: version `GLIBC_2.25' not found (required by /snap/cups/x1/lib/x86_64-linux-gnu/libsystemd.so.0)
Oct 26 10:41:39 till-x1carbon systemd[1]: snap.cups.cups-browsed.service: Main process exited, code=exited, status=1/FAILURE
Oct 26 10:41:39 till-x1carbon systemd[1]: snap.cups.cups-browsed.service: Unit entered failed state.
Oct 26 10:41:39 till-x1carbon systemd[1]: snap.cups.cups-browsed.service: Failed with result 'exit-code'.
Oct 26 10:41:39 till-x1carbon systemd[1]: snap.cups.cupsd.service: Service hold-off time over, scheduling restart.
Oct 26 10:41:39 till-x1carbon systemd[1]: Stopped Service for snap application cups.cupsd.
Oct 26 10:41:39 till-x1carbon systemd[1]: Started Service for snap application cups.cupsd.
Oct 26 10:41:39 till-x1carbon cups.cupsd[1991]: perl: /lib/x86_64-linux-gnu/libc.so.6: version `GLIBC_2.25' not found (required by /snap/cups/x1/lib/x86_64-linux-gnu/libcrypt.so.1)
Oct 26 10:41:39 till-x1carbon cups.cupsd[1991]: message repeated 3 times: [ perl: /lib/x86_64-linux-gnu/libc.so.6: version `GLIBC_2.25' not found (required by /snap/cups/x1/lib/x86_64-linux-gnu/libcrypt.so.1)]
Oct 26 10:41:39 till-x1carbon systemd[1]: snap.cups.cupsd.service: Main process exited, code=exited, status=1/FAILURE
Oct 26 10:41:39 till-x1carbon systemd[1]: snap.cups.cupsd.service: Unit entered failed state.
Oct 26 10:41:39 till-x1carbon systemd[1]: snap.cups.cupsd.service: Failed with result 'exit-code'.
Oct 26 10:41:39 till-x1carbon systemd[1]: snap.cups.cups-browsed.service: Service hold-off time over, scheduling restart.
Oct 26 10:41:39 till-x1carbon systemd[1]: snap.cups.cupsd.service: Service hold-off time over, scheduling restart.
Oct 26 10:41:39 till-x1carbon systemd[1]: Stopped Service for snap application cups.cupsd.
Oct 26 10:41:39 till-x1carbon systemd[1]: Started Service for snap application cups.cupsd.
Oct 26 10:41:39 till-x1carbon systemd[1]: Stopped Service for snap application cups.cups-browsed.
Oct 26 10:41:39 till-x1carbon systemd[1]: Started Service for snap application cups.cups-browsed.
Oct 26 10:41:39 till-x1carbon cups.cupsd[2047]: perl: /lib/x86_64-linux-gnu/libc.so.6: version `GLIBC_2.25' not found (required by /snap/cups/x1/lib/x86_64-linux-gnu/libcrypt.so.1)
Oct 26 10:41:39 till-x1carbon cups.cupsd[2047]: message repeated 3 times: [ perl: /lib/x86_64-linux-gnu/libc.so.6: version `GLIBC_2.25' not found (required by /snap/cups/x1/lib/x86_64-linux-gnu/libcrypt.so.1)]
Oct 26 10:41:39 till-x1carbon cups.cups-browsed[2051]: /snap/cups/x1/usr/sbin/cups-browsed: /lib/x86_64-linux-gnu/libc.so.6: version `GLIBC_2.25' not found (required by /snap/cups/x1/lib/x86_64-linux-gnu/libcrypt.so.1)
Oct 26 10:41:39 till-x1carbon systemd[1]: snap.cups.cupsd.service: Main process exited, code=exited, status=1/FAILURE
Oct 26 10:41:39 till-x1carbon systemd[1]: snap.cups.cupsd.service: Unit entered failed state.
Oct 26 10:41:39 till-x1carbon systemd[1]: snap.cups.cupsd.service: Failed with result 'exit-code'.
Oct 26 10:41:39 till-x1carbon cups.cups-browsed[2051]: /snap/cups/x1/usr/sbin/cups-browsed: /lib/x86_64-linux-gnu/libc.so.6: version `GLIBC_2.25' not found (required by /snap/cups/x1/lib/x86_64-linux-gnu/libsystemd.so.0)
Oct 26 10:41:39 till-x1carbon systemd[1]: snap.cups.cups-browsed.service: Main process exited, code=exited, status=1/FAILURE
Oct 26 10:41:39 till-x1carbon systemd[1]: snap.cups.cups-browsed.service: Unit entered failed state.
Oct 26 10:41:39 till-x1carbon systemd[1]: snap.cups.cups-browsed.service: Failed with result 'exit-code'.
Oct 26 10:41:40 till-x1carbon systemd[1]: snap.cups.cupsd.service: Service hold-off time over, scheduling restart.
Oct 26 10:41:40 till-x1carbon systemd[1]: snap.cups.cups-browsed.service: Service hold-off time over, scheduling restart.
Oct 26 10:41:40 till-x1carbon systemd[1]: Stopped Service for snap application cups.cups-browsed.
Oct 26 10:41:40 till-x1carbon systemd[1]: Started Service for snap application cups.cups-browsed.
Oct 26 10:41:40 till-x1carbon systemd[1]: Stopped Service for snap application cups.cupsd.
Oct 26 10:41:40 till-x1carbon systemd[1]: Started Service for snap application cups.cupsd.
Oct 26 10:41:40 till-x1carbon cups.cupsd[2123]: perl: /lib/x86_64-linux-gnu/libc.so.6: version `GLIBC_2.25' not found (required by /snap/cups/x1/lib/x86_64-linux-gnu/libcrypt.so.1)
Oct 26 10:41:40 till-x1carbon cups.cupsd[2123]: message repeated 2 times: [ perl: /lib/x86_64-linux-gnu/libc.so.6: version `GLIBC_2.25' not found (required by /snap/cups/x1/lib/x86_64-linux-gnu/libcrypt.so.1)]
Oct 26 10:41:40 till-x1carbon cups.cups-browsed[2122]: /snap/cups/x1/usr/sbin/cups-browsed: /lib/x86_64-linux-gnu/libc.so.6: version `GLIBC_2.25' not found (required by /snap/cups/x1/lib/x86_64-linux-gnu/libcrypt.so.1)
Oct 26 10:41:40 till-x1carbon cups.cups-browsed[2122]: /snap/cups/x1/usr/sbin/cups-browsed: /lib/x86_64-linux-gnu/libc.so.6: version `GLIBC_2.25' not found (required by /snap/cups/x1/lib/x86_64-linux-gnu/libsystemd.so.0)
Oct 26 10:41:40 till-x1carbon cups.cupsd[2123]: perl: /lib/x86_64-linux-gnu/libc.so.6: version `GLIBC_2.25' not found (required by /snap/cups/x1/lib/x86_64-linux-gnu/libcrypt.so.1)
Oct 26 10:41:40 till-x1carbon systemd[1]: snap.cups.cups-browsed.service: Main process exited, code=exited, status=1/FAILURE
Oct 26 10:41:40 till-x1carbon systemd[1]: snap.cups.cups-browsed.service: Unit entered failed state.
Oct 26 10:41:40 till-x1carbon systemd[1]: snap.cups.cups-browsed.service: Failed with result 'exit-code'.
Oct 26 10:41:40 till-x1carbon systemd[1]: snap.cups.cupsd.service: Main process exited, code=exited, status=1/FAILURE
Oct 26 10:41:40 till-x1carbon systemd[1]: snap.cups.cupsd.service: Unit entered failed state.
Oct 26 10:41:40 till-x1carbon systemd[1]: snap.cups.cupsd.service: Failed with result 'exit-code'.
Oct 26 10:41:40 till-x1carbon systemd[1]: snap.cups.cups-browsed.service: Service hold-off time over, scheduling restart.
Oct 26 10:41:40 till-x1carbon systemd[1]: snap.cups.cupsd.service: Service hold-off time over, scheduling restart.
Oct 26 10:41:40 till-x1carbon systemd[1]: Stopped Service for snap application cups.cupsd.
Oct 26 10:41:40 till-x1carbon systemd[1]: Started Service for snap application cups.cupsd.
Oct 26 10:41:40 till-x1carbon systemd[1]: Stopped Service for snap application cups.cups-browsed.
Oct 26 10:41:40 till-x1carbon systemd[1]: Started Service for snap application cups.cups-browsed.
Oct 26 10:41:40 till-x1carbon cups.cupsd[2197]: perl: /lib/x86_64-linux-gnu/libc.so.6: version `GLIBC_2.25' not found (required by /snap/cups/x1/lib/x86_64-linux-gnu/libcrypt.so.1)
Oct 26 10:41:40 till-x1carbon cups.cupsd[2197]: message repeated 3 times: [ perl: /lib/x86_64-linux-gnu/libc.so.6: version `GLIBC_2.25' not found (required by /snap/cups/x1/lib/x86_64-linux-gnu/libcrypt.so.1)]
Oct 26 10:41:40 till-x1carbon systemd[1]: snap.cups.cupsd.service: Main process exited, code=exited, status=1/FAILURE
Oct 26 10:41:40 till-x1carbon systemd[1]: snap.cups.cupsd.service: Unit entered failed state.
Oct 26 10:41:40 till-x1carbon systemd[1]: snap.cups.cupsd.service: Failed with result 'exit-code'.
Oct 26 10:41:40 till-x1carbon cups.cups-browsed[2198]: /snap/cups/x1/usr/sbin/cups-browsed: /lib/x86_64-linux-gnu/libc.so.6: version `GLIBC_2.25' not found (required by /snap/cups/x1/lib/x86_64-linux-gnu/libcrypt.so.1)
Oct 26 10:41:40 till-x1carbon cups.cups-browsed[2198]: /snap/cups/x1/usr/sbin/cups-browsed: /lib/x86_64-linux-gnu/libc.so.6: version `GLIBC_2.25' not found (required by /snap/cups/x1/lib/x86_64-linux-gnu/libsystemd.so.0)
Oct 26 10:41:40 till-x1carbon systemd[1]: snap.cups.cups-browsed.service: Main process exited, code=exited, status=1/FAILURE
Oct 26 10:41:40 till-x1carbon systemd[1]: snap.cups.cups-browsed.service: Unit entered failed state.
Oct 26 10:41:40 till-x1carbon systemd[1]: snap.cups.cups-browsed.service: Failed with result 'exit-code'.
Oct 26 10:41:40 till-x1carbon systemd[1]: snap.cups.cupsd.service: Service hold-off time over, scheduling restart.
Oct 26 10:41:40 till-x1carbon systemd[1]: snap.cups.cups-browsed.service: Service hold-off time over, scheduling restart.
Oct 26 10:41:40 till-x1carbon systemd[1]: Stopped Service for snap application cups.cups-browsed.
Oct 26 10:41:40 till-x1carbon systemd[1]: Started Service for snap application cups.cups-browsed.
Oct 26 10:41:40 till-x1carbon systemd[1]: Stopped Service for snap application cups.cupsd.
Oct 26 10:41:40 till-x1carbon systemd[1]: snap.cups.cupsd.service: Start request repeated too quickly.
Oct 26 10:41:40 till-x1carbon systemd[1]: Failed to start Service for snap application cups.cupsd.
Oct 26 10:41:40 till-x1carbon systemd[1]: snap.cups.cupsd.service: Unit entered failed state.
Oct 26 10:41:40 till-x1carbon systemd[1]: snap.cups.cupsd.service: Failed with result 'exit-code'.
Oct 26 10:41:40 till-x1carbon cups.cups-browsed[2262]: /snap/cups/x1/usr/sbin/cups-browsed: /lib/x86_64-linux-gnu/libc.so.6: version `GLIBC_2.25' not found (required by /snap/cups/x1/lib/x86_64-linux-gnu/libcrypt.so.1)
Oct 26 10:41:40 till-x1carbon cups.cups-browsed[2262]: /snap/cups/x1/usr/sbin/cups-browsed: /lib/x86_64-linux-gnu/libc.so.6: version `GLIBC_2.25' not found (required by /snap/cups/x1/lib/x86_64-linux-gnu/libsystemd.so.0)
Oct 26 10:41:40 till-x1carbon systemd[1]: snap.cups.cups-browsed.service: Main process exited, code=exited, status=1/FAILURE
Oct 26 10:41:40 till-x1carbon systemd[1]: snap.cups.cups-browsed.service: Unit entered failed state.
Oct 26 10:41:40 till-x1carbon systemd[1]: snap.cups.cups-browsed.service: Failed with result 'exit-code'.
Oct 26 10:41:40 till-x1carbon systemd[1]: snap.cups.cups-browsed.service: Service hold-off time over, scheduling restart.
Oct 26 10:41:40 till-x1carbon systemd[1]: Stopped Service for snap application cups.cups-browsed.
Oct 26 10:41:40 till-x1carbon systemd[1]: snap.cups.cups-browsed.service: Start request repeated too quickly.
Oct 26 10:41:40 till-x1carbon systemd[1]: Failed to start Service for snap application cups.cups-browsed.
Oct 26 10:41:40 till-x1carbon systemd[1]: snap.cups.cups-browsed.service: Unit entered failed state.
Oct 26 10:41:40 till-x1carbon systemd[1]: snap.cups.cups-browsed.service: Failed with result 'exit-code'.

Problem seems to be these messages with versionGLIBC_2.25’ not found`. Is this known? What can be wrong here?

[till.kamppeter]

Note also that I did not start to confine yet. My confinement is still devmode. At first I want to get it to work at all.

[ondra]

few things
first on classic avahi-observe and avahi-control are both provided by core snap as desktop system would have avahi preinstalled. If you are using server version there is no avahi preinstalled so you can either install it from deb or you can install snap version.
Now to your app problem:
perl: /lib/x86_64-linux-gnu/libc.so.6: version GLIBC_2.25 not found (required by /snap/cups/x1/lib/x86_64-linux-gnu/libcrypt.so.1)
this line is key, what you are you building on? Core snap is based on 16.04 which has glibc-2.23
Try to recompile your snap on system with glibc-2.23, so you link against correct version.
Does not look like avahi related problem at all. But let’s see

[ogra]

Try to recompile your snap on system with glibc-2.23,

You should always use “snapcraft cleanbuild” and have it use a container, to make sure the right system libs get included …

[till.kamppeter]

@ondra, @ogra, thank you very much, I did a cleanbuild now and have the two daemons (cupsd, cups-browsed) running (on port 10631 to not interfere with the system’s daemons. But Avahi is still not working, as otherwise the snap’s cups-browsed would pick up the system’s (CUPS on port 631) shared printers and make them available on the snap’s CUPS (port 10631).

[till.kamppeter]

The missing “lpadmin” group can be replaced by the always present “adm” group of the system. I simply build with

./configure --with-system-groups='sys adm root'
make

and then users in the “adm” group can do administrative tasks as creating a queue with the lpadmin command or logging into the admin part of the CUPS web interface. At least in a classic system the first created user is in the “adm” group.

[jdstrand]

Note that ‘adm’ is not the group you want to use; it is for monitoring tasks on Debian/Ubuntu. See https://wiki.debian.org/SystemGroups. Not to mention ‘adm’ may not exist on other distributions. What you really need is Multiple users and groups in snaps which is now designed, but not being worked on with priority (I am working on it in the background, so it is progressing, but slowly).

[till.kamppeter]

@jdstrand, thanks. I will keep using “adm” for the time being so that I can do testing and switch over to the real solution as soon as it is ready.

[till.kamppeter]

At least unrestricted Avahi is working correctly for me on Classic.
Important is that the system is connected to a router (somehow there must be a local network) and not be a single machine connected to a modem. So I installed my snap onto a virtual machine (running Bionic) as the Virtual Machine Manager works like a router with the VMs in their own LAN.
There, after installing my snap, the system’s CUPS with the system’s cups-browsed attached to it was running on port 631 and the snap’s CUPS with the snap’s cups-browsed attached to it on port 10631. The two are working happily in parallel and the both CUPS daemons are advertising their shared printers and both cups-browsed are picking up the DNS-SD broadcasts of the other CUPS daemon to add appropriate local queues to their own CUPS daemons.
So the system’s CUPS automatically got queues to print on the printers shared by the snap’s CUPS and vice-versa.

[till.kamppeter]

Now, after some bug fixes I got so far that when I install my snap on a classic system (in my case my Bionic VM) that the two CUPS daemons (System on port 631, snap on port 10631 with each having its own domain socket file and each its own attached cups-browsed) are running nicely in parallel. Each cups-browsed picks up the shared printers of the other cupsd. I can also print on the print queues of each cupsd and I can print from one cupsd on the other cupsd’s shared printers using the queues automatically created by cups-browsed.

To access via the command line I use the system’s commands (lp, lpstat, lpoptions, lpadmin, …) for the system’s cupsd and the snap’s commands (cups.lp, cups.lpstat, cups.lpoptions, cups,lpadmin, …) for the snap’s cupsd. They use the domain sockets and so I do not get asked for my password when using administrative commands.

You can also call the system’s commands with -h /var/snap/cups/current/var/run/cups.sock added for accessing the snap’s cupsd.

In addition, the web interfaces are available under http://localhost:631/ and http://localhost:10631/ and both are fully working.

Restriction is not yet applied and it is still used “adm” as makeshift lpadmin group.

I have updated the GitHub repository for everyone being able to test:

OpenPrinting/printing-stack-snap

[till.kamppeter]

Now I have tried to apply confinement. As a sudo snapcraft cleanbuild takes very long time as it always pulls 100s of MB from the internet, I used the --classic and --jailmode options together with --dangerous on the sudo snap install <options> <snapfile> command.
With

sudo snap install --classic --dangerous cups_0.1.0_amd64.snap

I get

error: cannot perform the following tasks:
- Mount snap "cups" (unset) (snap "cups" requires devmode or confinement override)

How do I do this correctly? I also have tried to set “confinement: classic”, rebuild the package and do

sudo snap install --dangerous cups_0.1.0_amd64.snap

getting the same error.

sudo snap install --jailmode --dangerous cups_0.1.0_amd64.snap

Installs without errors, but CUPS does not start. /var/log/syslog contains the following then:

Nov 10 21:04:00 virt-devel systemd[1]: Reloading.
Nov 10 21:04:01 virt-devel systemd[1]: Mounting Mount unit for cups...
Nov 10 21:04:01 virt-devel systemd[1]: Mounted Mount unit for cups.
Nov 10 21:04:01 virt-devel systemd[1]: Stopping Service for snap application cups.cups-browsed...
Nov 10 21:04:01 virt-devel kernel: [39218.192077] audit: type=1107 audit(1510355041.149:2155): pid=752 uid=105 auid=4294967295 ses=4294967295 msg='apparmor="ALLOWED" operation="dbus_signal"  bus="system" path="/com/redhat/PrinterSpooler" interface="com.redhat.PrinterSpooler" member="PrinterRemoved" mask="send" name="org.freedesktop.DBus" pid=7103 label="snap.cups.cupsd" peer_pid=2102 peer_label="unconfined"
Nov 10 21:04:01 virt-devel kernel: [39218.192077]  exe="/usr/bin/dbus-daemon" sauid=105 hostname=? addr=? terminal=?'
Nov 10 21:04:01 virt-devel kernel: [39218.192332] audit: type=1107 audit(1510355041.149:2156): pid=752 uid=105 auid=4294967295 ses=4294967295 msg='apparmor="ALLOWED" operation="dbus_method_call"  bus="system" path="/org/freedesktop/ColorManager" interface="org.freedesktop.ColorManager" member="FindDeviceById" mask="send" name="org.freedesktop.ColorManager" pid=7103 label="snap.cups.cupsd" peer_pid=926 peer_label="unconfined"
Nov 10 21:04:01 virt-devel kernel: [39218.192332]  exe="/usr/bin/dbus-daemon" sauid=105 hostname=? addr=? terminal=?'
Nov 10 21:04:01 virt-devel kernel: [39218.192761] audit: type=1107 audit(1510355041.150:2157): pid=752 uid=105 auid=4294967295 ses=4294967295 msg='apparmor="ALLOWED" operation="dbus_signal"  bus="system" path="/org/cups/cupsd/Notifier" interface="org.cups.cupsd.Notifier" member="PrinterDeleted" mask="send" name="org.freedesktop.DBus" pid=7134 label="snap.cups.cupsd" peer_pid=2102 peer_label="unconfined"
Nov 10 21:04:01 virt-devel kernel: [39218.192761]  exe="/usr/bin/dbus-daemon" sauid=105 hostname=? addr=? terminal=?'
Nov 10 21:04:01 virt-devel kernel: [39218.192889] audit: type=1107 audit(1510355041.150:2158): pid=752 uid=105 auid=4294967295 ses=4294967295 msg='apparmor="ALLOWED" operation="dbus_signal"  bus="system" path="/org/cups/cupsd/Notifier" interface="org.cups.cupsd.Notifier" member="PrinterDeleted" mask="send" name="org.freedesktop.DBus" pid=7134 label="snap.cups.cupsd" peer_pid=1885 peer_label="unconfined"
Nov 10 21:04:01 virt-devel kernel: [39218.192889]  exe="/usr/bin/dbus-daemon" sauid=105 hostname=? addr=? terminal=?'
Nov 10 21:04:01 virt-devel kernel: [39218.193038] audit: type=1107 audit(1510355041.150:2159): pid=752 uid=105 auid=4294967295 ses=4294967295 msg='apparmor="ALLOWED" operation="dbus_signal"  bus="system" path="/org/cups/cupsd/Notifier" interface="org.cups.cupsd.Notifier" member="PrinterDeleted" mask="send" name="org.freedesktop.DBus" pid=7134 label="snap.cups.cupsd" peer_pid=2676 peer_label="/usr/sbin/cups-browsed"
Nov 10 21:04:01 virt-devel kernel: [39218.193038]  exe="/usr/bin/dbus-daemon" sauid=105 hostname=? addr=? terminal=?'
Nov 10 21:04:01 virt-devel kernel: [39218.200235] audit: type=1107 audit(1510355041.157:2160): pid=752 uid=105 auid=4294967295 ses=4294967295 msg='apparmor="ALLOWED" operation="dbus_method_call"  bus="system" path="/org/freedesktop/ColorManager" interface="org.freedesktop.ColorManager" member="DeleteDevice" mask="send" name="org.freedesktop.ColorManager" pid=7103 label="snap.cups.cupsd" peer_pid=926 peer_label="unconfined"
Nov 10 21:04:01 virt-devel kernel: [39218.200235]  exe="/usr/bin/dbus-daemon" sauid=105 hostname=? addr=? terminal=?'
Nov 10 21:04:01 virt-devel kernel: [39218.212054] audit: type=1107 audit(1510355041.169:2161): pid=752 uid=105 auid=4294967295 ses=4294967295 msg='apparmor="ALLOWED" operation="dbus_signal"  bus="system" path="/com/redhat/PrinterSpooler" interface="com.redhat.PrinterSpooler" member="QueueChanged" mask="send" name="org.freedesktop.DBus" pid=7103 label="snap.cups.cupsd" peer_pid=2102 peer_label="unconfined"
Nov 10 21:04:01 virt-devel kernel: [39218.212054]  exe="/usr/bin/dbus-daemon" sauid=105 hostname=? addr=? terminal=?'
Nov 10 21:04:01 virt-devel kernel: [39218.212319] audit: type=1107 audit(1510355041.169:2162): pid=752 uid=105 auid=4294967295 ses=4294967295 msg='apparmor="ALLOWED" operation="dbus_signal"  bus="system" path="/com/redhat/PrinterSpooler" interface="com.redhat.PrinterSpooler" member="PrinterRemoved" mask="send" name="org.freedesktop.DBus" pid=7103 label="snap.cups.cupsd" peer_pid=2102 peer_label="unconfined"
Nov 10 21:04:01 virt-devel kernel: [39218.212319]  exe="/usr/bin/dbus-daemon" sauid=105 hostname=? addr=? terminal=?'
Nov 10 21:04:01 virt-devel kernel: [39218.212506] audit: type=1107 audit(1510355041.169:2163): pid=752 uid=105 auid=4294967295 ses=4294967295 msg='apparmor="ALLOWED" operation="dbus_method_call"  bus="system" path="/org/freedesktop/ColorManager" interface="org.freedesktop.ColorManager" member="FindDeviceById" mask="send" name="org.freedesktop.ColorManager" pid=7103 label="snap.cups.cupsd" peer_pid=926 peer_label="unconfined"
Nov 10 21:04:01 virt-devel kernel: [39218.212506]  exe="/usr/bin/dbus-daemon" sauid=105 hostname=? addr=? terminal=?'
Nov 10 21:04:01 virt-devel kernel: [39218.212831] audit: type=1107 audit(1510355041.170:2164): pid=752 uid=105 auid=4294967295 ses=4294967295 msg='apparmor="ALLOWED" operation="dbus_signal"  bus="system" path="/org/cups/cupsd/Notifier" interface="org.cups.cupsd.Notifier" member="PrinterStopped" mask="send" name="org.freedesktop.DBus" pid=7134 label="snap.cups.cupsd" peer_pid=2102 peer_label="unconfined"
Nov 10 21:04:01 virt-devel kernel: [39218.212831]  exe="/usr/bin/dbus-daemon" sauid=105 hostname=? addr=? terminal=?'
Nov 10 21:04:01 virt-devel systemd[1]: Stopped Service for snap application cups.cups-browsed.
Nov 10 21:04:01 virt-devel systemd[1]: Stopping Service for snap application cups.cupsd...
Nov 10 21:04:01 virt-devel systemd[1]: Stopped Service for snap application cups.cupsd.
Nov 10 21:04:01 virt-devel gsd-color[1922]: failed to connect to device: Failed to connect to missing device /org/freedesktop/ColorManager/devices/cups_snaptest
Nov 10 21:04:01 virt-devel systemd[1]: Reloading.
Nov 10 21:04:02 virt-devel snapd[724]: 2017/11/10 21:04:02.812552 cmd.go:133: exe doesn't have snap mount dir prefix: "/usr/lib/snapd/snapd" vs "/snap"
Nov 10 21:04:03 virt-devel systemd[1]: Reloading.
Nov 10 21:04:03 virt-devel systemd[1]: Started Service for snap application cups.cups-browsed.
Nov 10 21:04:03 virt-devel systemd[1]: Started Service for snap application cups.cupsd.
Nov 10 21:04:03 virt-devel cups.cupsd[7717]: perl: warning: Setting locale failed.
Nov 10 21:04:03 virt-devel cups.cupsd[7717]: perl: warning: Please check that your locale settings:
Nov 10 21:04:03 virt-devel cups.cupsd[7717]: #011LANGUAGE = (unset),
Nov 10 21:04:03 virt-devel cups.cupsd[7717]: #011LC_ALL = (unset),
Nov 10 21:04:03 virt-devel cups.cupsd[7717]: #011LC_TIME = "pt_BR.UTF-8",
Nov 10 21:04:03 virt-devel cups.cupsd[7717]: #011LC_MONETARY = "pt_BR.UTF-8",
Nov 10 21:04:03 virt-devel cups.cupsd[7717]: #011LC_ADDRESS = "pt_BR.UTF-8",
Nov 10 21:04:03 virt-devel cups.cupsd[7717]: #011LC_TELEPHONE = "pt_BR.UTF-8",
Nov 10 21:04:03 virt-devel cups.cupsd[7717]: #011LC_NAME = "pt_BR.UTF-8",
Nov 10 21:04:03 virt-devel cups.cupsd[7717]: #011LC_MEASUREMENT = "pt_BR.UTF-8",
Nov 10 21:04:03 virt-devel cups.cupsd[7717]: #011LC_IDENTIFICATION = "pt_BR.UTF-8",
Nov 10 21:04:03 virt-devel cups.cupsd[7717]: #011LC_NUMERIC = "pt_BR.UTF-8",
Nov 10 21:04:03 virt-devel cups.cupsd[7717]: #011LC_PAPER = "pt_BR.UTF-8",
Nov 10 21:04:03 virt-devel cups.cupsd[7717]: #011LANG = "C.UTF-8"
Nov 10 21:04:03 virt-devel cups.cupsd[7717]:     are supported and installed on your system.
Nov 10 21:04:03 virt-devel cups.cupsd[7717]: perl: warning: Falling back to a fallback locale ("C.UTF-8").
Nov 10 21:04:03 virt-devel cups.cupsd[7717]: perl: warning: Setting locale failed.
Nov 10 21:04:03 virt-devel cups.cupsd[7717]: perl: warning: Please check that your locale settings:
Nov 10 21:04:03 virt-devel cups.cupsd[7717]: #011LANGUAGE = (unset),
Nov 10 21:04:03 virt-devel cups.cupsd[7717]: #011LC_ALL = (unset),
Nov 10 21:04:03 virt-devel cups.cupsd[7717]: #011LC_TIME = "pt_BR.UTF-8",
Nov 10 21:04:03 virt-devel cups.cupsd[7717]: #011LC_MONETARY = "pt_BR.UTF-8",
Nov 10 21:04:03 virt-devel cups.cupsd[7717]: #011LC_ADDRESS = "pt_BR.UTF-8",
Nov 10 21:04:03 virt-devel cups.cupsd[7717]: #011LC_TELEPHONE = "pt_BR.UTF-8",
Nov 10 21:04:03 virt-devel cups.cupsd[7717]: #011LC_NAME = "pt_BR.UTF-8",
Nov 10 21:04:03 virt-devel cups.cupsd[7717]: #011LC_MEASUREMENT = "pt_BR.UTF-8",
Nov 10 21:04:03 virt-devel cups.cupsd[7717]: #011LC_IDENTIFICATION = "pt_BR.UTF-8",
Nov 10 21:04:03 virt-devel cups.cupsd[7717]: #011LC_NUMERIC = "pt_BR.UTF-8",
Nov 10 21:04:03 virt-devel cups.cupsd[7717]: #011LC_PAPER = "pt_BR.UTF-8",
Nov 10 21:04:03 virt-devel cups.cupsd[7717]: #011LANG = "C.UTF-8"
Nov 10 21:04:03 virt-devel cups.cupsd[7717]:     are supported and installed on your system.
Nov 10 21:04:03 virt-devel cups.cupsd[7717]: perl: warning: Falling back to a fallback locale ("C.UTF-8").
[...]    (Several more times of "perl: warning: Setting locale failed.")
Nov 10 21:04:03 virt-devel cups.cupsd[7717]: perl: warning: Setting locale failed.
Nov 10 21:04:03 virt-devel cups.cupsd[7717]: perl: warning: Please check that your locale settings:
Nov 10 21:04:03 virt-devel cups.cupsd[7717]: #011LANGUAGE = (unset),
Nov 10 21:04:03 virt-devel cups.cupsd[7717]: #011LC_ALL = (unset),
Nov 10 21:04:03 virt-devel cups.cupsd[7717]: #011LC_TIME = "pt_BR.UTF-8",
Nov 10 21:04:03 virt-devel cups.cupsd[7717]: #011LC_MONETARY = "pt_BR.UTF-8",
Nov 10 21:04:03 virt-devel cups.cupsd[7717]: #011LC_ADDRESS = "pt_BR.UTF-8",
Nov 10 21:04:03 virt-devel cups.cupsd[7717]: #011LC_TELEPHONE = "pt_BR.UTF-8",
Nov 10 21:04:03 virt-devel cups.cupsd[7717]: #011LC_NAME = "pt_BR.UTF-8",
Nov 10 21:04:03 virt-devel cups.cupsd[7717]: #011LC_MEASUREMENT = "pt_BR.UTF-8",
Nov 10 21:04:03 virt-devel cups.cupsd[7717]: #011LC_IDENTIFICATION = "pt_BR.UTF-8",
Nov 10 21:04:03 virt-devel cups.cupsd[7717]: #011LC_NUMERIC = "pt_BR.UTF-8",
Nov 10 21:04:03 virt-devel cups.cupsd[7717]: #011LC_PAPER = "pt_BR.UTF-8",
Nov 10 21:04:03 virt-devel cups.cupsd[7717]: #011LANG = "C.UTF-8"
Nov 10 21:04:03 virt-devel cups.cupsd[7717]:     are supported and installed on your system.
Nov 10 21:04:03 virt-devel cups.cupsd[7717]: perl: warning: Falling back to a fallback locale ("C.UTF-8").
Nov 10 21:04:04 virt-devel systemd[1]: Reloading.
Nov 10 21:04:04 virt-devel cups.cupsd[7717]: Bad system call (core dumped)
Nov 10 21:04:04 virt-devel systemd[1]: snap.cups.cupsd.service: Main process exited, code=exited, status=159/n/a
Nov 10 21:04:04 virt-devel systemd[1]: snap.cups.cupsd.service: Unit entered failed state.
Nov 10 21:04:04 virt-devel systemd[1]: snap.cups.cupsd.service: Failed with result 'exit-code'.
Nov 10 21:04:04 virt-devel systemd[1]: snap.cups.cupsd.service: Service hold-off time over, scheduling restart.
Nov 10 21:04:04 virt-devel systemd[1]: Stopped Service for snap application cups.cupsd.
Nov 10 21:04:04 virt-devel systemd[1]: Started Service for snap application cups.cupsd.
[...]    (Several repetitions of the above)

What is going wrong here?

[till.kamppeter]

I have found it out now. One needs both confinement: classic in snapcraft.yaml AND installing with --classic. This way I get the snap installed and can test it with classic confinement.

[ogra]

Note that classic confinement is not supported in Ubuntu Core (and also not in many non-ubuntu distros).