0

I am using Manjaro with Cinnamon, and whenever I go to "Print Settings" (about system-config-printer), I cannot do anything until I click unlock in the corner, which requires me to enter my password.

This is very annoying, and also, the authorization expires after a few minutes, and I have to unlock repeatedly.

How can I allow passwordless access to all functions of system-config-printer? I have already added my user to group cups; there is no group printer on my system.

This machine is in my home, used only by me, it is already secure, and I am not worried about unauthorized access to the printer settings.

  • Is the user in the cups and printer group? – vfbsilva Nov 10 '19 at 5:23
  • Are you looking for no-sudo/passwordless access to Print Settings i.e. system-config-printer for adding/configuring printers or the action of printing itself, because those are two different things. Both can be switched to non-sudo mode if desired, but you need to specify which one you need because the former is a visudo edit, and the latter will involve user and group permissions. – BarBar1234 Nov 10 '19 at 5:42
  • @BarBar1234 Edited to clarify – Bagalaw Nov 10 '19 at 21:30
  • Downvoters care to explain their reasoning? – Bagalaw Nov 10 '19 at 21:30
  • 3
    I am going to write up the answer to your question momentarily, but I just wanted to emphasize yet again that the worst part about about down votes is that they do not require the user to give a reason for doing so. At the very least it would be useful if there was a popup with 5-10 choices that allowed to pick a general reason for issuing a downvote like. "not specific enough", "asked X times before", "not relevant to U&L" etc. so the person asking a question could at least get some point of reference for the future. – BarBar1234 Nov 10 '19 at 22:48
0

Ok, your question still presents itself in two parts, so I am going to break it down and answer each issue separately:

1. CUPS policy and access

CUPS is the defacto printing server in linux, allowing for all types of printing: direct usb cable connection, local LAN printing, as well as WAN access. Consequently it comes with a multitude of configuration settings, many of them specific to security and system policy management. Going into these intricate details at this point would be counterproductive, as your main goal right now is to essentially be allowed to print on your local (directly connected or on your LAN) printer that you yourself own and have access to, without the need to type in a password.

If you have cups installed (and these days it comes included with the vast majority of Linux distros), and you have the service started with (if you can see any machines in system-print-settings then you have it running already):

sudo systemctl start cups

then if you go to http://localhost:631/ you will see the CUPS server admin page, which is essentially a web-accessible GUI for CUPS configuration, which by default in /etc/cups/cupsd.conf will not have any restrictions placed on its access.

[...]
Browsing On
BrowseLocalProtocols dnssd
DefaultAuthType Basic
WebInterface Yes
<Location />
  # Restrict access to the server...
  Order allow,deny
</Location>
[...]

If you look further down in that same file cupsd.conf you will see that other locations will come with restrictions, like for example:

<Location /admin/conf>
  AuthType Default
  Require user @SYSTEM
</Location>

and if you type in http://localhost:631/admin/conf you will be presented with a prompt for password.

NOW, here is the most important part : CUPS does not consider root or sudo **to be special in any way, and it is not the fact that they belong to those groups that gives them access to server configuration **

The @SYSTEM designation in /etc/cups/cupsd.conf is a refrence to a value present in /etc/cups/cups-files.conf. Typically (unless changed directly by admin), it will say:

sudo grep -i System /etc/cups/cups-files.conf 
# Administrator user group, used to match @SYSTEM in cupsd.conf policy rules...
SystemGroup lpadmin

and that lpadmin group present on your system is what allows a user (including root) to configure CUPS. If you run groups as root, you will see that lpadmin group included there along with root .

So in order to give any system user access to CUPS configuration pages, you need to make sure that they are part of lpadmin or whatever other group designation you happen to find corresponding to @SYSTEM in cups-files.conf.

Obviously, after adding the user to that group, you might need to restart both the cups service as well as likely restart your user session, so you might as well reboot.

Now, what this will allow is for a non-sudo user to set printer options, print, and send/cancel jobs to any printers you have. The other default settings in cupsd.conf should be secure enough by default , or at least they were the last time I heard.

2. Print Settings and system-config-printer

While the above will have given you access to printer configuration options at http://localhost:631/* as a non-root user, as long as that user is in the lpadmin group, it will still likely ask you for a password, and more importantly for your particular question , it will not affect anything related to system-config-printer dialog.

Now I will admit this part was a lot trickier, and while playing with sudoers and group permissions for non-sudo user allowed me various forms of access, every subsequent dialog I'd open would produce a password prompt, so for example if I clicked on Settings, I would see a password prompt and if I just left it in the background, the settings dialog would eventually open, and changing most configuration options proved to be either impossible or very disfunctional.

Then I looked into how the policy settings are managed for that dialog and I eventually found the corresponding file.

All it takes is the following line of code (make sure you have gawk installed when you run it to do an inplace replacement) to never see that unlock button or a password prompt when running system-config-printer:

sudo gawk -i inplace '{gsub((/auth_admin|auth_admin_keep/),"yes"); print }' /usr/share/polkit-1/actions/org.opensuse.cupspkhelper.mechanism.policy 

What it does is replace all the values in that dialog's policy file that ask for auth_admin or auth_admin_keepto yes, so you will end up with the following settings and their changed access level inside the policy file:

$ sudo grep -e "action id" -e  "description xml:lang=\"en\"" -e "yes" /usr/share/polkit-1/actions/org.opensuse.cupspkhelper.mechanism.policy


 <action id="org.opensuse.cupspkhelper.mechanism.server-settings">
    <description xml:lang="en">Get/Set server settings</description>
      <allow_any>yes</allow_any>
      <allow_inactive>yes</allow_inactive>
      <allow_active>yes</allow_active>
  <action id="org.opensuse.cupspkhelper.mechanism.devices-get">
    <description xml:lang="en">Get list of available devices</description>
      <allow_any>yes</allow_any>
      <allow_inactive>yes</allow_inactive>
      <allow_active>yes</allow_active>
  <action id="org.opensuse.cupspkhelper.mechanism.printer-set-default">
    <description xml:lang="en">Set a printer as default printer</description>
      <allow_any>yes</allow_any>
      <allow_inactive>yes</allow_inactive>
      <allow_active>yes</allow_active>
  <action id="org.opensuse.cupspkhelper.mechanism.printer-enable">
    <description xml:lang="en">Enable/Disable a printer</description>
      <allow_any>yes</allow_any>
      <allow_inactive>yes</allow_inactive>
      <allow_active>yes</allow_active>
  <action id="org.opensuse.cupspkhelper.mechanism.printer-local-edit">
    <description xml:lang="en">Add/Remove/Edit a local printer</description>
      <allow_any>yes</allow_any>
      <allow_inactive>yes</allow_inactive>
      <allow_active>yes</allow_active>
  <action id="org.opensuse.cupspkhelper.mechanism.printer-remote-edit">
    <description xml:lang="en">Add/Remove/Edit a remote printer</description>
      <allow_any>yes</allow_any>
      <allow_inactive>yes</allow_inactive>
      <allow_active>yes</allow_active>
  <action id="org.opensuse.cupspkhelper.mechanism.class-edit">
    <description xml:lang="en">Add/Remove/Edit a class</description>
      <allow_any>yes</allow_any>
      <allow_inactive>yes</allow_inactive>
      <allow_active>yes</allow_active>
  <action id="org.opensuse.cupspkhelper.mechanism.job-edit">
    <description xml:lang="en">Restart/Cancel/Edit a job</description>
      <allow_any>yes</allow_any>
      <allow_inactive>yes</allow_inactive>
      <allow_active>yes</allow_active>
  <action id="org.opensuse.cupspkhelper.mechanism.job-not-owned-edit">
    <description xml:lang="en">Restart/Cancel/Edit a job owned by another user</description>
      <allow_any>yes</allow_any>
      <allow_inactive>yes</allow_inactive>
      <allow_active>yes</allow_active>
  <action id="org.opensuse.cupspkhelper.mechanism.all-edit">
    <description xml:lang="en">Change printer settings</description>
      <allow_any>yes</allow_any>
      <allow_inactive>yes</allow_inactive>
      <allow_active>yes</allow_active>
  <action id="org.opensuse.cupspkhelper.mechanism.printeraddremove">
    <description xml:lang="en">Add/Remove/Edit a printer</description>
      <allow_any>yes</allow_any>
      <allow_inactive>yes</allow_inactive>
      <allow_active>yes</allow_active>

Now, you need to realize that changing the policy setting per Part 2 will not have any effect on CUPS without allowing access through what I wrote in Part 1. In fact if cups isnt running or its access is restricted (even to root by kicking him out of lpadmin), having access to that dialog will not allow you to print.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.