cups-pdf sandbox issues in yosemite

[jasonw@…]

Installed cups-pdf under Yosemite DP 8 (14A361c), following all directions. When I try to add the printer, no entry for cups-pdf shows.

Log shows this line:

sandboxd[269] ([23432]): cups-deviced(23432) deny file-read-metadata /opt/local/libexec/cups/backend/cups-pdf

To test, I tried replacing the link in /usr/libexec/cups/backend with the actual file (and chown root:wheel, chmod 700 for good measure).

Still, no printer shows up, and log displays:

sandboxd[269] ([23577]): cups-pdf(23577) deny file-read-metadata /opt/local/etc/cups/cups-pdf.conf
sandboxd[269] ([23577]): cups-pdf(23577) deny file-read-metadata /opt/local/var/log/cups
--- last message repeated 1 time ---
sandboxd[269] ([23577]): cups-pdf(23577) deny file-read-metadata /opt/local/var/log
sandboxd[269] ([23577]): cups-pdf(23577) deny file-read-metadata /opt/local/var
sandboxd[269] ([23577]): cups-pdf(23577) deny file-read-metadata /opt/local
sandboxd[269] ([23577]): cups-pdf(23577) deny file-read-metadata /opt

Sandbox no longer complains about the backend, but now it disallows access to the config and log files.

[cooljeanius (Eric Gallager)]

Cc Me!

[stoffer@…]

Added "Sandboxing off" to /etc/cups/cups-files.conf and changed /opt/local/etc/cups/cups-pdf.conf to use "GhostScript /opt/local/bin/gs" with default "GSCall %s -q -dCompatibilityLevel=%s -dNOPAUSE -dBATCH -dSAFER -sDEVICE=pdfwrite -sOutputFile="%s" -dAutoRotatePages=/PageByPage -dAutoFilterColorImages=false -dColorImageFilter=/FlateEncode -dPDFSETTINGS=/prepress -c .setpdfwrite -f %s"

fixed it for me, maybe the Portfile should be patched?

[icaines77@…]

Agreed, stoffer@…'s suggestion worked for me. Except that I also needed to comment out the "PDFVer" line.

[icaines77@…]

Cc Me!

[mf2k (Frank Schima)]

Would someone please attach their patch(es)?

[icaines77@…]

I am not sure how to patch for this, since it involves changing a file outside of macports (/etc/cups/cups-files.conf), I suppose we could add it to the instructional blurb that appears when cups-pdf is first installed, or add code to make the change to the ${prefix}/libexec/cups-pdf_links.sh script that users are supposed to run?

[mf2k (Frank Schima)]

One or both sound reasonable to me.

[iwatakenichi@…]

Adding "Sandboxing off" to /etc/cups/cups-files.conf doesn't look a must, it worked for me without it.

[icaines77@…]

Replying to iwatakenichi@…:

Adding "Sandboxing off" to /etc/cups/cups-files.conf doesn't look a must, it worked for me without it.

Just to confirm, are you using OSX 10.10 (Yosemite)?

Just checked again, and it looks like cups-pdf will work with either "Sandboxing off" or "Sandboxing relaxed" set in /etc/cups/cups-files.conf, but if I use neither then cups-pdf is still failing with sandboxing errors. Presumably better to recommend people use the "relaxed" option?

(I can take a stab at a revised portfile next week.)

[icaines77@…]

Revised Portfile with instructions re sandboxing.

[icaines77@…]

Diff of portfile.

[icaines77@…]

I have attached a revised Portfile which includes the changes described above plus a description of how to change the Sandboxing setting on CUPS. Someone who actually knows what they are doing should probably take a look.

[leonfauster@…]

Does someone here had success on El Capitan 10.11 with the above suggestion (see also #52245)?

[icaines77@…]

Replying to leonfauster@…:

Does someone here had success on El Capitan 10.11 with the above suggestion (see also #52245)?

Yes, it's working for me.