Hello!
Same problem here on a DELL Vostro 1015 laptop with Ubuntu 22.04 LTS installed. 
Case looks very similar (I did not try installing Chromium from 3rd party repo, 
so cannot say anything about Chromium configurations working ok for print 
preview).

Looking up in the /var/log/syslog file, I found out that the same kind of 
message appeared (thanks a lot Dalik for the history! It helped a lot...) 
Some lines above that message about cups/ppd saying

Dec 14 22:47:15 Vostro-1015 vmunix: [ 7591.002262] audit: type=1400
audit(1734212835.036:373): apparmor="DENIED" operation="open"
class="file" profile="snap.chromium.chromium"
name="/etc/cups/ppd/ET-2860-Series.ppd" pid=12081 comm="ThreadPoolForeg"
requested_mask="r" denied_mask="r" fsuid=1000 ouid=0

I found out that there were some /other/ DENIED messages by apparmor
like

Dec 14 22:46:32 Vostro-1015 vmunix: [ 7548.431167] audit: type=1400
audit(1734212792.465:362): apparmor="DENIED" operation="open"
class="file" profile="snap.chromium.chromium"
name="/sys/devices/pci0000:00/0000:00:1a.0/usb2/2-1/2-1.1/devnum"
pid=12081 comm="ThreadPoolForeg" requested_mask="r" denied_mask="r"
fsuid=1000 ouid=0

and earlier

Dec 14 22:46:13 Vostro-1015 vmunix: [ 7529.767007] audit: type=1400
audit(1734212773.800:352): apparmor="DENIED" operation="open"
class="file" profile="snap.chromium.chromium" name="/etc/vulkan/icd.d/"
pid=12197 comm="chrome" requested_mask="r" denied_mask="r" fsuid=1000
ouid=0

showing that apparmor was indeed forbidding a lot of actions in the
snap.chromium.chromium profile...

I checked that all such data in /etc/vulkan were at least readable by
anyone (they are root-owned so drwxr-xr-x is minimum and was there) and
I issued the command

sudo gedit /var/lib/snapd/apparmor/profiles/snap.chromium.chromium

and updated some lines (addition on top of lines following line #1931
reading "# Support reading the Vulkan ICD files")

/etc/vulkan/ r,
/etc/vulkan/** r,

plus added apparmor permissions in that file for
/sys/devices/pci*/**/**/**/**/devnum

I also changed in the terminal the access permissions on the 
/etc/cups/ppd/ET-2860-Series.ppd file (root-owned, group lp, changed from 640 
to 644) for more safety on user access. 
I closed the Chromium application and reopened it, hoping for -at least- 
getting rid of that last message and its relatives regarding /etc/vulkan.

Unfortunately, this proved useless and the message still is there in the
syslog file (along with siblings).

I would welcome any new idea to go further on investigating this case.
Regards.

-- 
You received this bug notification because you are a member of Desktop
Packages, which is subscribed to chromium-browser in Ubuntu.
https://bugs.launchpad.net/bugs/2088333

Title:
  Chromium - printer unavailable - apparmor denial

Status in chromium-browser package in Ubuntu:
  Confirmed

Bug description:
  Snap chromium loads fine but when I open print preview window and
  select a USB connected printer and on the left I get a message that
  the printer is unavailable for all installed printers. Syslog shows
  the following error below. If I select the PDF printer, I get a print
  preview as expected. If I install chromium from a 3rd party repo, I do
  not have this problem and printing works.

  2024-11-16T04:14:32.340887+00:00 hostname kernel: kauditd_printk_skb: 39 
callbacks suppressed
  2024-11-16T04:14:32.340930+00:00 hostname kernel: audit: type=1400 
audit(1731730472.339:1550): apparmor="DENIED" operation="open" class="file" 
profile="snap.chromium.chromium" name="/etc/cups/ppd/printer001.ppd" 
pid=2189152 comm="ThreadPoolForeg" requested_mask="r" denied_mask="r" 
fsuid=1003 ouid=0
  2024-11-16T04:14:32.341776+00:00 hostname chromium_chromium.desktop[2189152]: 
[2189152:2189152:1115/231432.341331:ERROR:device_event_log_impl.cc(201)] 
[23:14:32.340] Printer: printer_capabilities.cc:235 Failed to get capabilities 
for printer001, result: kFailed

  I tried creating an override profile for apparmor but ran into
  additional errors that prevented Chromium from loading so I gave up on
  that.

  I think if we can add the following to the snap.chromium.chromium
  apparmor profile this would resolve the issue - /etc/cups/ppd/* path
  so all files inside are allowed to read as well as /var/spool/cups/*.

  If you have a working profile override that I can drop in with the two
  paths I can try that.

  
  Ubuntu 24.04 fully patched
  apparmor/noble-updates,now 4.0.1really4.0.1-0ubuntu0.24.04.3 amd64 
[installed,automatic]
  chromium           130.0.6723.116   2993   latest/stable  canonical✓     held

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/chromium-browser/+bug/2088333/+subscriptions


-- 
Mailing list: https://launchpad.net/~desktop-packages
Post to     : desktop-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~desktop-packages
More help   : https://help.launchpad.net/ListHelp

Reply via email to