# Last Modified: Sun Sep 16 18:11:15 2007

abi <abi/3.0>,

include <tunables/global>
/usr/sbin/cupsd {
  include <abstractions/base>
  include <abstractions/bash>
  include <abstractions/dbus>
  include <abstractions/nameservice>
  include <abstractions/perl>
  include <abstractions/hosts_access>

  capability chown,
  capability dac_override,
  capability fowner,
  capability fsetid,
  capability net_bind_service,
  capability setgid,
  capability setuid,

  /{usr/,}bin/bash ixr,
  /{usr/,}bin/cat ix,

  /usr/bin/foomatic-rip ixr,
  /etc/foomatic/** r,

  /usr/bin/gs ix,
  /usr/lib/ghostscript/** m,
  /usr/lib64/ghostscript/** m,
  /usr/share/ghostscript/** r,
  /etc/ghostscript/** r,

  /dev/lp0 rw,
  /dev/tty rw,
  /dev/ttyS? w,
  /etc/cups rw,
  /etc/cups/ r,
  /etc/cups/** r,
  /etc/cups/certs w,
  /etc/cups/certs/* w,
  /etc/cups/*.conf* rw,
  /etc/cups/ppd rw,
  /etc/printcap rw,
  /etc/cups/printcap rw,
  /etc/cups/ssl rw,
  /etc/cups/yes/* rw,
  @{PROC}/meminfo r,
  @{PROC}/sys/dev/parport/** r,
  /sys/class/usb r,
  /usr/bin/perl ix,
  /usr/bin/smbspool ixr,
  /usr/lib/cups/backend/* ixr,
  /usr/lib/cups/filter/* ixr,
  /usr/sbin/cupsd mixr,
  /usr/share/cups/** r,
  /var/log/cups/access_log rw,
  /var/log/cups/error_log rw,
  /var/spool/cups rw,
  /var/spool/cups/** rw,
  /var/spool/cups/tmp w,
  /var/spool/cups/tmp/ r,
  /{,var/}run/cups/ rw,
  /{,var/}run/cups/** rw,
  /var/cache/cups/ rw,
  /var/cache/cups/** rw,

  # Site-specific additions and overrides. See local/README for details.
  include if exists <local/usr.sbin.cupsd>
}