Text edit, sandbox access to cups server

Question

Text edit, sandbox access to cups server

I run a lab for a computer science department. The computers in the lab are dual boot iMacs running Snow Leopard & Windows 7. We recently upgraded one of the lab computers to Lion (we did not do a clean install). Access to the lab printers is controlled by a cups server running on our MacPro server.

Since upgrading the one lab computer to Lion that computer can no longer print from Text Edit or Preview. The problem appears to be caused by the fact that Text Edit & Preview are now sandboxed and sandbox is denying network access. This is a typical message in /var/log/system.log when a user tries to print from Text Edit (I've changed the IP address of the cups server to nonsense for this posting):

sandboxd[220] ([204]): TextEdit(204) deny network-outbound 111.11.11.11:631

Here is a similar message when one tries to print from Preview:

sandboxd[300] ([268]): Preview(268) deny network-outbound 111.11.11.11:631

In the print dialogue box of both apps it states that there is no printer selected. If I try to add a printer I get an error message saying the attempt to add failed. The following error messages shows up in /var/log/system.log:

[0x0-0x20020].com.apple.print.add[303]: Password for student on 111.11.11.11?

There is no request for a password when trying to add the printer.

Any ideas/suggestions for how I can resolve this problem?

Thanks,

Julie

iMac, Mac OS X (10.7.2)

Posted on Nov 23, 2011 9:48 AM

Reply

Answer 1

tArre

Level 1

85 points

Nov 24, 2011 6:14 AM in response to julie dfromturlock

bad news...

the "sandbox" is some kind of security approach.

the permissions that some application has inside it's sandbox is defined during application development (that's say, not by you).

probably there is a way to workaround this.

Maybe you can configure your local CUPs, and make TextEditor to connect local printer, not to remote (and let CUPs to do the network things).

that's a guess i have not tested...

there must be a way to print from TextEditor because i've do it. Probably the trick is that, use local CUPs.

Reply

Answer 2

Nov 30, 2011 9:32 AM in response to tArre

Thank you for your reply. It got me thinking of how I could use the local cups to send print jobs to the cups server. The following solution appears to be working for print jobs sent from Text Edit, Preview and all other apps on the Lion client computer:

1) I added an IPP printer on the client computer with a raw driver.

2) I then did the following lpadmin command on the client computer:

lpadmin -p local_printer -v ipp://cupsServer/printers/csok

Reply

Answer 3

Jan 19, 2012 8:11 AM in response to julie dfromturlock

Sadly this is not an adequate solution to the problem.

We run in a managed envrionment and using a cups client.conf on our machines allows us to keep the printer configuration consistent on all machines. Having to install printers manually on each machine would be ridiculous!

This is obviously a bug in Lion; applications should be allowed to submit jobs to remote print servers as they always have. Is there a good way to report this issue in a manner that it will actually be seen by Apple engineers?

Reply

Answer 4

Apr 4, 2012 2:23 AM in response to julie dfromturlock

We also had these problems. We solved this by changing /System/Library/Sandbox/Profiles/application.sb:

In the entitlement "com.apple.security.print" we added the line:

(allow network-outbound (remote ip4 "*:631"))

Reply

Answer 5

jeff38fr

Level 1

0 points

Apr 4, 2012 7:12 AM in response to dagfrommettlach

I had the same problem wth sandbox, and this one seems to be solved. But I still have an error when I tried to print :

Apr 4 16:11:48 gre036223-108 TextEdit[260]: An uncaught exception was raised

Apr 4 16:11:48 gre036223-108 TextEdit[260]: -[__NSCFDictionary setObject:forKey:]: attempt to insert nil value (key: printer-location)

Apr 4 16:11:48 gre036223-108 TextEdit[260]: (

0 CoreFoundation 0x00007fff82b0dfc6 __exceptionPreprocess + 198

1 libobjc.A.dylib 0x00007fff825fcd5e objc_exception_throw + 43

2 CoreFoundation 0x00007fff82b0ddfa +[NSException raise:format:arguments:] + 106

3 CoreFoundation 0x00007fff82b0dd84 +[NSException raise:format:] + 116

4 CoreFoundation 0x00007fff82acaf3b -[__NSCFDictionary setObject:forKey:] + 219

5 PrintingPrivate 0x0000000110e2936a -[PKBrowser(private) queueList] + 324

6 PrintingPrivate 0x0000000110e27c82 -[PKBrowser filteredDeviceList] + 75

7 PrintCocoaUI 0x0000000110d3c759 CreateDefaultFileName + 6849

....

Reply

Answer 6

jeff38fr

Level 1

0 points

Apr 4, 2012 8:21 AM in response to jeff38fr

Solved...

It doesn't work with a local account, but with a AD account it's OK.

Reply