samba - Feb 2024 - Samba 4.19.4 as printer server: printer are not show in browser

Thank Rowland

With browser I means "list all printers shared by CUPS from [smbclient
-L server] command"

A few minutes ago I discovered that it is a SElinux problem

I have run "sudo setenforce 0" then run "smbclient -N -L
fedora", the
printers appear in the list and work if I print on it

I had previously already checked the audit.log to see if SElinux errors
appeared but nothing was reported when run smbclient 

Now I have re enable SElinux with "sudo setenforce 1" and restart the
server, but the list of printers continues to be displayed and all work
fine.

This is good for me, but it's not clear what happened, because now with
Selinux enabled the printers are listed as expected.

Furthermore, I don't understand if it's a Selinux problem with Samba or
with Cups

Now I do some other test and investigations (revert the snapshot to
initial situation) to find out what exactly causes the printers not to
be displayed when Selinux is active and is never deactivated, even for
a moment. If I have any news I'll let you know.

Thanks you for your time

Dario


Il giorno mer, 07/02/2024 alle 11.39 +0000, Rowland Penny via samba ha
scritto:
> On Wed, 07 Feb 2024 12:13:32 +0100
> Dario Lesca via samba <samba at lists.samba.org> wrote:
> 
> > I have try many options and different debug and I don't know what
> > to
> > check anymore to resolve.
> > 
> > Please, someone can help me to discover why the CUPS printer are
> > not
> > show in browser list in my setup?
> > 
> > What's wrong on my configurations?
> > 
> > Thanks in advance
> > 
> 
> Please define 'browser'.
> 
> Are we talking the CUPS web browser on port 631 or something else ?
> 
> If you are talking the various GUI browser applications, then you may
> be able to get them working, but you probably will not want to,
> because
> it entails turning SMBv1 on everywhere.
> 
> Rowland
> ?
>

On Wed, 07 Feb 2024 13:18:12 +0100
Dario Lesca via samba <samba at lists.samba.org> wrote:
> Thank Rowland
> 
> With browser I means "list all printers shared by CUPS from [smbclient
> -L server] command"
I would never have equated 'browser' with smbclient.
> 
> A few minutes ago I discovered that it is a SElinux problem
> 
> I have run "sudo setenforce 0" then run "smbclient -N -L
fedora", the
> printers appear in the list and work if I print on it
> 
> I had previously already checked the audit.log to see if SElinux
> errors appeared but nothing was reported when run smbclient 
> 
> Now I have re enable SElinux with "sudo setenforce 1" and restart
the
> server, but the list of printers continues to be displayed and all
> work fine.
> 
> This is good for me, but it's not clear what happened, because now
> with Selinux enabled the printers are listed as expected.
> 
> Furthermore, I don't understand if it's a Selinux problem with
Samba
> or with Cups
If Selinux is involved with anything, it is a 'Selinux' problem, Samba
(for instance) does not write the Selinux rules.
> 
> Now I do some other test and investigations (revert the snapshot to
> initial situation) to find out what exactly causes the printers not to
> be displayed when Selinux is active and is never deactivated, even for
> a moment. If I have any news I'll let you know.
> 
> Thanks you for your time
> 
Don't mention it :-)

Rowland

Il giorno mer, 07/02/2024 alle 13.18 +0100, Dario Lesca via samba ha
scritto:
> Now I do some other test and investigations (revert the snapshot to
> initial situation) 
I have do some test and I have found what can unlock the missing CUPS
printers list when do a "smbclient -L server" or browse the server
from
windows.

See these follow steps[1].

As you see, it's not a SElinux problem, but I do not know what's
happened.

Only after I perform at least one print on a manually added dumb
printer (lp1) the list of printers shared by CUPS is shown!!

Before to print, when the CUPS printer are not show, I have stop smb
and nmb and I have copy the /var/lib/samba dir into a backup temp dir
(/opt/lib-samba-before)

Then I have restart smb/nmb and I have print a job, stop the services
and copied the /var/lib/samba dir again to check the differences
(/opt/lib-samba-after)

These are the difference[2]

I need some suggestions on how to investigate this strange behaviour
and what causes it and fill a bugs on the specific scope (Fedora?,
CUPS?, Samba?).

Many thanks

Dario

[1]
# Install a fresh Fedora 39 server

# Install cups
dnf install cups -y
systemctl restart cups

# Add a fake printer
lpadmin -p laser1 -oraw -v socket://laser1:9100/ -E

# Install another virtual printer (cups-PDF)
dnf install cups-pdf -y

# Check CUPS printers list
lpstat -t
# CUPS printers are listed

# Install and start samba
dnf install samba samba-client -y
systemctl restart smb nmb

# List printers
smbclient -N -L fedora
# CUPS printers list is NOT show

# add a dumb printer
cat << EOF >> /etc/samba/smb.conf
[lp1]
        comment = LP1 Printer
        path = /var/tmp
        printable = Yes
        browseable = Yes
	printer name = Cups-PDF
	public = yes
EOF

# disable auth (or add a user to samba)
sed -i '/security = user/a\\tmap to guest = bad user'
/etc/samba/smb.conf

# Check ..
testparm -s /etc/samba/smb.conf

# Restart samba
systemctl restart smb nmb

# List printers
smbclient -N -L fedora
# CUPS printers are NOT show
# are only displayed the manually added printer         

# Once Again ...
smbclient -N -L fedora
# CUPS printers are NOT show
# are only displayed the manually added printer         

# ....

# Print a simple job to dumb lp1 printer
smbclient -N //fedora/lp1 -c 'print /etc/issue'

# List printers
smbclient -N -L fedora
# from now and forever the list of CUPS printers will be shown

[2]

root at fedora:~# ls -F /opt/lib-samba-before
account_policy.tdb  browse.dat  drivers/  group_mapping.tdb  lock/  private/ 
registry.tdb  share_info.tdb  smbprofile.tdb
?
root at fedora:~# ls -F /opt/lib-samba-after/
account_policy.tdb  browse.dat  drivers/  DriverStore/  group_mapping.tdb  lock/
printing/  private/  registry.tdb  share_info.tdb  smbprofile.tdb


root at fedora:~# ls -Fa /opt/lib-samba-before/drivers/
./  ../

root at fedora:~# ls -Fa /opt/lib-samba-after/drivers/
./  ../  ARM64/  color/  IA64/  W32ALPHA/  W32MIPS/  W32PPC/  W32X86/  WIN40/ 
x64/

root at fedora:~# ls -Fa /opt/lib-samba-after/DriverStore/
./  ../  FileRepository/  Temp/

Hello,

same Problem here with arch linux and samba-4.19.5-1.


Thanks for your workaround.