[pkg-apparmor] Bug#1132502: cups: AppArmor profile blocks USB backend on newer kernels (USB printers not detected)

[nara]

Package: cups
Version: 2.4.7-4
Severity: important
X-Debbugs-CC: apparmor at packages.debian.org

Dear Maintainer,

On Debian Trixie, USB printers are not detected by CUPS when running 
newer kernels (e.g., 6.19.8). The issue is caused by the AppArmor 
profile for cupsd blocking the USB backend.

Audit log excerpt:

[11631.189160] audit: type=1400 audit(...): apparmor="DENIED" 
operation="open" class="file" profile="/usr/sbin/cupsd" name="/" 
pid=19738 comm="usb" requested_mask="r" denied_mask="r" fsuid=7 ouid=0

This prevents /usr/lib/cups/backend/usb from functioning, so CUPS lists 
no usb:// devices.

Workaround / fix:

Adding the following lines to /etc/apparmor.d/usr.sbin.cupsd resolves 
the issue:

     / r,
     /usr/lib/cups/backend/usb rix,

After reloading the profile, USB printers appear again via `lpinfo -v`.

System details:
- Debian Trixie (testing)
- CUPS 2.4.7-4
- AppArmor enabled
- USB backend located at /usr/lib/cups/backend/usb
- Kernel 6.12 works; kernel 6.19.8 triggers the denial

This appears to be a missing rule in the shipped AppArmor profile.

Please update the profile to allow the USB backend to function correctly.

Thank you.