Epson C1100N, Ubuntu 12.04, and AppArmor

What a pain that was! Some months ago I decided to upgrade my Ubuntu 10.04 Lucid Lynx to the 12.04 Precise Pangolin. I while back I made the decision to only do upgrades to the LTS (long term support versions) as I realised that far too much of my life was spent “fixing” upgrades. It used to be fun but these days I’d rather used my geek time more productively…

The upgrade went fine, though it took a little time to get used to the Unity interface (which I now rather like). Unfortunately I was hit with a driver issue the like of which fortunately doesn’t seem to come up much these days. The problem was that the driver for my trusty old Epson C1100N printer seemed to have died with the upgrade. It’s always been a bit problematic on Linux since I’ve been using a 64 bit distro; something to do with the dependencies (particularly libstdc++5) of the shell script that the driver uses to build documents into something the printer understands. The last time I got it to work fine using the instructions here. Years previous to that I’d even contributed to something of a team effort getting a working driver install, digging around though system logs and so on to find the cause of the problem. So then, it was rather embarassing to be in the position of having to reboot in to Windows to print.

Shortly after the upgrade, I found an updated page on the excellent Ubuntu wiki telling me how to install the print driver using Epson’s source code with a ready-made script for 64 bit machines. I ran this an all appeared to go well, but no printing 🙁 Several times over the past few months I’ve tried uninstalling / reinstalling / reconfiguring and digging through driver source code to find the problem. At one point I had a bunch of legacy libraries installed, which were breaking enough things that Ubuntu refused to allow any further updates through apt-get until it was all fixed.

Anyway, I just had a breakthrough. Naturally I’ve been looking in the logs (specifically /var/logs/syslog and /var/log/cups/error_log) each time I’d tried debugging. In the cups error log I had this:

/bin/bash: /usr/lib/cups/filter/pstoalc1100.sh: /bin/bash: bad interpreter: Permission denied

which I’d assumed was being caused by the broken driver. (pstoalc1100.sh is the script that does the grunt work)

In syslog there were a few things, but for some reason until this time I’d missed this:

type=1400 audit(1371153769.239:2777): apparmor="DENIED" operation="exec" parent=4771 profile="/usr/sbin/cupsd" name="/usr/local/bin/pstoalc1100.sh" pid=4773 comm="bash" requested_mask="x" denied_mask="x" fsuid=7 ouid=0

It seems that, despite having been in Ubuntu (at least for CUPS printing) for years, AppArmor was blocking the pstoalc1100.sh script from running. In the shell I did this:

sudo aa-complain "/usr/sbin/cupsd"

which puts AppArmor into learning mode for CUPS. I then tried to print, and shortly later out popped a document! Obviously to restore security, a call to aa-enforce is needed once AppArmor is convinced of my printer’s right to exist.

I’m a big fan of Linux, but trials like this are an unfortunate price to pay. The one benefit is that had a new build of Windows done this my chances of a fix would have been much closer to zero.