Don't call launch_activate_socket multiple times (<rdar://problem/17523218>)

[thirdparty/cups.git] / scheduler / process.c

diff --git a/scheduler/process.c b/scheduler/process.c
index a3a79802142858723508591c1ee9bf1f282ae7e7..639d6464fcdc89cff6f5127dea8c39101cf2d327 100644 (file)
--- a/scheduler/process.c
+++ b/scheduler/process.c
@@ -73,6 +73,7 @@ cupsdCreateProfile(int job_id,                /* I - Job ID or 0 for none */
                        domain[1024],   /* Domain socket, if any */
                        request[1024],  /* Quoted RequestRoot */
                        root[1024],     /* Quoted ServerRoot */
+                       state[1024],    /* Quoted StateDir */
                        temp[1024];     /* Quoted TempDir */
   const char           *nodebug;       /* " (with no-log)" for no debug */
   cupsd_listener_t     *lis;           /* Current listening socket */
@@ -104,6 +105,7 @@ cupsdCreateProfile(int job_id,              /* I - Job ID or 0 for none */
   cupsd_requote(cache, CacheDir, sizeof(cache));
   cupsd_requote(request, RequestRoot, sizeof(request));
   cupsd_requote(root, ServerRoot, sizeof(root));
+  cupsd_requote(state, StateDir, sizeof(state));
   cupsd_requote(temp, TempDir, sizeof(temp));
 
   nodebug = LogLevel < CUPSD_LOG_DEBUG ? " (with no-log)" : "";
@@ -188,8 +190,10 @@ cupsdCreateProfile(int job_id,             /* I - Job ID or 0 for none */
                 " #\"^%s/\""           /* TempDir/... */
                 " #\"^%s$\""           /* CacheDir */
                 " #\"^%s/\""           /* CacheDir/... */
+                " #\"^%s$\""           /* StateDir */
+                " #\"^%s/\""           /* StateDir/... */
                 "))\n",
-                temp, temp, cache, cache);
+                temp, temp, cache, cache, state, state);
   /* Read common folders */
   cupsFilePrintf(fp,
                  "(allow file-read-data file-read-metadata\n"
@@ -222,6 +226,9 @@ cupsdCreateProfile(int job_id,              /* I - Job ID or 0 for none */
                 " #\"^/Library/Application Support$\""
                 " #\"^/Library/Application Support/\""
                 " #\"^/Library/Caches$\""
+                " #\"^/Library/ColorSync$\""
+                " #\"^/Library/ColorSync/Profiles$\""
+                " #\"^/Library/ColorSync/Profiles/\""
                 " #\"^/Library/Fonts$\""
                 " #\"^/Library/Fonts/\""
                 " #\"^/Library/Frameworks$\""
@@ -234,6 +241,9 @@ cupsdCreateProfile(int job_id,              /* I - Job ID or 0 for none */
                 " #\"^/Library/Security$\""
                 " #\"^/Library/Security/\""
                 " #\"^/Library/WebServer$\""
+                " #\"^/System/Library/ColorSync$\""
+                " #\"^/System/Library/ColorSync/Profiles$\""
+                " #\"^/System/Library/ColorSync/Profiles/\""
                 " #\"^%s/Library$\""   /* RequestRoot/Library */
                 " #\"^%s/Library/\""   /* RequestRoot/Library/... */
                 " #\"^%s$\""           /* ServerBin */
@@ -259,21 +269,9 @@ cupsdCreateProfile(int job_id,             /* I - Job ID or 0 for none */
                   " #\"^/Library/Printers/PPD Plugins/\""
                   ")%s)\n", nodebug);
   }
-  /* Allow execution of child processes */
-  cupsFilePuts(fp, "(allow process-fork)\n");
-  cupsFilePrintf(fp,
-                 "(allow process-exec\n"
-                 "  (regex"
-                 " #\"^/bin/\""                /* /bin/... */
-                 " #\"^/usr/bin/\""    /* /usr/bin/... */
-                 " #\"^/usr/libexec/cups/\""   /* /usr/libexec/cups/... */
-                 " #\"^/usr/libexec/fax/\""    /* /usr/libexec/fax/... */
-                 " #\"^/usr/sbin/\""   /* /usr/sbin/... */
-                " #\"^%s/\""           /* ServerBin/... */
-                " #\"^/Library/Printers/.*/\""
-                " #\"^/System/Library/Frameworks/Python.framework/\""
-                "))\n",
-                bin);
+  /* Allow execution of child processes as long as the programs are not in a user directory */
+  cupsFilePuts(fp, "(allow process*)\n");
+  cupsFilePuts(fp, "(deny process-exec (regex #\"^/Users/\"))\n");
   if (RunUser && getenv("CUPS_TESTROOT"))
   {
     /* Allow source directory access in "make test" environment */
@@ -311,6 +309,9 @@ cupsdCreateProfile(int job_id,              /* I - Job ID or 0 for none */
                 "  (literal \"/usr/sbin/sendmail\")\n"
                 "  (with no-sandbox))\n");
   }
+  /* Allow access to Bluetooth, USB, and notify_post. */
+  cupsFilePuts(fp, "(allow iokit*)\n");
+  cupsFilePuts(fp, "(allow distributed-notification-post)\n");
   /* Allow outbound networking to local services */
   cupsFilePuts(fp, "(allow network-outbound"
                   "\n       (regex #\"^/private/var/run/\" #\"^/private/tmp/\")");
@@ -324,9 +325,6 @@ cupsdCreateProfile(int job_id,              /* I - Job ID or 0 for none */
       cupsFilePrintf(fp, "\n       (literal \"%s\")", domain);
     }
   }
-  /* Allow access to Bluetooth, USB, and notify_post. */
-  cupsFilePuts(fp, "(allow iokit*)\n");
-  cupsFilePuts(fp, "(allow distributed-notification-post)\n");
   if (allow_networking)
   {
     /* Allow TCP and UDP networking off the machine... */