Hi Kevin, Thank you for the clarification. However, we want to emphasize that the decision to have cupsd ignore one of its main configuration files is a major breaking change. This is not just a tightening of the sandbox but a major departure from documented CUPS behavior (https://www.cups.org/doc/man-cups-files.conf.html). By ignoring cups-files.conf, macOS disables essential administrative controls required for non-standard printing environments. As such, we hope the team will reconsider this approach. If a fixed configuration is necessary for the default security posture, there should still be an alternative that allows legitimate, authorized software to operate in “relaxed” mode. In terms of supporting CUPSD_SANDBOXING_STRICT, am I correct that these two points are the real issues here, not the path limitations? As we mentioned earlier, it is a combination of all three (file/folder access, sub-process handling, and network calls). We are actively working on modifying our backend/filter to accommo
Topic:
App & System Services
SubTopic:
General
Tags: