Question

I am writing a command line tool. There I’d like to create a directory in the /Users/user_name/Library directory. When I run that program from Terminal as a root, then everything is ok, but the problem is when I want to use that tool as a backend for cups (that program is called, also as root, when I print something). The program is called, but in the system.log file I found the error: sandboxd: deny file-write-*. I’m a new Mac OS X programmer and I’m not sure how to fix it. Anybody can help me?

Answer 1

Since Snow Leopard cups is running in a sandbox that prevents it from misbehaving – like accessing user’s home. Depending on your OS X version you can get away by using another directory, not user’s home. On Lion it is even more restrictive than that. The sandboxing rules are built-in to the cups binary (as opposed to sb scripts), so your only luck may be replacing cups with a version that specifically allows access to what you need in the sandbox (if you really want to go there, the rules are defined by cupsdCreateProfile in cups/scheduler/process.c). AFAICT there is nothing you can do in your application, because sandboxing is designed to prevent exactly what you are trying to do.

Another alternative is to not run cups as root, because sandboxing is only used when cups is run as root.