Lenz Grimmer's random thoughts

I’ve always been a fan of Brother, as their devices usually come with decent support for the Linux OS (at least initially). I have an MFC-7460DN Laser Printer / Scanner in my home office, that worked fine with Ubuntu Linux for the past few years. It’s hooked up to my DSL router’s ethernet switch and acts like a network printer for all of our devices.

Just to keep my mind flexible and to take a look at another Linux distribution for a change, I recently started using Fedora Workstation 23 on my Laptop (a company-issued Lenovo ThinkPad T440s). While the OS installation was painless and all main components like Video, Audio, Networking were detected and configured correctly out of the box, the post-installation of some tools and services required some more effort.

This time, the printing part of the MFC-7460DN took me quite some time to figure out. While Brother provides RPM packages of the drivers, they are 32-bit only, and the instructions hadn’t been updated since Fedora 12. The first thing I had to do was to download two driver RPM packages. I initially started with the newer versions of the drivers, brgenml1cupswrapper-3.1.0 and brgenml1lpr-3.1.0, but somehow did not get them to work at all. I then tried the older packages, mfc7460dnlpr-2.1.0 and cupswrapperMFC7460DN-2.0.4. These installed flawlessly, and a new printer was added to the CUPS configuration automatically.

However, it was configured as a local printer, so I first had to change the existing configuration to talk to the remote LPD port instead. While the printer configuration looked correct and no errors showed up, all print jobs simply disappeared into the bit bucket, without any visible error on the application side. Unfortunately the web-based CUPS administration tool was not much helpful, either – the button View Error Log simply returned a “Not found” error. There was no error log file in /var/log/cups, so I queried the status of the CUPS service via systemd next.

The command systemctl status -l cups then gave me a first hint:

sh: /opt/brother/Printers/BrGenML1//lpd/rawtobr3: /lib/ld-linux.so.2: bad ELF interpreter: No such file or directory

Since this is a 32-bit binary, it might help to actually install a 32-bit version of the GNU C library! I simply forgot this step, even though it’s documented in the installation instructions. A simple dnf install glibc.i686 got me over this hurdle.

Unfortunately the print jobs still did not reach the printer and disappeared in the void! Checking the CUPS error log again, I now saw this:

/usr/local/Brother/Printer/MFC7460DN/lpd/filterMFC7460DN: line 131: 11660 Done                    eval cat $INPUT_TEMP
11661 Broken pipe             | $PSCONV $PSCONV_OP
11662 Segmentation fault      | $BRCONV $BRCONV_OP
PID 11602 (/usr/lib/cups/filter/brlpdwrapperMFC7460DN) exited with no errors.
PID 11603 (/usr/lib/cups/backend/lpd) exited with no errors.

Hilarious. Oh well, maybe the 32-bit binary is simply too old and crashes in the new environment? Let’s take a look at the full systemd journal with journalctl! This gave me further clues:

cupsd[10951]: /usr/local/Brother/Printer/MFC7460DN/lpd/filterMFC7460DN: line 131: 11660 Done                    eval cat $INPUT_TEMP
cupsd[10951]: 11661 Broken pipe             | $PSCONV $PSCONV_OP
cupsd[10951]: 11662 Segmentation fault      | $BRCONV $BRCONV_OP
cupsd[10951]: PID 11602 (/usr/lib/cups/filter/brlpdwrapperMFC7460DN) exited with no errors.
cupsd[10951]: PID 11603 (/usr/lib/cups/backend/lpd) exited with no errors.
cupsd[10951]: time-at-completed=1449759139
cupsd[10951]: Job completed.
cupsd[10951]: Removing document files.
dbus[1190]: [system] Successfully activated service 'org.fedoraproject.Setroubleshootd'
setroubleshoot[11624]: SELinux is preventing brprintconflsr3 from using the execmem access on a process. For complete SELinux messages. run sealert -l 5d873063-1d87-4e82-b
python3[11624]: SELinux is preventing brprintconflsr3 from using the execmem access on a process.
                                                
                                *****  Plugin catchall_boolean (89.3 confidence) suggests   ******************
                           
                                If you want to allow cups to execmem
                                Then you must tell SELinux about this by enabling the 'cups_execmem' boolean.
                                                
                                Do
                                setsebool -P cups_execmem 1
                                                
                                *****  Plugin catchall (11.6 confidence) suggests   **************************
                                                
                                If you believe that brprintconflsr3 should be allowed execmem access on processes labeled cupsd_t by default.
                                Then you should report this as a bug.
                                You can generate a local policy module to allow this access.
                                Do
                                allow this access for now by executing:
                                # grep brprintconflsr3 /var/log/audit/audit.log | audit2allow -M mypol
                                # semodule -i mypol.pp

OK, so SELinux seems to be getting in the way here. I did as suggested and ran the following commands:

# setsebool -P cups_execmem 1
# grep brprintconflsr3 /var/log/audit/audit.log | audit2allow -M brothermfc7460dn
# semodule -i brothermfc7460dn.pp

An lo and behold, the printer started printing! Let’s hope it still does when I reboot the system…

Things I learned and that surprised me:

• The error handling in CUPS completely failed here. There was not a single end-user accessible hint that something went wrong, the print jobs just disappeared in the void.
• The move to systemd still has some ripple effects, e.g. the “Not found” error for the missing CUPS error log in the web UI.
• Analyzing log files with journalctl is actually quite convenient. Instead of grepping and tailing multiple logs under /var/log/, these tasks can now be performed using a single tool.
• SELinux is still a bitch, even though the hints provided by setroubleshootd were quite useful to resolve the issues at hand.