#define CPCONFIG "/etc/cups/cups-pdf.conf"

#define CPCONFIG "/etc/cups/cups-pdf-md1.conf"

### Key: PostProcessing
##  postprocessing script that will be called after the creation of the PDF
##  as arguments the filename of the PDF, the username as determined by 
##  CUPS-PDF and the one as given to CUPS-PDF will be passed
##  the script will be called with user privileges
##  set this to an empty value to use no postprocessing
### Default: <empty>

PostProcessing /etc/cups/cups-pdf-md1.sh

#!/bin/bash
/etc/cups/PDF2Mail.sh "$1" "$2" "$3"

#!/bin/bash
/etc/cups/PDF2Mail.sh "$1" "$2" "$3" "/etc/cups/cups-pdf-md1.pdf"

#!/bin/bash
/etc/cups/PDF2Mail.sh "$1" "$2" "$3" "/etc/cups/cups-pdf-md2.pdf"

#!/bin/bash
/etc/cups/PDF2Mail.sh "$1" "$2" "$3" "/etc/cups/cups-pdf-md3.pdf"

#!/bin/bash
/etc/cups/PDF2Mail.sh "$1" "$2" "$3" "/etc/cups/cups-pdf-md4.pdf"

#!/bin/bash
#
# PDF2Mail.sh
#
# This script is a CUPS postprocessor. It adds a watermark 
# if necessary, renames the file and offers the possibility 
# for sending the file by e-mail.
#
# @author.: Manuel Dräger
# @datei..: 20.03.2016
# @version: 0.1
# @usage..: with postprocessor directive in /etc/cups-pdf.conf

export file="$1"
export USER="$2"
export wmfile="$4"
export date=`date +%Y.%m.%d`
export time=`date +%H.%M.%S`
export hostname=`hostname`
export dirname=`dirname $file`
export filename=`basename $file`
export newfile="$date - $time - $hostname - $filename"
export nfile="$dirname/$newfile"
export self=`basename $0`
export DISPLAY=:0.0
export HOME=/home/$USER
export XAUTHORITY=$HOME/.Xauthority

# thunderbird needs a D-BUS session, if thunderbird is not running
if test -z "$DBUS_SESSION_BUS_ADDRESS" ; then
  eval `dbus-launch --sh-syntax`
fi

#  show dialog to save the file
nfile=`zenity --file-selection --save --confirm-overwrite --filename="$nfile"`
if [ $? -eq 0 ]; then
  # add watermarks and delete the original file
  if [ $wmfile -eq "" ]; then
    mv "$file" "$nfile"
  else
    pdftk "$file" background "$wmfile" output "$nfile" && rm "$file"
  fi
  # show dialog for sending the file by e-mail
  if zenity --question --text "Willst Du die PDF per E-Mail mit Thunderbird versenden?"; then 
    # escape the ","
    export pseudouri="file://"`echo $nfile | sed 's/,/%2C/g'`
    export subject=`basename "$nfile" | sed 's/,/%2C/g'`
    # send file via thunderbird
    thunderbird -compose "subject=$subject,attachment='$pseudouri'"
  fi
fi

# vim:syntax=apparmor
# Last Modified: Thu Aug  2 12:54:46 2007
# Author: Martin Pitt <martin.pitt@ubuntu.com>

#include <tunables/global>

/usr/sbin/cupsd flags=(attach_disconnected) {
  #include <abstractions/base>
  #include <abstractions/bash>
  #include <abstractions/authentication>
  #include <abstractions/dbus>
  #include <abstractions/fonts>
  #include <abstractions/nameservice>
  #include <abstractions/perl>
  #include <abstractions/user-tmp>

  capability chown,
  capability fowner,
  capability fsetid,
  capability kill,
  capability net_bind_service,
  capability setgid,
  capability setuid,
  capability audit_write,
  deny capability block_suspend,

  # nasty, but we limit file access pretty tightly, and cups chowns a
  # lot of files to 'lp' which it cannot read/write afterwards any
  # more
  capability dac_override,

  # the bluetooth backend needs this
  network bluetooth,

  # the dnssd backend uses those
  network x25 seqpacket,
  network ax25 dgram,
  network netrom seqpacket,
  network rose dgram,
  network ipx dgram,
  network appletalk dgram,
  network econet dgram,
  network ash dgram,

  /bin/bash ixr,
  /bin/dash ixr,
  /bin/hostname ixr,
  /dev/lp* rw,
  deny /dev/tty rw,  # silence noise
  /dev/ttyS* rw,
  /dev/ttyUSB* rw,
  /dev/usb/lp* rw,
  /dev/bus/usb/ r,
  /dev/bus/usb/** rw,
  /dev/parport* rw,
  /etc/cups/ rw,
  /etc/cups/** rw,
  /etc/cups/interfaces/* ixrw,
  /etc/foomatic/* r,
  /etc/gai.conf r,
  /etc/papersize r,
  /etc/pnm2ppa.conf r,
  /etc/printcap rwl,
  /etc/ssl/** r,
  @{PROC}/net/ r,
  @{PROC}/net/* r,
  @{PROC}/sys/dev/parport/** r,
  @{PROC}/*/net/ r,
  @{PROC}/*/net/** r,
  @{PROC}/*/auxv r,
  @{PROC}/sys/crypto/** r,
  /sys/** r,
  /usr/bin/* ixr,
  /usr/sbin/* ixr,
  /bin/* ixr,
  /sbin/* ixr,
  /usr/lib/** rm,

  # backends which come with CUPS can be confined
  /usr/lib/cups/backend/bluetooth ixr,
  /usr/lib/cups/backend/dnssd ixr,
  /usr/lib/cups/backend/http ixr,
  /usr/lib/cups/backend/ipp ixr,
  /usr/lib/cups/backend/lpd ixr,
  /usr/lib/cups/backend/parallel ixr,
  /usr/lib/cups/backend/serial ixr,
  /usr/lib/cups/backend/snmp ixr,
  /usr/lib/cups/backend/socket ixr,
  /usr/lib/cups/backend/usb ixr,
  # we treat cups-pdf specially, since it needs to write into /home
  # and thus needs extra paranoia
  /usr/lib/cups/backend/cups-pdf Px,
  /usr/lib/cups/backend/cups-pdf-md1 Px, # Modifikation MD
  /usr/lib/cups/backend/cups-pdf-md2 Px, # Modifikation MD
  /usr/lib/cups/backend/cups-pdf-md3 Px, # Modifikation MD
  /usr/lib/cups/backend/cups-pdf-md4 Px, # Modifikation MD
  # third party backends get no restrictions as they often need high
  # privileges and this is beyond our control
  /usr/lib/cups/backend/* Cx -> third_party,

  /usr/lib/cups/cgi-bin/* ixr,
  /usr/lib/cups/daemon/* ixr,
  /usr/lib/cups/monitor/* ixr,
  /usr/lib/cups/notifier/* ixr,
  # filters and drivers (PPD generators) are always run as non-root,
  # and there are a lot of third-party drivers which we cannot predict
  /usr/lib/cups/filter/** Cxr -> third_party,
  /usr/lib/cups/driver/* Cxr -> third_party,
  /usr/local/** rm,
  /usr/local/lib/cups/** rix,
  /usr/share/** r,
  /{,var/}run/** rm,
  /{,var/}run/avahi-daemon/socket rw,
  deny /{,var/}run/samba/ rw,
  /{,var/}run/samba/** rw,
  /var/cache/samba/*.tdb r,
  /var/{cache,lib}/samba/printing/printers.tdb r,
  /{,var/}run/cups/ rw,
  /{,var/}run/cups/** rw,
  /var/cache/cups/ rw,
  /var/cache/cups/** rwk,
  /var/log/cups/ rw,
  /var/log/cups/* rw,
  /var/spool/cups/ rw,
  /var/spool/cups/** rw,

  # third-party printer drivers; no known structure here
  /opt/** rix,

  # FIXME: no policy ATM for hplip and Brother drivers
  /usr/bin/hpijs Cx -> third_party,
  /usr/Brother/** Cx -> third_party,

  # Kerberos authentication
  /etc/krb5.conf r,
  deny /etc/krb5.conf w,
  /etc/krb5.keytab rk,
  /etc/cups/krb5.keytab rwk,
  /tmp/krb5cc* k,

  # likewise authentication
  /etc/likewise r,
  /etc/likewise/* r,

  # silence noise
  deny /etc/udev/udev.conf r,

  signal peer=/usr/sbin/cupsd//third_party,
  unix peer=(label=/usr/sbin/cupsd//third_party),
  profile third_party flags=(attach_disconnected) {
    # third party backends, filters, and drivers get relatively no restrictions
    # as they often need high privileges, are unpredictable or otherwise beyond
    # our control
    file,
    capability,
    audit deny capability mac_admin,
    network,
    dbus,
    signal,
    ptrace,
    unix,
  }

  # Site-specific additions and overrides. See local/README for details.
  #include <local/usr.sbin.cupsd>
}

# separate profile since this needs to write into /home
/usr/lib/cups/backend/cups-pdf {
  #include <abstractions/base>
  #include <abstractions/fonts>
  #include <abstractions/nameservice>
  #include <abstractions/user-tmp>

  capability chown,
  capability fowner,
  capability fsetid,
  capability setgid,
  capability setuid,

  # unfortunate, but required for when $HOME is 700
  capability dac_override,
  capability dac_read_search,

  @{PROC}/*/auxv r,

  /bin/dash ixr,
  /bin/bash ixr,
  /bin/cp ixr,
  /etc/papersize r,
  /etc/cups/cups-pdf.conf r,
  @{HOME}/PDF/ rw,
  @{HOME}/PDF/* rw,
  /usr/bin/gs ixr,
  /usr/lib/cups/backend/cups-pdf mr,
  /usr/lib/ghostscript/** mr,
  /usr/share/** r,
  /var/log/cups/cups-pdf_log w,
  /var/spool/cups/** r,
  /var/spool/cups-pdf/** rw,
  /etc/cups/cups-pdf.sh uxr, # Modifikation MD
}

/usr/lib/cups/backend/cups-pdf-md1 {
  #include <abstractions/base>
  #include <abstractions/fonts>
  #include <abstractions/nameservice>
  #include <abstractions/user-tmp>

  capability chown,
  capability fowner,
  capability fsetid,
  capability setgid,
  capability setuid,

  # unfortunate, but required for when $HOME is 700
  capability dac_override,
  capability dac_read_search,

  @{PROC}/*/auxv r,

  /bin/dash ixr,
  /bin/bash ixr,
  /bin/cp ixr,
  /etc/papersize r,
  /etc/cups/cups-pdf-md1.conf r, # Modifikation MD
  @{HOME}/PDF/ rw,
  @{HOME}/PDF/* rw,
  /usr/bin/gs ixr,
  /usr/lib/cups/backend/cups-pdf mr,
  /usr/lib/ghostscript/** mr,
  /usr/share/** r,
  /var/log/cups/cups-pdf_log w,
  /var/spool/cups/** r,
  /var/spool/cups-pdf/** rw,
  /etc/cups/cups-pdf-md1.sh uxr, # Modifikation MD
}

/usr/lib/cups/backend/cups-pdf-md2 {
  #include <abstractions/base>
  #include <abstractions/fonts>
  #include <abstractions/nameservice>
  #include <abstractions/user-tmp>

  capability chown,
  capability fowner,
  capability fsetid,
  capability setgid,
  capability setuid,

  # unfortunate, but required for when $HOME is 700
  capability dac_override,
  capability dac_read_search,

  @{PROC}/*/auxv r,

  /bin/dash ixr,
  /bin/bash ixr,
  /bin/cp ixr,
  /etc/papersize r,
  /etc/cups/cups-pdf-md2.conf r, # Modifikation MD
  @{HOME}/PDF/ rw,
  @{HOME}/PDF/* rw,
  /usr/bin/gs ixr,
  /usr/lib/cups/backend/cups-pdf mr,
  /usr/lib/ghostscript/** mr,
  /usr/share/** r,
  /var/log/cups/cups-pdf_log w,
  /var/spool/cups/** r,
  /var/spool/cups-pdf/** rw,
  /etc/cups/cups-pdf-md2.sh uxr, # Modifikation MD
}

/usr/lib/cups/backend/cups-pdf-md3 {
  #include <abstractions/base>
  #include <abstractions/fonts>
  #include <abstractions/nameservice>
  #include <abstractions/user-tmp>

  capability chown,
  capability fowner,
  capability fsetid,
  capability setgid,
  capability setuid,

  # unfortunate, but required for when $HOME is 700
  capability dac_override,
  capability dac_read_search,

  @{PROC}/*/auxv r,

  /bin/dash ixr,
  /bin/bash ixr,
  /bin/cp ixr,
  /etc/papersize r,
  /etc/cups/cups-pdf-md3.conf r, # Modifikation MD
  @{HOME}/PDF/ rw,
  @{HOME}/PDF/* rw,
  /usr/bin/gs ixr,
  /usr/lib/cups/backend/cups-pdf mr,
  /usr/lib/ghostscript/** mr,
  /usr/share/** r,
  /var/log/cups/cups-pdf_log w,
  /var/spool/cups/** r,
  /var/spool/cups-pdf/** rw,
  /etc/cups/cups-pdf-md3.sh uxr, # Modifikation MD
}

/usr/lib/cups/backend/cups-pdf-md4 {
  #include <abstractions/base>
  #include <abstractions/fonts>
  #include <abstractions/nameservice>
  #include <abstractions/user-tmp>

  capability chown,
  capability fowner,
  capability fsetid,
  capability setgid,
  capability setuid,

  # unfortunate, but required for when $HOME is 700
  capability dac_override,
  capability dac_read_search,

  @{PROC}/*/auxv r,

  /bin/dash ixr,
  /bin/bash ixr,
  /bin/cp ixr,
  /etc/papersize r,
  /etc/cups/cups-pdf-md4.conf r, # Modifikation MD
  @{HOME}/PDF/ rw,
  @{HOME}/PDF/* rw,
  /usr/bin/gs ixr,
  /usr/lib/cups/backend/cups-pdf mr,
  /usr/lib/ghostscript/** mr,
  /usr/share/** r,
  /var/log/cups/cups-pdf_log w,
  /var/spool/cups/** r,
  /var/spool/cups-pdf/** rw,
  /etc/cups/cups-pdf-md4.sh uxr, # Modifikation MD
}