How to prevent a user from adding or removing printers?

This could be done using a PolKit policy. There are a few printer-related Polkit actions:

$ pkaction | grep -i print
org.opensuse.cupspkhelper.mechanism.printer-enable
org.opensuse.cupspkhelper.mechanism.printer-local-edit
org.opensuse.cupspkhelper.mechanism.printer-remote-edit
org.opensuse.cupspkhelper.mechanism.printer-set-default
org.opensuse.cupspkhelper.mechanism.printeraddremove

The last one seems to be the most relevant. Create a .pkla file in /etc/polkit-1/localauthority/50-local.d named, say, disable-printer-change.pkla, containing:

[Printer addition, removal]
Identity=unix-user:geraldo
Action=org.opensuse.cupspkhelper.mechanism.printeraddremove
ResultAny=no
ResultInactive=no
ResultActive=no

Replace geraldo with the appropriate username. Wildcards are supported, and you can also use groups using unix-group:<group-name>.

How to prevent a user from adding or removing printers?

Related

Recent Posts