Since last update i can't print

English Applications
1

Hi,
I need some help. Since the last system update I can’t print any document.
In the CUPS log file the following error appears:
‘cfFilterGhostscript: bwrap: Can't mount proc on /newroot/proc: Operation not permitted’

Any idea of what is happening?

Thanks in advance for any help.

2

Maybe a flatpack issue?

3

I do not use it. I install allways the old way my software (rpm)

4

Is this a new TW installation? Is SELinux in use?

Run bwrap --ro-bind / / echo "sandbox works"

This test will have the sandboxing utility take the root filesystem / and mount it as / inside the sandbox, and if it succeeds, you’ll see sandbox works printed.

5

BTW, if it fails, check
sudo ausearch -m avc -ts today
and report back.

6

No, it is an old installation, with apparmor. I am not aware of the installation of SELinux.
Your command did work and displayed the message “sandbox works”

7 
sudo ausearch -m avc -ts today
[----
time->Mon Feb 16 09:30:26 2026
type=AVC msg=audit(1771230626.942:236): apparmor="STATUS" operation="profile_replace" profile="unconfined" name="/usr/libexec/snapd/snap-confine" pid=1374 comm=
"apparmor_parser"
----
time->Mon Feb 16 09:30:26 2026
type=AVC msg=audit(1771230626.949:237): apparmor="STATUS" operation="profile_replace" profile="unconfined" name="/usr/libexec/snapd/snap-confine//mount-namespac
e-capture-helper" pid=1374 comm="apparmor_parser"
----
time->Mon Feb 16 12:44:57 2026
type=AVC msg=audit(1771242297.136:237): apparmor="STATUS" operation="profile_replace" profile="unconfined" name="/usr/libexec/snapd/snap-confine" pid=1360 comm=
"apparmor_parser"
----
time->Mon Feb 16 12:44:57 2026
type=AVC msg=audit(1771242297.150:238): apparmor="STATUS" operation="profile_replace" profile="unconfined" name="/usr/libexec/snapd/snap-confine//mount-namespac
e-capture-helper" pid=1360 comm="apparmor_parser"
----
time->Mon Feb 16 18:35:24 2026
type=AVC msg=audit(1771263324.081:236): apparmor="STATUS" operation="profile_replace" profile="unconfined" name="/usr/libexec/snapd/snap-confine" pid=1363 comm=
"apparmor_parser"
----
time->Mon Feb 16 18:35:24 2026
type=AVC msg=audit(1771263324.094:238): apparmor="STATUS" operation="profile_replace" profile="unconfined" name="/usr/libexec/snapd/snap-confine//mount-namespac
e-capture-helper" pid=1363 comm="apparmor_parser"
----
time->Mon Feb 16 20:20:20 2026
type=AVC msg=audit(1771269620.689:236): apparmor="STATUS" operation="profile_replace" profile="unconfined" name="/usr/libexec/snapd/snap-confine" pid=1379 comm=
"apparmor_parser"
----
time->Mon Feb 16 20:20:20 2026
type=AVC msg=audit(1771269620.699:237): apparmor="STATUS" operation="profile_replace" profile="unconfined" name="/usr/libexec/snapd/snap-confine//mount-namespac
e-capture-helper" pid=1379 comm="apparmor_parser"
8

I checked it, and SELinux was installed automatically.
It is on my system, as well as apparmor (since the beginning)

9

Thanks for the formating of the terminal text. How do i do this myself?

10

Refer to the following guide:

1 Like
11

Let’s try
sudo -u lp bwrap --ro-bind / / echo "sandbox works"
If that fails then the restriction applies specifically form a CUPS context.

12

Can you show the results from
/usr/sbin/getenforce
and
/usr/sbin/aa-status

13

/usr/sbin/getenforce
…
Disabled
…

/usr/sbin/aa-status
…
apparmor module is loaded.
You do not have enough privilege to read the profile set.
…

14

All good - that confirms AppArmor active.

15

All good - that confirms AppArmor active.

Can you try the command I gave in post #11?

16 
sudo -u lp bwrap --ro-bind / / echo "sandbox works"
sandbox works
17

Ok, that is as expected.

18

Is it only particular file types trigger the error? (PDF, image, text)?

19 
D [16/Feb/2026:19:33:00 +0100] [Job 686] cfFilterGhostscript: Started Ghostscript (PID 10086)
D [16/Feb/2026:19:33:00 +0100] [Job 686] cfFilterGhostscript: Started logging (PID 10087)
D [16/Feb/2026:19:33:00 +0100] [Job 686] cfFilterGhostscript: Input data feed completed
D [16/Feb/2026:19:33:00 +0100] [Job 686] cfFilterGhostscript: bwrap: Can\'t mount proc on /newroot/proc: Operation not permitted
D [16/Feb/2026:19:33:00 +0100] [Job 686] Set job-printer-state-message to "cfFilterGhostscript: Ghostscript (PID 10086) stopped with status 1", current level=ERROR

That is the part od teh CUPS log with error. So Ghostsricpt is the programme running (gs), but i don’t now if it is under the ‘lp’ user or what other user

20

Use the “`” backtick character. Three in a row before and after multi-line code.

1 Like