Apparmor interferes with CUPS PDF print

Could the issue be something other than apparmor? A 24.04 system on the same network gives the same DENIED type messages but, the print to PDF happens. On 26.04, I see no output file at all when the print is coming from another system on the LAN

Using 26.04. CUPS print to PDF is working when the originator of the file is on the 26.04 system. The CUPS PDF print is shared with other systems in my local area network. At attempt print to PDF from an XP system in my local area network is failing. The system log contains a few lines such as this

2026-07-16T21:23:36.032922-05:00 localhost kernel: audit: type=1400 audit(1784255016.031:150402): apparmor="DENIED" operation="connect" class="file" profile="/usr/lib/cups/backend/cups-pdf" name="/run/samba/winbindd/pipe" pid=1158626 comm="cups-pdf" requested_mask="wr" denied_mask="wr" fsuid=0 ouid=0

Due to the presence of an XP system in my local area network, winbind is installed.

I've got rid of the above message from syslog by disabling apparmor with regard to cupsd (I think) but messages about dbus-daemon persist, an example is:

2026-07-17T10:06:37.333138-05:00 localhost kernel: audit: type=1107 audit(1784300797.331:152868): pid=1310 uid=995 auid=4294967295 ses=4294967295 subj=unconfined msg='apparmor="DENIED" operation="dbus_signal" bus="system" path="/com/redhat/PrinterSpooler" interface="com.redhat.PrinterSpooler" member="JobQueuedLocal" name=":1.8991" mask="receive" pid=349875 label="unconfined" peer_pid=1168372 peer_label="/usr/sbin/cupsd" peer_info="No such file or directory"

What do I need to change so that this works?

Regarding AppArmor denials - it sounds like AppArmor bug. The nss_winbind module communicates with winbindd over the named pipe. The current default location is /var/run/samba/winbindd/pipe. But this location is not mentioned anywhere in AppArmor profiles - the /etc/apparmor.d/abstractions/winbind defines the /tmp/.winbindd/pipe which indeed was used by default in the past.

Try adding this path locally and see if it fixes the AppArmor denials:

mkdir /etc/apparmor.d/abstractions/winbind.d
echo '  @{run}/samba/winbindd/pipe rw,' > /etc/apparmor.d/abstractions/winbind.d/pipe

You would need to reload profiles that include this file, the most clean approach is rebooting. Of course you would need to disable complaint mode again to test it.