Bambuddy Virtual Printer permissions?

Apps and Virtualization
,
1

Hello,

Has anyone successfully installed a Virtual Printer in Bambuddy via TrueNAS App?

I get permission errors.
Though NET_BIND_SERVICE is enabled in the App settings I see on apps.truenas.com.

I have also set Network host to enabled.

It still has issues with “services” according to the logs:

FTP server error: [Errno 13] error while attempting to bind on address
('192.168.1.102', 990): [errno 13] permission denied

Camera-322 proxy error: [Errno 13] error while attempting to bind on address
('192.168.1.101', 322): [errno 13] permission denied

Any thoughts are welcome.

2

Are 990 and 322 the ports it tries to bind to? If yes that may be an issue because i think truenas blocks ports below 9000 (at least that was an issue in the past)

3

Yes ports 990 and 332, though I understand that NET_BIND_SERVICE would allow it to access ports <1024.

4

The install wizzard only wants to publish port 30446 so i don’t know where ports 990 and 332 are coming from…

5

Correct, 332 and 990 are for FTPS and the camera I understand and with Network Host I assume you should be able to access them too, together with the NET_BIND_SERVICE .
It needs these 2 ports to start the services inside Bambuddy in order to send/receive files and enable the camera.
The printer itself works fine via Bambuddy, but not via the Virtual Printer.

But honestly this is out of my league :slight_smile:

6

With a little help of AI analyzing my log file:

$ capsh --print
Current: =
Bounding set =cap_net_bind_service
Ambient set =
Securebits: ... (no-new-privs=1)
uid=568 gid=568

The application catalog says Bambuddy can bind privileged ports, but
CAP_NET_BIND_SERVICE is only in the bounding set. It is absent from
permitted/effective/ambient sets, so the non-root service cannot bind
ports <1024.
7

The official app doesn’t work for me either, but I was able to get the Bambuddy virtual printer working by installing the docker container as a custom application.

8

Custom install instructions:

Navigate “Applications” > “Discover Apps” > “Custom App”. Configure the app as follows (leave settings on their default value if not explicitly called out in these instructions):

Application Name: bambuddy

Image Configuration

  • Repository: ghcr.io/maziggy/bambuddy

  • Tag: latest

  • Pull Policy: Pull the image if it is not already present on the host.

Container Configuration

  • Hostname: bambuddy

  • Environment Variables: PORT = 15000 (or whatever port you want to host the UI on)

  • Restart Policy: Unless Stopped

Security Context Configuration:

  • Capabilities: (add one capability)

    • Capability: NET_BIND_SERVICE

Network Configuration:

  • Host Network: ENABLE (this is required for the virtual printer)

Portal Configuration:

  • Name: Web UI

  • Protocol: HTTP

  • Use Node IP: ENABLE

  • Port: 15000 (this needs to be the same port number you configured in the environment variables)

  • Path: /

Storage: (add two storage configurations)

  • Storage 1

    • Type: ixVolume

    • Mount Path: /app/data

  • Storage 2

    • Type: ixVolume

    • Mount Path: /app/logs

Resource Configuration

  • Enable Resource Limits (optional)

Click “Update” to deploy, you might need to restart the application after initial setup if you have problems with jobs getting stuck in the queue.

9

Thanks, that works indeed. I do wonder why the official app doesn’t. Can it be that the custom app runs as root (user 0)? The official app runs as app user 568.

I also see that about 258 people have the official app installed, so I wonder if no one has the official app working with the virtual printer…

10

yeah that bounding-set vs effective thing is probably why the official chart fails and the custom one works.

in my experience ix apps often run as apps user 568 and only put NET_BIND_SERVICE in the bounding set, so the process never actually gets the cap in its permitted/effective set. custom app with host network + the capability added the way jlb2003 wrote it usually ends up with a process that can actually bind <1024.

so if virtual printer needs 990/322, custom app is probably the path until the catalog chart wires the cap through properly (or remaps those services above 1024). not ideal but at least youre not crazy. shrug