Permission denied when filedevice prints anywhere other than /tmp/

[abingigo]

I have created a custom ppd file in /usr/share/cups/model with the following properties

*Format Version: "4.3"
*FileVersion: "1.0"
*LanguageVersion: English
*LanguageEncoding: ISOLatin1
*PCFileName: "fileprinter.ppd"
*Manufacturer: "Custom"
*Product: "(Text File Output)"
*cupsFilter: "text/plain 0 fileprinter"
*ModelName: "Text File Output"
*ShortNickName: "Text File Output"
*NickName: "Text File Output"

And made a filter in /usr/lib/cups/filter like this

#!/bin/bash
cat "$6" > <myfolder>/$3

After that, I create my printer sudo lpadmin -p fileprinter -P /usr/share/cups/model/fileprinter.ppd -v file:///dev/null -E

I then print with sudo lp -d fileprinter -s -c -t<title> <filetoprint>

If <myfolder> is /tmp, this works perfectly. I get a new file created in /tmp with all the data from <filetoprint>. Unfortunately, I want it to print elsewhere, and when I do that, the filter fails and I get this in the logs

[Job 143] /usr/lib/cups/filter/fileprinter: line 2: <myfolder>/<filename>: Permission denied

The permissions on the filter is 755, and the permissions in the target directory is 777. I have tried changing the owners and permissions multiple times to no avail. This issue occurs everywhere I tried other than in /tmp.

Is /tmp the only place filedevices can print to?

OS: RHEL 9.5
Cups version: 2.3.3

[jschwender]

a security policy may be effective. Check polkit or whatever is effective in your system.
Note: cups is actively developed on openprinting.org

[abingigo]

I used pkaction --verbose to see a list of all the policies in my system. Which one of these policies, if any, am I to change? Or is it another policy entirely?

  description:       Change printer settings
  message:           Privileges are required to change printer settings. This should only be needed from the Printers system settings panel.
  vendor:            The openSUSE Project
  vendor_url:        http://www.opensuse.org/
  icon:              printer
  implicit any:      auth_admin
  implicit inactive: auth_admin
  implicit active:   auth_admin_keep

org.opensuse.cupspkhelper.mechanism.class-edit:
  description:       Add/Remove/Edit a class
  message:           Privileges are required to add/remove/edit a class.
  vendor:            The openSUSE Project
  vendor_url:        http://www.opensuse.org/
  icon:              printer
  implicit any:      auth_admin
  implicit inactive: auth_admin
  implicit active:   auth_admin_keep

org.opensuse.cupspkhelper.mechanism.devices-get:
  description:       Get list of available devices
  message:           Privileges are required to get list of available devices.
  vendor:            The openSUSE Project
  vendor_url:        http://www.opensuse.org/
  icon:              printer
  implicit any:      auth_admin
  implicit inactive: auth_admin
  implicit active:   auth_admin_keep

org.opensuse.cupspkhelper.mechanism.job-edit:
  description:       Restart/Cancel/Edit a job
  message:           Privileges are required to restart/cancel/edit a job.
  vendor:            The openSUSE Project
  vendor_url:        http://www.opensuse.org/
  icon:              printer
  implicit any:      auth_admin
  implicit inactive: auth_admin
  implicit active:   yes

org.opensuse.cupspkhelper.mechanism.job-not-owned-edit:
  description:       Restart/Cancel/Edit a job owned by another user
  message:           Privileges are required to restart/cancel/edit a job owned by another user.
  vendor:            The openSUSE Project
  vendor_url:        http://www.opensuse.org/
  icon:              printer
  implicit any:      auth_admin
  implicit inactive: auth_admin
  implicit active:   auth_admin_keep

org.opensuse.cupspkhelper.mechanism.printer-enable:
  description:       Enable/Disable a printer
  message:           Privileges are required to enable/disable a printer, or a class.
  vendor:            The openSUSE Project
  vendor_url:        http://www.opensuse.org/
  icon:              printer
  implicit any:      auth_admin
  implicit inactive: auth_admin
  implicit active:   auth_admin_keep

org.opensuse.cupspkhelper.mechanism.printer-local-edit:
  description:       Add/Remove/Edit a local printer
  message:           Privileges are required to add/remove/edit a local printer.
  vendor:            The openSUSE Project
  vendor_url:        http://www.opensuse.org/
  icon:              printer
  implicit any:      auth_admin
  implicit inactive: auth_admin
  implicit active:   auth_admin_keep

org.opensuse.cupspkhelper.mechanism.printer-remote-edit:
  description:       Add/Remove/Edit a remote printer
  message:           Privileges are required to add/remove/edit a remote printer.
  vendor:            The openSUSE Project
  vendor_url:        http://www.opensuse.org/
  icon:              printer
  implicit any:      auth_admin
  implicit inactive: auth_admin
  implicit active:   auth_admin_keep

org.opensuse.cupspkhelper.mechanism.printer-set-default:
  description:       Set a printer as default printer
  message:           Privileges are required to set a printer, or a class, as default printer.
  vendor:            The openSUSE Project
  vendor_url:        http://www.opensuse.org/
  icon:              printer
  implicit any:      auth_admin
  implicit inactive: auth_admin
  implicit active:   auth_admin_keep

org.opensuse.cupspkhelper.mechanism.printeraddremove:
  description:       Add/Remove/Edit a printer
  message:           Privileges are required to add/remove/edit a printer.
  vendor:            The openSUSE Project
  vendor_url:        http://www.opensuse.org/
  icon:              printer
  implicit any:      auth_admin
  implicit inactive: auth_admin
  implicit active:   auth_admin_keep

org.opensuse.cupspkhelper.mechanism.server-settings:
  description:       Get/Set server settings
  message:           Privileges are required to get/set server settings.
  vendor:            The openSUSE Project
  vendor_url:        http://www.opensuse.org/
  icon:              printer
  implicit any:      auth_admin
  implicit inactive: auth_admin
  implicit active:   auth_admin_keep