I have a small Linux server (Ubuntu Server, 12.04 LTS) which is serving as a print release server. Essentially, I have defined a CUPS printer, and added Option job-hold-until indefinite to the entry in printers.conf so guests to the library can pay cash for their printouts, and someone at the desk can click "Release Job" in the CUPS web interface to send it to the printer.
The problem is that periodically the CUPS web interface will stop responding. The error log will fill up with messages like this:
E [10/Sep/2013:13:28:04 -0500] Unable to create certificate file /var/run/cups/certs/0 - Too many open files
E [10/Sep/2013:13:28:04 -0500] [CGI] Unable to create pipe for /usr/lib/cups/cgi-bin/jobs.cgi - Too many open files
E [10/Sep/2013:13:28:04 -0500] Unable to create certificate file /var/run/cups/certs/0 - Too many open files
The bulk of the messages have to do with files that have to do with SSL encryption for the web interface. It appears to be opening them and then never closing them, until it starts hitting the "Too many open files" error.
We don't really need SSL encryption for this. It's already fire-walled off to just IPs for staff computers inside the building. So the first time this happened, I attempted to disable SSL entirely by adding DefaultEncryption Never to cupsd.conf. We can access the web interface without SSL now, but the problem recurred this morning anyway.
So ... how do I persuade CUPS to 1) close the files when it's done with them, or B) not open them in the first place?
Further research indicated this problem was caused by AppArmor, an Ubuntu security mechanism. It was interfering with CUPS usual access, and CUPS didn't know what to do about it. To resolve the problem, I disabled the CUPS profile in AppArmor: