I am using a custom CUPS backend for printing on Mac OS X. The backend works by forwarding the print data to another machine (using ssh) and feeding the data to the printer from there. For this to work, the backend (implemented as a shell script), needs access to an ssh private key. Problem: since I upgraded to Yosemite, the script can no longer access the file containing the key. Instead I see the following error message on the console:
sandboxd: [...] deny file-read-data /
/usr/libexec/cups/backend/.mybackend-ssh/id_dsa: Permission denied
in the CUPS error log file.
How can I inject a file into the sandbox used to isolate CUPS backends?