sandboxd for CUPS backends in Mac OS X Yosemite I am using a custom CUPS backend for printing on Mac OS X.  The backend works by forwarding the print data to another machine (using ssh) and feeding the data to the printer from there.  For this to work, the backend (implemented as a shell script), needs access to an ssh private key.  Problem: since I upgraded to Yosemite, the script can no longer access the file containing the key.  Instead I see the following error message on the console:

sandboxd: [...] deny file-read-data /


and

/usr/libexec/cups/backend/.mybackend-ssh/id_dsa: Permission denied


in the CUPS error log file.

How can I inject a file into the sandbox used to isolate CUPS backends?
While this doesn't answer the question, I stumbled across this - http://www.papercut.com/kb/Main/MacOS1010YosemiteKnownIssues - when trying to get Tea4CUPS working in OS X 10.10 (I was not able to achieve this):


  To get PaperCut working with Mac OS 10.10 in the interim, you’ll need to disable sandboxing. Edit the file /etc/cups/cups-files.conf to include the new line ‘Sandboxing Relaxed’. Then restart CUPS for this to take effect.


sudo sh -c 'echo "Sandboxing Relaxed" &gt;&gt; /etc/cups/cups-files.conf'
sudo launchctl stop org.cups.cupsd