Re: RFC tweak for lpd.if to make it fit CUPS

["Christopher J. PeBenito" <cpebenito@tresys.com>]

On Sat, 2006-09-30 at 14:23 +1000, Russell Coker wrote:
> On Saturday 30 September 2006 13:54, Matt Anderson <mra@hp.com> wrote:
> > I've been playing around with the printing portion of the policy a bit
> > and would like to suggest some changes.  Looking at the source for
> > lpd.if it seems the the policy was originally written with a lpr/lpd in
> > mind that is not CUPS.
> 
> Correct.  The lpr/lpd policy was written a long time before the cups policy.  
> My recollection is that I wrote the cups policy to support mixed-mode systems 
> with lpr/lpd emulation in CUPS and easy conversion between cups and lpd.
> 
> For today's use it's probably best to just dump support for lpd.  In Fedora 
> cups is the only supported option, for LSPP you have the same but no option 
> of getting lprng from extras, in Debian things are tending towards cups (and 
> with Debian having more support for modules we can probably switch between 
> cups and lpd modules).

Seems that we're going to have to split lpr out again, and turn it into
a mta-like setup.

> > There are comments referencing a lightweight 
> > mode, and $1_lpr_t is allowed to read and write to the spool directly.
> > CUPS does not do these things.  Attached is a patch I've applied to my
> > systems that allows CUPS to work just fine in Targeted and MLS mode with
> > 13 less allow rules.
> 
> That seems fine to me.

If we split out lpr, then we can make all the rules optional on lpd or
cups, depending on what is installed.  I'd rather not remove the rules
completely unless we can confirm it doesn't need these rules, otherwise
lpd support may break.

-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.