successful cupsys admin: advantages of running pam_selinux

[Luke Kenneth Casson Leighton <lkcl@lkcl.net>]

it is with some amazement that, by adding pam_selinux to /etc/pam.d/cups
and by adding an ordinary user to the lpadmin group that i was able
to have that ordinary user set up a local printer and actually print
to it (openoffice).

i am aware that there are concerns about pam_selinux being inappropriate
for certain things - openssh being one of them due to ttys not being
managed properly, and kdm when you set AutoLogin is another.

however the prospect of having to code up a policy for doing what i
just managed to do fills me with some trepidation.

i could not tell you where to begin to get the same effect as the
lpadmin group.

six of one, half a dozen of the other.

i mention all this just in case someone thought "i know, pam_selinux
is bad, let's drop it entirely".

l.

-- 
-- 
expecting email to be received and understood is a bit like
picking up the telephone and immediately dialing without
checking for a dial-tone; speaking immediately without listening
for either an answer or ring-tone; hanging up immediately and
believing that you have actually started a conversation.
--
<a href="http://lkcl.net">      lkcl.net      </a> <br />
<a href="mailto:lkcl@lkcl.net"> lkcl@lkcl.net </a> <br />


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.