successful cupsys admin: advantages of running pam_selinux

successful cupsys admin: advantages of running pam_selinux

[Luke Kenneth Casson Leighton]

it is with some amazement that, by adding pam_selinux to /etc/pam.d/cups
and by adding an ordinary user to the lpadmin group that i was able
to have that ordinary user set up a local printer and actually print
to it (openoffice).

i am aware that there are concerns about pam_selinux being inappropriate
for certain things - openssh being one of them due to ttys not being
managed properly, and kdm when you set AutoLogin is another.

however the prospect of having to code up a policy for doing what i
just managed to do fills me with some trepidation.

i could not tell you where to begin to get the same effect as the
lpadmin group.

six of one, half a dozen of the other.

i mention all this just in case someone thought "i know, pam_selinux
is bad, let's drop it entirely".

l.

-- 
-- 
expecting email to be received and understood is a bit like
picking up the telephone and immediately dialing without
checking for a dial-tone; speaking immediately without listening
for either an answer or ring-tone; hanging up immediately and
believing that you have actually started a conversation.
--
<a href="http://lkcl.net">      lkcl.net      </a> <br />
<a href="mailto:lkcl@lkcl.net"> lkcl@lkcl.net </a> <br />


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: successful cupsys admin: advantages of running pam_selinux

[Russell Coker]

On Sun, 6 Jun 2004 10:08, Luke Kenneth Casson Leighton <lkcl@lkcl.net> wrote:
> it is with some amazement that, by adding pam_selinux to /etc/pam.d/cups
> and by adding an ordinary user to the lpadmin group that i was able
> to have that ordinary user set up a local printer and actually print
> to it (openoffice).

How does cups use pam_selinux?

Cups doesn't spawn a shell, and even if it tried the policy does not permit 
domain transitions to user domains.

Cups doesn't have any terminal devices to relabel.

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: successful cupsys admin: advantages of running pam_selinux

[Luke Kenneth Casson Leighton]

On Sun, Jun 06, 2004 at 07:46:26PM +1000, Russell Coker wrote:
> On Sun, 6 Jun 2004 10:08, Luke Kenneth Casson Leighton <lkcl@lkcl.net> wrote:
> > it is with some amazement that, by adding pam_selinux to /etc/pam.d/cups
> > and by adding an ordinary user to the lpadmin group that i was able
> > to have that ordinary user set up a local printer and actually print
> > to it (openoffice).
> 
> How does cups use pam_selinux?
 
  umm....

> Cups doesn't spawn a shell, and even if it tried the policy does not permit 
> domain transitions to user domains.
> 
> Cups doesn't have any terminal devices to relabel.

 i'll do an experiment: i'll remove the entry pam_selinux from
 /etc/pam.d/cups and see if i can add a printer...
 
 ... and it works.  hey, that's even better.

 thanks!

 l.


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: successful cupsys admin: advantages of running pam_selinux

[Luke Kenneth Casson Leighton]

okay, so pam_selinux has nothing to do with successfully being
able to get a printer to work [and my conclusions based on the
assumption that it did are therefore invalid]

wow.  even more amazing: selinux doesn't get in the way _at all_!

On Sun, Jun 06, 2004 at 12:08:53AM +0000, Luke Kenneth Casson Leighton wrote:

> it is with some amazement that, by adding pam_selinux to /etc/pam.d/cups
> and by adding an ordinary user to the lpadmin group that i was able
> to have that ordinary user set up a local printer and actually print
> to it (openoffice).
> 
> i am aware that there are concerns about pam_selinux being inappropriate
> for certain things - openssh being one of them due to ttys not being
> managed properly, and kdm when you set AutoLogin is another.
> 
> however the prospect of having to code up a policy for doing what i
> just managed to do fills me with some trepidation.
> 
> i could not tell you where to begin to get the same effect as the
> lpadmin group.
> 
> six of one, half a dozen of the other.
> 
> i mention all this just in case someone thought "i know, pam_selinux
> is bad, let's drop it entirely".
> 
> l.

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.