Re: successful cupsys admin: advantages of running pam_selinux

[Luke Kenneth Casson Leighton <lkcl@lkcl.net>]

okay, so pam_selinux has nothing to do with successfully being
able to get a printer to work [and my conclusions based on the
assumption that it did are therefore invalid]

wow.  even more amazing: selinux doesn't get in the way _at all_!

On Sun, Jun 06, 2004 at 12:08:53AM +0000, Luke Kenneth Casson Leighton wrote:

> it is with some amazement that, by adding pam_selinux to /etc/pam.d/cups
> and by adding an ordinary user to the lpadmin group that i was able
> to have that ordinary user set up a local printer and actually print
> to it (openoffice).
> 
> i am aware that there are concerns about pam_selinux being inappropriate
> for certain things - openssh being one of them due to ttys not being
> managed properly, and kdm when you set AutoLogin is another.
> 
> however the prospect of having to code up a policy for doing what i
> just managed to do fills me with some trepidation.
> 
> i could not tell you where to begin to get the same effect as the
> lpadmin group.
> 
> six of one, half a dozen of the other.
> 
> i mention all this just in case someone thought "i know, pam_selinux
> is bad, let's drop it entirely".
> 
> l.

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.