From: Russell Coker <russell@coker.com.au>
To: Matt Anderson <mra@hp.com>
Cc: selinux@tycho.nsa.gov, redhat-lspp@redhat.com
Subject: Re: RFC tweak for lpd.if to make it fit CUPS
Date: Sat, 30 Sep 2006 14:23:41 +1000 [thread overview]
Message-ID: <200609301423.45245.russell@coker.com.au> (raw)
In-Reply-To: <451DEA8B.2070609@hp.com>
On Saturday 30 September 2006 13:54, Matt Anderson <mra@hp.com> wrote:
> I've been playing around with the printing portion of the policy a bit
> and would like to suggest some changes. Looking at the source for
> lpd.if it seems the the policy was originally written with a lpr/lpd in
> mind that is not CUPS.
Correct. The lpr/lpd policy was written a long time before the cups policy.
My recollection is that I wrote the cups policy to support mixed-mode systems
with lpr/lpd emulation in CUPS and easy conversion between cups and lpd.
For today's use it's probably best to just dump support for lpd. In Fedora
cups is the only supported option, for LSPP you have the same but no option
of getting lprng from extras, in Debian things are tending towards cups (and
with Debian having more support for modules we can probably switch between
cups and lpd modules).
> There are comments referencing a lightweight
> mode, and $1_lpr_t is allowed to read and write to the spool directly.
> CUPS does not do these things. Attached is a patch I've applied to my
> systems that allows CUPS to work just fine in Targeted and MLS mode with
> 13 less allow rules.
That seems fine to me.
> Does the addition of this rule seem reasonable?
>
> allow sysadm_lpr_t print_spool_t:file read;
Yes.
> Lastly in order to determine if a user is authorized to print to a given
> printer based on a comparison of their level to that of the printer I'd
> like to propose this rule:
>
> allow $1_lpr_t printer_device_t:file write
That's fine, but it will need a clear comment to avoid the risk of having it
copied inappropriately in future.
--
russell@coker.com.au
http://etbe.blogspot.com/ My Blog
http://www.coker.com.au/sponsorship.html Sponsoring Free Software development
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
next prev parent reply other threads:[~2006-09-30 4:24 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2006-09-30 3:54 RFC tweak for lpd.if to make it fit CUPS Matt Anderson
2006-09-30 4:23 ` Russell Coker [this message]
2006-10-02 14:02 ` Christopher J. PeBenito
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=200609301423.45245.russell@coker.com.au \
--to=russell@coker.com.au \
--cc=mra@hp.com \
--cc=redhat-lspp@redhat.com \
--cc=selinux@tycho.nsa.gov \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.