[refpolicy] AVC denials from cups

[mra@hp.com (Matt Anderson)]

JOhn ROss POrter wrote:
> I don't know how to distinguish between "to get extra functionality", 
> and "driver is requesting."  I submit a print job to the device which 
> uses the hp:/net/Office... URI and I get AVC denial pop-ups.

You had mentioned that the hplip driver allows you to get more
functionality than just printing.  I was wondering if the AVCs were
generated from those requests, or the printing requests, or what was
seemingly random from the driver.

> I should also mention, again(?), that I run SELinux in "permissive" 
> mode.  The AVC warnings are just an annoyance and to not prohibit 
> further activities.

It could be interesting to see how the system behaves in enforcing mode.
You could remove your policy additions and see if you're still able to
print and access the scanning and printer display feedback
functionality, then add your policy module back in, and see what works.

> My reason for filing this bug report derived from following
> suggestions 
> received from the #selinux channel on the freenode IRC Network.
>  From my own point of view, this issue may be dropped.  The thread may 
> prove helpful, however, to anyone else installing the 2.8.7 level of
> hplip.

I don't recall you posting the rules in your policy module here.  It
might be good to do that so that its all archived in the same place.

> Thanks for your attention,
> Joropo

Thanks for bringing it up.
-matt