SELINUX_ERR using chcon to set a printer to Secret

[Matt Anderson <mra@hp.com>]

I am trying to develop the policy needed for CUPS to do labeled
printing.  I've already got:

allow sysadm_t printer_device_t:chr_file { relabelfrom relabelto };

With that loaded however I still get the following message in my audit
log when I try to do:

[sysadm_r@orb dev]# chcon -l Secret /dev/lp0

type=SELINUX_ERR msg=audit(1159469257.883:92):
security_validate_transition:  denied for
oldcontext=system_u:object_r:printer_device_t:s0
newcontext=system_u:object_r:printer_device_t:s2
taskcontext=root:sysadm_r:sysadm_t:s0-s15:c0.c255 tclass=chr_file

Is this something that can be allowed in policy?  How can I specify that
I want to authorize sysadm_r to adjust the level of a printer device file?

thanks
-matt

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.