I've been playing around with the printing portion of the policy a bit
and would like to suggest some changes.  Looking at the source for
lpd.if it seems the the policy was originally written with a lpr/lpd in
mind that is not CUPS.  There are comments referencing a lightweight
mode, and $1_lpr_t is allowed to read and write to the spool directly.
CUPS does not do these things.  Attached is a patch I've applied to my
systems that allows CUPS to work just fine in Targeted and MLS mode with
13 less allow rules.

One side effect of this is that from $1_lpr_t access is no longer given
to print_spool_t.  If however we were then to allow access for
administrators (say: sysadm_r) to print_spool_t we can then use that
check to enable lprm and lpq for admins, but still restricting normal
users to only seeing their jobs.  This eliminates the need for the
helper program lspp-access.

Do the attached changes make sense?

Does the addition of this rule seem reasonable?

allow sysadm_lpr_t print_spool_t:file read;


Lastly in order to determine if a user is authorized to print to a given
printer based on a comparison of their level to that of the printer I'd
like to propose this rule:

allow $1_lpr_t printer_device_t:file write

Thanks
-matt