* Auditing printing
@ 2018-05-01 18:05 warron.french
2018-05-01 18:20 ` Steve Grubb
0 siblings, 1 reply; 5+ messages in thread
From: warron.french @ 2018-05-01 18:05 UTC (permalink / raw)
To: Linux-Audit Mailing List
[-- Attachment #1.1: Type: text/plain, Size: 530 bytes --]
I have a requirement to monitor two (2) things:
1. Print to file
2. Print to (printer) device
What is the best approach for this? I don't see a syscall that looks
appropriate - but that doesn't mean there is not one.
Would I simply do an audit on the *lpr* command? Or is it another command?
I need the ability to monitor printing to both file and device, *FROM*,
linux shell as well as console or GUI.
Can someone advise me on how to accomplish this please?
Thanks in advance,
--------------------------
Warron French
[-- Attachment #1.2: Type: text/html, Size: 1113 bytes --]
[-- Attachment #2: Type: text/plain, Size: 0 bytes --]
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: Auditing printing
2018-05-01 18:05 Auditing printing warron.french
@ 2018-05-01 18:20 ` Steve Grubb
2018-05-01 18:29 ` warron.french
0 siblings, 1 reply; 5+ messages in thread
From: Steve Grubb @ 2018-05-01 18:20 UTC (permalink / raw)
To: linux-audit
On Tuesday, May 1, 2018 2:05:36 PM EDT warron.french wrote:
> I have a requirement to monitor two (2) things:
>
> 1. Print to file
>
> 2. Print to (printer) device
>
>
> What is the best approach for this?
Cups should be hardwired to audit.
# ldd /usr/sbin/cupsd | grep audit
libaudit.so.1 => /lib64/libaudit.so.1 (0x00007f04f1cfa000)
It's been a long time since I looked at this.
-Steve
> I don't see a syscall that looks
> appropriate - but that doesn't mean there is not one.
>
> Would I simply do an audit on the *lpr* command? Or is it another command?
>
> I need the ability to monitor printing to both file and device, *FROM*,
> linux shell as well as console or GUI.
>
> Can someone advise me on how to accomplish this please?
>
>
> Thanks in advance,
> --------------------------
> Warron French
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: Auditing printing
2018-05-01 18:20 ` Steve Grubb
@ 2018-05-01 18:29 ` warron.french
2018-05-01 21:53 ` Steve Grubb
0 siblings, 1 reply; 5+ messages in thread
From: warron.french @ 2018-05-01 18:29 UTC (permalink / raw)
To: Steve Grubb; +Cc: Linux-Audit Mailing List
[-- Attachment #1.1: Type: text/plain, Size: 1145 bytes --]
OK, so that will cover from CLI as well as something in the gui like
Firefox?
For both printing to a print device as well as to a file?
--------------------------
Warron French
On Tue, May 1, 2018 at 2:20 PM, Steve Grubb <sgrubb@redhat.com> wrote:
> On Tuesday, May 1, 2018 2:05:36 PM EDT warron.french wrote:
> > I have a requirement to monitor two (2) things:
> >
> > 1. Print to file
> >
> > 2. Print to (printer) device
> >
> >
> > What is the best approach for this?
>
> Cups should be hardwired to audit.
>
> # ldd /usr/sbin/cupsd | grep audit
> libaudit.so.1 => /lib64/libaudit.so.1 (0x00007f04f1cfa000)
>
> It's been a long time since I looked at this.
>
> -Steve
>
> > I don't see a syscall that looks
> > appropriate - but that doesn't mean there is not one.
> >
> > Would I simply do an audit on the *lpr* command? Or is it another
> command?
> >
> > I need the ability to monitor printing to both file and device, *FROM*,
> > linux shell as well as console or GUI.
> >
> > Can someone advise me on how to accomplish this please?
> >
> >
> > Thanks in advance,
> > --------------------------
> > Warron French
>
>
>
>
>
[-- Attachment #1.2: Type: text/html, Size: 1994 bytes --]
[-- Attachment #2: Type: text/plain, Size: 0 bytes --]
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: Auditing printing
2018-05-01 18:29 ` warron.french
@ 2018-05-01 21:53 ` Steve Grubb
2018-05-01 23:57 ` warron.french
0 siblings, 1 reply; 5+ messages in thread
From: Steve Grubb @ 2018-05-01 21:53 UTC (permalink / raw)
To: warron.french; +Cc: Linux-Audit Mailing List
On Tuesday, May 1, 2018 2:29:56 PM EDT warron.french wrote:
> OK, so that will cover from CLI as well as something in the gui like
> Firefox?
>
> For both printing to a print device as well as to a file?
I haven't looked at this code in a very long time. So, I don't remember how
to enable it to test it. But it should have full coverage to meet export
requirements for LSPP way back on RHEL 5. The code has been ported all these
years and is supposed to still work.
-Steve
> On Tue, May 1, 2018 at 2:20 PM, Steve Grubb <sgrubb@redhat.com> wrote:
> > On Tuesday, May 1, 2018 2:05:36 PM EDT warron.french wrote:
> > > I have a requirement to monitor two (2) things:
> > >
> > > 1. Print to file
> > >
> > > 2. Print to (printer) device
> > >
> > >
> > > What is the best approach for this?
> >
> > Cups should be hardwired to audit.
> >
> > # ldd /usr/sbin/cupsd | grep audit
> >
> > libaudit.so.1 => /lib64/libaudit.so.1 (0x00007f04f1cfa000)
> >
> > It's been a long time since I looked at this.
> >
> > -Steve
> >
> > > I don't see a syscall that looks
> > > appropriate - but that doesn't mean there is not one.
> > >
> > > Would I simply do an audit on the *lpr* command? Or is it another
> >
> > command?
> >
> > > I need the ability to monitor printing to both file and device, *FROM*,
> > > linux shell as well as console or GUI.
> > >
> > > Can someone advise me on how to accomplish this please?
> > >
> > >
> > > Thanks in advance,
> > > --------------------------
> > > Warron French
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: Auditing printing
2018-05-01 21:53 ` Steve Grubb
@ 2018-05-01 23:57 ` warron.french
0 siblings, 0 replies; 5+ messages in thread
From: warron.french @ 2018-05-01 23:57 UTC (permalink / raw)
To: Steve Grubb; +Cc: Linux-Audit Mailing List
[-- Attachment #1.1: Type: text/plain, Size: 1766 bytes --]
Thanks for the feedback Steve.
--------------------------
Warron French
On Tue, May 1, 2018 at 5:53 PM, Steve Grubb <sgrubb@redhat.com> wrote:
> On Tuesday, May 1, 2018 2:29:56 PM EDT warron.french wrote:
> > OK, so that will cover from CLI as well as something in the gui like
> > Firefox?
> >
> > For both printing to a print device as well as to a file?
>
> I haven't looked at this code in a very long time. So, I don't remember
> how
> to enable it to test it. But it should have full coverage to meet export
> requirements for LSPP way back on RHEL 5. The code has been ported all
> these
> years and is supposed to still work.
>
> -Steve
>
> > On Tue, May 1, 2018 at 2:20 PM, Steve Grubb <sgrubb@redhat.com> wrote:
> > > On Tuesday, May 1, 2018 2:05:36 PM EDT warron.french wrote:
> > > > I have a requirement to monitor two (2) things:
> > > >
> > > > 1. Print to file
> > > >
> > > > 2. Print to (printer) device
> > > >
> > > >
> > > > What is the best approach for this?
> > >
> > > Cups should be hardwired to audit.
> > >
> > > # ldd /usr/sbin/cupsd | grep audit
> > >
> > > libaudit.so.1 => /lib64/libaudit.so.1 (0x00007f04f1cfa000)
> > >
> > > It's been a long time since I looked at this.
> > >
> > > -Steve
> > >
> > > > I don't see a syscall that looks
> > > > appropriate - but that doesn't mean there is not one.
> > > >
> > > > Would I simply do an audit on the *lpr* command? Or is it another
> > >
> > > command?
> > >
> > > > I need the ability to monitor printing to both file and device,
> *FROM*,
> > > > linux shell as well as console or GUI.
> > > >
> > > > Can someone advise me on how to accomplish this please?
> > > >
> > > >
> > > > Thanks in advance,
> > > > --------------------------
> > > > Warron French
>
>
>
>
>
[-- Attachment #1.2: Type: text/html, Size: 2964 bytes --]
[-- Attachment #2: Type: text/plain, Size: 0 bytes --]
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2018-05-01 23:57 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2018-05-01 18:05 Auditing printing warron.french
2018-05-01 18:20 ` Steve Grubb
2018-05-01 18:29 ` warron.french
2018-05-01 21:53 ` Steve Grubb
2018-05-01 23:57 ` warron.french
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox