Re: Patch: add ACL for parallel printer and scanner

["Karl O. Pinc" <kop@meme.com>]

On 10/07/2009 12:40:25 PM, Frederic Crozat wrote:
> Le mercredi 07 octobre 2009 à 18:59 +0200, Martin Pitt a écrit :
> > Frederic Crozat [2009-10-07 18:31 +0200]:
> > > > This grants access to any device connected, to the parallel
> port, and
> > > > is not limited to printers or scanners, right?
> > > >   KERNEL="parport[0-9]*",  ENV{ACL_MANAGE}="1"
> > > 
> > > Yes, since there is no possible autodetection on it.

> > I'd really like to avoid it for printers, see above.
> 
> As far as I know, there is no way to detect the device plugged on a
> parallel port, so I don't see how we could allow only access for
> scanner
> and not for printer (unless we move the ACL to sane package but it
> isn't
> a real protection).

I have a stupid idea, firmly grounded in ignorance
and grown in the hothouse of klugery.  Take it
for what it's worth.

If you wrote a kernel driver/module
that does nothing but read a config file and create a
"dummy" device node (for detection by KERNEL=foo) based on 
the parallel scanner connectivity information in a config 
file then udev could set device permissions that are appropriate
for the scanner while leaving printer parallel ports alone.
The config file would specify which parallel port is plugged
into the scanner, default to parport0, and be installed
along with the kernel module only when the sane 
"parallel-scanner" application package is installed.

I know nothing about parallel scanners but perhaps
there is some way that the "driver" could probe the parallel
ports to autodetect -- printers do not normally respond
to commands and send a lot of data to the CPU over the
parallel port.

This would reduce the end-user's problem to installing
a package supporting parallel scanners.

Karl <kop@meme.com>
Free Software:  "You don't pay back, you pay forward."
                 -- Robert A. Heinlein