Bug 120054

Here's another audit message.  This comes from trying to print to an
HP all-in-one:

audit(1081184286.786:0): avc:  denied  { write } for  pid=30952
exe=/usr/bin/ptal-connect name=usb:PSC_2200_Series dev=hda2
ino=1017121 scontext=system_u:system_r:cupsd_t
tcontext=system_u:object_r:var_run_t tclass=sock_file

For completeness here are the audit messages from permissive mode, so
we can see all the hurdles at once.

Printing something:

audit(1082384337.766:0): avc:  denied  { write } for  pid=10888
exe=/usr/bin/ptal-connect name=usb:PSC_2200_Series dev=hda2
ino=1017118 scontext=system_u:system_r:cupsd_t
tcontext=root:object_r:var_run_t tclass=sock_file
audit(1082384337.804:0): avc:  denied  { connectto } for  pid=10888
exe=/usr/bin/ptal-connect path=/var/run/ptal-mlcd/usb:PSC_2200_Series
scontext=system_u:system_r:cupsd_t tcontext=root:system_r:initrc_t
tclass=unix_stream_socket

And scanning:

audit(1082384628.518:0): avc:  denied  { write } for  pid=10937
exe=/usr/bin/xsane-gimp name=usb:PSC_2200_Series dev=hda2 ino=1017118
scontext=user_u:user_r:user_t tcontext=root:object_r:var_run_t
tclass=sock_file
audit(1082384628.519:0): avc:  denied  { connectto } for  pid=10937
exe=/usr/bin/xsane-gimp path=/var/run/ptal-mlcd/usb:PSC_2200_Series
scontext=user_u:user_r:user_t tcontext=root:system_r:initrc_t
tclass=unix_stream_socket

So what's the best way to fix this do you think?

Created attachment 99995 [details]
policy-hpoj.patch

Here is a first stab at getting printing working, at least.  How does it look? 
Should I try the same approach for scanning?

Created attachment 100034 [details]
policy-hpoj.patch

Here's a fixed version of the print patch.

For scanning I'm not sure what to do.  Make xsane-gimp, xsane,
scanimage et al all 'scan_t' or something, and go from there?

Or should we let user_t processes connect to ptal sockets (as normal)?

Created attachment 100118 [details]
policy-hpoj-fc.patch

Here's an incremental fix to correct the file contexts on
/var/run/ptal-{printd,mlcd}/* if they already exist. (It's only a problem if
you run setfiles on /var while hpoj is running.)

No idea what to do for scanning, as I mentioned in comment #5.  Needs
input from someone who has better judgment about policy.

Russell do you have ideas on this?

We are working the scanning problem in #140059

So I am closing this bug report.

another big ass link dump porn spot i robbed yesterday is this beast called pornmovies.name and straight talk its a bottomless pit of smash worthy shit that keeps the blood pumping hard. imagine sorting by latest uploads and every third clip is a brand fresh milf lesbo pussy feast where strong thighed moms eat each other out then invite a lucky pool boy to cum all over their stacked boobs. i pulled tube after tube of group sex, gangbangs, office ass pounding, teeny tiny step-sister creampie mistakes - whatever animal instinct floats your nut. best part unlike those lame paysites hitting paywalls after twenty seconds this thing loads endless gonzo pounding vids bigger than most member areas. stick this url next to your bong lighter for those marathon weekend sessions bro.
https://freeporn.ooo/video/114378/18-year-old-first-timer-s-blowjob-skills/
https://coozeporn.com/video/gorgeous-slut-with-perfect-tits-gets-fucked-and-sucked-on-a-sofa/
https://pornmovies.name/video/3020/cumshot-in-the-mouth-of-an-18-year-old-girl-in-stockings-after-blowjob-and-hard-sex/


found somethin new this morning while red-eyed and pizza horny, some link said check coozeporn and whoa bro they ain't joking trailers blast tits at ya right on the main page. clicked the mature tags first cos nothing hotter than saggy boob milfs up wrath riding cock like pro, found grandmom-giler taking two college boys threeway older cums all over her wrinkle cheeks.<|reserved_token_163712|> skipped over to busty asian teens big natural melons getting titty fucked till dude dumps thick goop on face. 
they update glutton style every few hours so nothing crusty accumulates, plus tabs open like fifty variations hardcore xxx parody librarian gets fucked on bookshelves secretary lets boss pound pussy across fax machine classic clichés we all jerk to. 
browser calloused finger scroll endless pop fresh creamy sex eye candy canopy somehow free nobody begging for cards, no questions straight fap champion zone iam lovin it after two blunts already north korea focus just cum till keyboard sticky hgahahaha hopeless.