Bug 210542

Summary: CUPS doesn't work in MLS Enforcing mode
Product: [Fedora] Fedora Reporter: Matt Anderson <mra>
Component: cupsAssignee: Tim Waugh <twaugh>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: 6CC: iboverma, linda.knippers, sgrubb
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: 1.2.5-2.fc6.8 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2006-11-07 22:29:00 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 207681    
Attachments:
Description Flags
Updated cups-lspp.patch which sets spool file context correctly
none
Incremental patch versus patch id=137751
none
Updated patch that removes INFO log messages none

Description Matt Anderson 2006-10-12 19:33:56 UTC 
Description of problem:
The current CUPS code attempts to set the spool files to a ranged MLS label,
which is not allowed in Enforcing mode

Version-Release number of selected component (if applicable):
1.2.4-9

How reproducible:
Every Time.

Please update to the attached patch, which sets the spool files to the
sensitivity level of the client's context.
Comment 1 Matt Anderson 2006-10-12 19:33:57 UTC 
Created attachment 138361 [details]
Updated cups-lspp.patch which sets spool file context correctly
Comment 2 Matt Anderson 2006-10-12 19:37:21 UTC 
Created attachment 138363 [details]
Incremental patch versus patch id=137751

This patch shows just the changes between patch 138361 and patch 137751 which
was included in cups-1.2.4-9
Comment 3 Matt Anderson 2006-10-16 19:37:43 UTC 
Created attachment 138615 [details]
Updated patch that removes INFO log messages

This updated patch removes INFO log messages as requested.

It also fixes a minor SELinux issue pointed out by Chris PeBenito, when
determining if a job can access the printer the access check needs to be on
CHR_FILE__WRITE to match the char device (/dev/lp0) of the printer, not the
generic FILE__WRITE.
Comment 4 Tim Waugh 2006-10-17 13:49:21 UTC 
Fixed in CVS for FC6.
Comment 5 Tim Waugh 2006-10-23 16:49:55 UTC 
1.2.5-2.fc6.1 built and ready to go into updates-testing once FC6 is actually
released.
Comment 6 Fedora Update System 2006-11-07 22:24:41 UTC 
Fixed in update: cups-1.2.5-2.fc6.8