Well, this should be fun to fix. It seems we have setuid/setgid, group membership issues for LPRNG, and this is bad (though not in an exploits way). Here is the email that pointed it out: --- Bill, In porting the Pinstripe srpms to Linuxppc I discovered what I think is a flaw in the LPRng spec. On my machine running the Pinstripe rpms I find that the stock LPRng spec results in users being unable to print files from their own directories when their directories have restricted permissions like drwx------. In such cases I get an error message that the lpr can't open the file to be printed. What I noticed was that the LPRng.spec had... %attr(4755,lp,lp) %{_bindir}/lpq %attr(4755,lp,lp) %{_bindir}/lprm %attr(4755,lp.lp) %{_bindir}/lpr %attr(4755,lp,lp) %{_bindir}/lpstat in the file list. Shouldn't this be.... %attr(4755,root,lp) %{_bindir}/lpq %attr(4755,root,lp) %{_bindir}/lprm %attr(4755,root,lp) %{_bindir}/lpr %attr(4755,root,lp) %{_bindir}/lpstat On my machine that change solves the problem and matches what was in the lpr spec from RedHat 6.2.... %attr(6555,root,lp) /usr/bin/lpq %attr(6555,root,lp) /usr/bin/lpr %attr(6555,root,lp) /usr/bin/lprm
I think that this, and many other issues are handled by removing the sticky bits from the client programs. So that's what I did. I also removed the bit from the lpc control program.
I think this is all closed up now.