Bug 210542 - CUPS doesn't work in MLS Enforcing mode
CUPS doesn't work in MLS Enforcing mode
Status: CLOSED ERRATA
Product: Fedora
Classification: Fedora
Component: cups (Show other bugs)
6
All Linux
medium Severity medium
: ---
: ---
Assigned To: Tim Waugh
:
Depends On:
Blocks: FC6Update
  Show dependency treegraph
 
Reported: 2006-10-12 15:33 EDT by Matt Anderson
Modified: 2007-11-30 17:11 EST (History)
3 users (show)

See Also:
Fixed In Version: 1.2.5-2.fc6.8
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2006-11-07 17:29:00 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
Updated cups-lspp.patch which sets spool file context correctly (72.82 KB, patch)
2006-10-12 15:33 EDT, Matt Anderson
no flags Details | Diff
Incremental patch versus patch id=137751 (12.63 KB, patch)
2006-10-12 15:37 EDT, Matt Anderson
no flags Details | Diff
Updated patch that removes INFO log messages (72.83 KB, patch)
2006-10-16 15:37 EDT, Matt Anderson
no flags Details | Diff

  None (edit)
Description Matt Anderson 2006-10-12 15:33:56 EDT
Description of problem:
The current CUPS code attempts to set the spool files to a ranged MLS label,
which is not allowed in Enforcing mode

Version-Release number of selected component (if applicable):
1.2.4-9

How reproducible:
Every Time.

Please update to the attached patch, which sets the spool files to the
sensitivity level of the client's context.
Comment 1 Matt Anderson 2006-10-12 15:33:57 EDT
Created attachment 138361 [details]
Updated cups-lspp.patch which sets spool file context correctly
Comment 2 Matt Anderson 2006-10-12 15:37:21 EDT
Created attachment 138363 [details]
Incremental patch versus patch id=137751

This patch shows just the changes between patch 138361 and patch 137751 which
was included in cups-1.2.4-9
Comment 3 Matt Anderson 2006-10-16 15:37:43 EDT
Created attachment 138615 [details]
Updated patch that removes INFO log messages

This updated patch removes INFO log messages as requested.

It also fixes a minor SELinux issue pointed out by Chris PeBenito, when
determining if a job can access the printer the access check needs to be on
CHR_FILE__WRITE to match the char device (/dev/lp0) of the printer, not the
generic FILE__WRITE.
Comment 4 Tim Waugh 2006-10-17 09:49:21 EDT
Fixed in CVS for FC6.
Comment 5 Tim Waugh 2006-10-23 12:49:55 EDT
1.2.5-2.fc6.1 built and ready to go into updates-testing once FC6 is actually
released.
Comment 6 Fedora Update System 2006-11-07 17:24:41 EST
Fixed in update: cups-1.2.5-2.fc6.8

Note You need to log in before you can comment on or make changes to this bug.