Bug 564551 - Failure to own /usr/share/hplip/prnt/plugins/ directory leads to print failure
Summary: Failure to own /usr/share/hplip/prnt/plugins/ directory leads to print failure
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: hplip
Version: 12
Hardware: All
OS: Linux
medium
high
Target Milestone: ---
Assignee: Tim Waugh
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
: 538441 552725 (view as bug list)
Depends On:
Blocks: 565875
TreeView+ depends on / blocked
 
Reported: 2010-02-13 07:56 UTC by David Anderson
Modified: 2010-04-21 11:20 UTC (History)
4 users (show)

Fixed In Version: hplip-3.10.2-2.fc12
Doc Type: Bug Fix
Doc Text:
Clone Of:
: 565875 (view as bug list)
Environment:
Last Closed: 2010-04-03 04:36:48 UTC
Type: ---


Attachments (Terms of Use)

Description David Anderson 2010-02-13 07:56:48 UTC
Description of problem:

Some HP printers require installation of a proprietary plugin. One is the HP 1018, an extremely popular budget laser. (Here in Kenya, it accounts for the majority of printers you will see). Happily, hplip-gui takes care of the plugin: just point and click.

However, printing does not work because SELinux forbids access to the plugin. This is because the directory /usr/share/hplip/prnt/plugins/ does not exist by default, and hplip creates it. However, when created it gets a default label of usr_t which is inherited from /usr/share/hplip/prnt/.

The plugin needs to be lib_t. This is in SELinux policy, but it will only pick it up after a relabel. I believe that if /usr/share/hplip/prnt/plugins was included in the hplip package, then the label would be correct automatically without needing intervention. (The SELinux troubleshooter pops up, and its advice is happily correct).

P.S. I filed a bug about this in Fedora 9 - it never got fixed, and when I upgraded to 12 it was still there. :-(

Version-Release number of selected component (if applicable): hplip-3.9.8-21.fc12


How reproducible: Every time


Steps to Reproduce:
1. Plugin in HP 1018 printer
2. Message tells you to install plugin. Do this via hplip-gui
3. Try to print
  
Actual results:

SELinux denial:

type=AVC msg=audit(1264613185.579:103): avc:  denied  { execute } for  pid=3760 comm="hpcups" path="/usr/share/hplip/prnt/plugins/lj-x86_64.so" dev=dm-0 ino=272806 scontext=system_u:system_r:cupsd_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:usr_t:s0 tclass=file

type=SYSCALL msg=audit(1264613185.579:103): arch=c000003e syscall=9 success=no exit=-13 a0=0 a1=210000 a2=5 a3=802 items=0 ppid=1029 pid=3760 auid=4294967295 uid=4 gid=7 euid=4 suid=4 fsuid=4 egid=7 sgid=7 fsgid=7 tty=(none) ses=4294967295 comm="hpcups" exe="/usr/lib/cups/filter/hpcups" subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 key=(null)


Additional info:

Problem is fixed by /sbin/restorecon '/usr/share/hplip/prnt/plugins/*', but this would be unnecessary if the hplip RPM included the 'plugins' directory.

Comment 1 David Anderson 2010-02-13 07:58:34 UTC
Sorry, "Additional info:" should read:

Problem is fixed by /sbin/restorecon -r '/usr/share/hplip/prnt/plugins/', but
this would be unnecessary if the hplip RPM included the 'plugins' directory.

Comment 2 Tim Waugh 2010-02-16 15:52:38 UTC
*** Bug 538441 has been marked as a duplicate of this bug. ***

Comment 3 Fedora Update System 2010-02-16 16:09:14 UTC
hplip-3.9.8-29.fc12 has been submitted as an update for Fedora 12.
http://admin.fedoraproject.org/updates/hplip-3.9.8-29.fc12

Comment 4 Fedora Update System 2010-02-18 22:27:07 UTC
hplip-3.9.8-29.fc12 has been pushed to the Fedora 12 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update hplip'.  You can provide feedback for this update here: http://admin.fedoraproject.org/updates/F12/FEDORA-2010-1623

Comment 5 Fedora Update System 2010-02-27 20:35:57 UTC
hplip-3.10.2-1.fc12 has been submitted as an update for Fedora 12.
http://admin.fedoraproject.org/updates/hplip-3.10.2-1.fc12

Comment 6 Fedora Update System 2010-03-02 01:10:17 UTC
hplip-3.10.2-1.fc12 has been pushed to the Fedora 12 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update hplip'.  You can provide feedback for this update here: http://admin.fedoraproject.org/updates/F12/FEDORA-2010-3332

Comment 7 Fedora Update System 2010-03-24 23:39:08 UTC
hplip-3.10.2-2.fc12 has been pushed to the Fedora 12 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update hplip'.  You can provide feedback for this update here: http://admin.fedoraproject.org/updates/hplip-3.10.2-2.fc12

Comment 8 Fedora Update System 2010-04-03 04:36:36 UTC
hplip-3.10.2-2.fc12 has been pushed to the Fedora 12 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 9 Tim Waugh 2010-04-21 11:20:01 UTC
*** Bug 552725 has been marked as a duplicate of this bug. ***


Note You need to log in before you can comment on or make changes to this bug.