Re: [redhat-lspp] Re: cups userspace -- trusted programs?
Linda Knippers wrote:
>> I don't think they should be considered a source for
leaking
>> information. The only thing I see isn't a leak so much as a
>> (extremely low bandwidth) covert channel of "is the printer enabled
>> or disabled?" Since the use of these programs is restricted, we're
>> covered under no-evil-admin.
>
> How are these restricted? Or rather, how are they supposed to be
> restricted? I am able to cupsenable, cupsdisable, accept and reject
> my printer as a non-root user under both permissive and enforcing
> modes.
To which groups does your user account belong?
uid=500(mcthomps) gid=500(mcthomps) groups=500(mcthomps)
context=user_u:user_r:user_t:SystemLow
By default, cups
will allow anyone in group sys to perform administrative functions
but this is configurable in cupsd.conf. We'll have to decide
whether allowing sys group members is ok or we'll have to modify
the cupsd.conf for the evaluated config. I suspect we'll modify
cupsd.conf.
I've butchered my cupsd.conf pretty badly, so it could be a result of
that. I've not tried doing this with a fresh install, but if it works on
your end, I'll assume it's my config mangling.
Mike