diff -burN cups-1.1.23/config.h.in cups-1.1.23-acaudit/config.h.in
--- cups-1.1.23/config.h.in	2005-01-03 14:29:44.000000000 -0500
+++ cups-1.1.23-acaudit/config.h.in	2006-01-31 16:23:29.000000000 -0500
@@ -298,6 +298,12 @@
 #define CUPS_PYTHON	"/usr/bin/python"
 
 
+/*
+ * Do we have Linux Auditing?
+ */
+
+#undef HAVE_AUDIT
+
 #endif /* !_CUPS_CONFIG_H_ */
 
 /*
diff -burN cups-1.1.23/config-scripts/cups-audit.m4 cups-1.1.23-acaudit/config-scripts/cups-audit.m4
--- cups-1.1.23/config-scripts/cups-audit.m4	1969-12-31 19:00:00.000000000 -0500
+++ cups-1.1.23-acaudit/config-scripts/cups-audit.m4	2006-02-06 11:42:41.000000000 -0500
@@ -0,0 +1,34 @@
+dnl
+dnl   Audit handling code for the Common UNIX Printing System (CUPS).
+dnl
+dnl   Copyright 2005-2006 by Hewlett-Packard Development Company, L.P.
+dnl
+dnl   This program is free software; you can redistribute it and/or modify
+dnl   it under the terms of the GNU General Public License as published by
+dnl   the Free Software Foundation; version 2.
+dnl
+dnl   This program is distributed in the hope that it will be useful, but
+dnl   WITHOUT ANY WARRANTY; without even the implied warranty of
+dnl   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+dnl   General Public License for more details.
+dnl
+dnl   You should have received a copy of the GNU General Public License
+dnl   along with this program; if not, write to the Free Software Foundation,
+dnl   Inc., 51 Franklin Street, Fifth Floor Boston, MA 02110-1301 USA
+dnl
+
+dnl Do we want auditing?
+AC_ARG_ENABLE(audit, [  --enable-audit          turn on audit support, default=yes])
+
+if test x"$enable_audit" != xno; then
+    case "$uname" in
+        Linux)
+            AC_CHECK_LIB(audit,audit_send_user_message,
+                         [LIBAUDIT="-laudit" AC_SUBST(LIBAUDIT)])
+            AC_CHECK_HEADER(libaudit.h, AC_DEFINE(HAVE_AUDIT))
+            ;;
+        *)
+            # All others
+            ;;
+    esac
+fi
diff -burN cups-1.1.23/configure.in cups-1.1.23-acaudit/configure.in
--- cups-1.1.23/configure.in	2005-01-03 14:29:44.000000000 -0500
+++ cups-1.1.23-acaudit/configure.in	2006-02-01 11:22:00.000000000 -0500
@@ -41,6 +41,8 @@
 
 sinclude(config-scripts/cups-scripting.m4)
 
+sinclude(config-scripts/cups-audit.m4)
+
 AC_OUTPUT(Makedefs cups.list cups.sh cups-config conf/cupsd.conf conf/pam.std)
 
 chmod +x cups-config
diff -burN cups-1.1.23/Makedefs.in cups-1.1.23-acaudit/Makedefs.in
--- cups-1.1.23/Makedefs.in	2005-01-03 14:29:44.000000000 -0500
+++ cups-1.1.23-acaudit/Makedefs.in	2006-02-06 13:06:36.000000000 -0500
@@ -95,7 +95,7 @@
 LDFLAGS		=	-L../cups -L../filter $(RC_CFLAGS) @LDFLAGS@ $(OPTIM)
 LINKCUPS	=	@LINKCUPS@
 LINKCUPSIMAGE	=	@LINKCUPSIMAGE@
-LIBS		=	$(LINKCUPS) $(NETLIBS) @LIBS@ $(COMMONLIBS)
+LIBS		=	$(LINKCUPS) $(NETLIBS) @LIBS@ $(COMMONLIBS) @LIBAUDIT@
 NETLIBS		=	@NETLIBS@
 OPTIM		=	@OPTIM@
 OPTIONS		=
diff -burN cups-1.1.23/scheduler/conf.c cups-1.1.23-acaudit/scheduler/conf.c
--- cups-1.1.23/scheduler/conf.c	2005-01-03 14:29:59.000000000 -0500
+++ cups-1.1.23-acaudit/scheduler/conf.c	2006-02-06 13:31:42.000000000 -0500
@@ -50,6 +50,9 @@
 #  include <syslog.h>
 #endif /* HAVE_VSYSLOG */
 
+#ifdef HAVE_AUDIT
+#  include <libaudit.h>
+#endif /* HAVE_AUDIT */
 
 /*
  * Possibly missing network definitions...
@@ -139,6 +142,9 @@
   { "ServerKey",		&ServerKey,		VAR_STRING },
 #  endif /* HAVE_LIBSSL || HAVE_GNUTLS */
 #endif /* HAVE_SSL */
+#ifdef HAVE_AUDIT
+  { "AuditLog",			&AuditLog,		VAR_INTEGER },
+#endif /* HAVE_AUDIT */
   { "ServerName",		&ServerName,		VAR_STRING },
   { "ServerRoot",		&ServerRoot,		VAR_STRING },
   { "TempDir",			&TempDir,		VAR_STRING },
@@ -395,6 +401,20 @@
   else
     RunUser = getuid();
 
+#ifdef WITH_AUDIT
+  /*
+   * ClassifyOverride is set during read_cofiguration, if its on, report it now
+   */
+  if (ClassifyOverride)
+    audit_log_user_message(AuditLog, AUDIT_USYS_CONFIG,
+              "[Config] ClassifyOverride=enabled Users can override print banners",
+              ServerName, NULL, NULL, 1);
+  else
+    audit_log_user_message(AuditLog, AUDIT_USYS_CONFIG,
+              "[Config] ClassifyOverride=disabled Users cannot override print banners",
+              ServerName, NULL, NULL, 1);
+#endif /* WITH_AUDIT */
+
  /*
   * Use the default system group if none was supplied in cupsd.conf...
   */
@@ -569,7 +589,15 @@
     ClearString(&Classification);
 
   if (Classification)
+  {
     LogMessage(L_INFO, "Security set to \"%s\"", Classification);
+#ifdef HAVE_AUDIT
+    SetStringf(&AuditMessage, "[Config] Security level=\"%s\"", Classification);
+    audit_log_user_message(AuditLog, AUDIT_LABEL_LEVEL_CHANGE, AuditMessage,
+                           ServerName, NULL, NULL, 1);
+    free(AuditMessage);
+#endif /* HAVE_AUDIT */
+  }
 
  /*
   * Update the MaxClientsPerHost value, as needed...
diff -burN cups-1.1.23/scheduler/conf.h cups-1.1.23-acaudit/scheduler/conf.h
--- cups-1.1.23/scheduler/conf.h	2005-01-03 14:29:59.000000000 -0500
+++ cups-1.1.23-acaudit/scheduler/conf.h	2006-02-06 12:11:00.000000000 -0500
@@ -168,6 +168,13 @@
 VAR const char		**MimeTypes		VALUE(NULL);
 					/* Array of MIME types */
 
+#ifdef HAVE_AUDIT
+VAR int			AuditLog		VALUE(-1);
+					/* File descriptor for audit */
+VAR char		*AuditMessage		VALUE(NULL);
+					/* Message to be sent to the audit log */
+#endif /* HAVE_AUDIT */
+
 #ifdef HAVE_SSL
 VAR char		*ServerCertificate	VALUE(NULL);
 					/* Server certificate file */
diff -burN cups-1.1.23/scheduler/ipp.c cups-1.1.23-acaudit/scheduler/ipp.c
--- cups-1.1.23/scheduler/ipp.c	2005-01-03 14:29:59.000000000 -0500
+++ cups-1.1.23-acaudit/scheduler/ipp.c	2006-02-06 13:32:06.000000000 -0500
@@ -86,6 +86,9 @@
 #  include <paper.h>
 #endif /* HAVE_LIBPAPER */
 
+#ifdef HAVE_AUDIT
+#  include <libaudit.h>
+#endif /* HAVE_AUDIT */
 
 /*
  * PPD default choice structure...
@@ -4954,6 +4957,16 @@
 	 /*
           * Force the leading banner to have the classification on it...
 	  */
+#ifdef HAVE_AUDIT
+         /*
+          * Log the impending label change
+          */
+          SetStringf(&AuditMessage, "job=%d classification changed from=\"%s\" to=\"%s\"",
+                     job->id, attr->values[0].string.text, Classification);
+          audit_log_user_message(AuditLog, AUDIT_LABEL_OVERRIDE, AuditMessage,
+                                 ServerName, NULL, NULL, 1);
+          free(AuditMessage);
+#endif /* HAVE_AUDIT */
 
           SetString(&attr->values[0].string.text, Classification);
 
@@ -4971,6 +4984,16 @@
 	 /*
 	  * Can't put two different security markings on the same document!
 	  */
+#ifdef HAVE_AUDIT
+         /*
+          * Log the impending label change
+          */
+          SetStringf(&AuditMessage, "job=%d footer page classification changed from=\"%s\" to=\"%s\"",
+                     job->id, attr->values[1].string.text, attr->values[0].string.text);
+          audit_log_user_message(AuditLog, AUDIT_LABEL_OVERRIDE, AuditMessage,
+                                 ServerName, NULL, NULL, 1);
+          free(AuditMessage);
+#endif /* HAVE_AUDIT */
 
           SetString(&attr->values[1].string.text, attr->values[0].string.text);
 
diff -burN cups-1.1.23/scheduler/job.c cups-1.1.23-acaudit/scheduler/job.c
--- cups-1.1.23/scheduler/job.c	2005-01-03 14:29:59.000000000 -0500
+++ cups-1.1.23-acaudit/scheduler/job.c	2006-02-06 13:32:25.000000000 -0500
@@ -63,6 +63,9 @@
 #include "cupsd.h"
 #include <grp.h>
 
+#ifdef HAVE_AUDIT
+#include <libaudit.h>
+#endif /* HAVE_AUDIT */
 
 /*
  * Local globals...
@@ -1405,6 +1408,13 @@
     if ((current->job_sheets =
          ippFindAttribute(current->attrs, "job-sheets", IPP_TAG_ZERO)) != NULL)
       LogMessage(L_DEBUG, "... but someone added one without setting job_sheets!");
+#ifdef HAVE_AUDIT
+    SetStringf(&AuditMessage, "job=%d user=\"%s\" printer=\"%s\" is UNLABELED",
+               id, current->username, printer->name);
+    audit_log_user_message(AuditLog, AUDIT_USER_UNLABELED_EXPORT, AuditMessage,
+                           ServerName, NULL, NULL, 1);
+    free(AuditMessage);
+#endif /* HAVE_AUDIT */
   }
   else if (current->job_sheets->num_values == 1)
     LogMessage(L_DEBUG, "job-sheets=%s",
@@ -1790,6 +1800,13 @@
                attr->values[0].string.text);
 
     envp[envc ++] = classification;
+#ifdef HAVE_AUDIT
+    SetStringf(&AuditMessage, "job=%d user=\"%s\" printer=\"%s\" with labels \"%s\" \"%s\"",
+               id, current->username, printer->name, attr->values[0].string.text, attr->values[1].string.text);
+    audit_log_user_message(AuditLog, AUDIT_USER_LABELED_EXPORT, AuditMessage,
+                           ServerName, NULL, NULL, 1);
+    free(AuditMessage);
+#endif /* HAVE_AUDIT */
   }
 
   if (current->dtype & (CUPS_PRINTER_CLASS | CUPS_PRINTER_IMPLICIT))
diff -burN cups-1.1.23/scheduler/main.c cups-1.1.23-acaudit/scheduler/main.c
--- cups-1.1.23/scheduler/main.c	2005-01-03 14:29:59.000000000 -0500
+++ cups-1.1.23-acaudit/scheduler/main.c	2006-01-31 16:29:51.000000000 -0500
@@ -55,6 +55,10 @@
 #  include <malloc.h>
 #endif /* HAVE_MALLOC_H && HAVE_MALLINFO */
 
+#if defined(HAVE_AUDIT)
+#  include <libaudit.h>
+#endif /* HAVE_AUDIT */
+
 
 /*
  * Local functions...
@@ -177,6 +181,10 @@
   if (!ConfigurationFile)
     SetString(&ConfigurationFile, CUPS_SERVERROOT "/cupsd.conf");
 
+#ifdef HAVE_AUDIT
+  AuditLog = audit_open();
+#endif /* HAVE_AUDIT */
+
  /*
   * If the user hasn't specified "-f", run in the background...
   */
@@ -786,6 +794,10 @@
   free(input);
   free(output);
 
+#ifdef HAVE_AUDIT
+  audit_close(AuditLog);
+#endif /* HAVE_AUDIT */
+
   return (!stop_scheduler);
 }
 
diff -burN cups-1.1.23/scheduler/printers.c cups-1.1.23-acaudit/scheduler/printers.c
--- cups-1.1.23/scheduler/printers.c	2005-01-03 14:29:59.000000000 -0500
+++ cups-1.1.23-acaudit/scheduler/printers.c	2006-02-06 13:32:40.000000000 -0500
@@ -56,6 +56,9 @@
 
 #include "cupsd.h"
 
+#ifdef HAVE_AUDIT
+#  include <libaudit.h>
+#endif /* HAVE_AUDIT */
 
 /*
  * Local functions...
@@ -1275,6 +1278,13 @@
       attr->values[1].string.text = strdup(Classification ?
 	                                   Classification : p->job_sheets[1]);
     }
+#ifdef HAVE_AUDIT
+    SetStringf(&AuditMessage, "[Config] printer=\"%s\" uri=\"%s\" banners set to \"%s\" \"%s\"",
+               p->name, p->uri, p->job_sheets[0], p->job_sheets[1]);
+    audit_log_user_message(AuditLog, AUDIT_LABEL_LEVEL_CHANGE, AuditMessage,
+                           ServerName, NULL, NULL, 1);
+    free(AuditMessage);
+#endif /* HAVE_AUDIT */
   }
 
   printer_type = p->type;
