>> I don't think they should be considered a source for leaking >> information. The only thing I see isn't a leak so much as a >> (extremely low bandwidth) covert channel of "is the printer enabled >> or disabled?" Since the use of these programs is restricted, we're >> covered under no-evil-admin. > > How are these restricted? Or rather, how are they supposed to be > restricted? I am able to cupsenable, cupsdisable, accept and reject > my printer as a non-root user under both permissive and enforcing > modes.
To which groups does your user account belong? By default, cups will allow anyone in group sys to perform administrative functions but this is configurable in cupsd.conf. We'll have to decide whether allowing sys group members is ok or we'll have to modify the cupsd.conf for the evaluated config. I suspect we'll modify cupsd.conf. -- ljk -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
