Linda Knippers <[EMAIL PROTECTED]> wrote on 07/14/2006 13:38:02:
> George Wilson wrote:
> > [EMAIL PROTECTED] wrote on 07/14/2006 12:37:29:
> >
> >> On Fri, Jul 14, 2006 at 01:17:28PM -0400, Daniel J Walsh wrote:
> >> > Internal Red Hat people are interested if we can do this another way
> >> > without introducing a new SUID application.
> >> >
> >> > Could someone spell out the exact requirements, that devallocator is
> >> > trying to solve?
> >>
> >> I'm a bit confused also. I thought it was intended to help administrators
> >> define labels for printer devices, and tools run by administrators don't
> >> need to be SUID.
> >>
> >> I just looked at the code, and some of its features such as relabeling
> >> floppy and CD-ROM devices should definitely *not* be accessible to
> >> non-admin users via a SUID application, at least not in an evaluated
> >> config. It also has many override capabilities in its policy, are those
> >> all really necessary? I think it would be preferable to require that an
> >> admin runs it who has the necessary privileges already, instead of having
> >> the tool grant them.
> >>
> >> -Klaus
> >>
> >> --
> >> redhat-lspp mailing list
> >> [email protected]
> >> https://www.redhat.com/mailman/listinfo/redhat-lspp
> >
> > It is to allow a user to allocate a printer for exclusive use. Because
> > relabeling is a privileged operation, we need an intermediary to do the
> > work on the user's behalf. There is TSOL documentation that describes
> > device allocation procedures in their environment:
> >
> > http://docs.sun.com/app/docs/doc/816-4557/6maosrjd8?a=view
> >
> > and
> >
> > http://docs.sun.com/app/docs/doc/816-4557/6maosrjdk?a=view
>
> I don't think we need this for printers. Do we really want to
> support users allocating personal printer devices? I've assumed
> that an admin would configure the printer devices with devallocator
> and then use the lpadmin or other cups utilities to create printer
> queues for them. I don't think this is something a regular user
> does.
>
> I don't think we have personal printer queues with CUPS
> today (do we?) and I didn't think we needed them for LSPP, even if
> TSOL supports that feature. I think even with Trusted Solaris, the
> user has to have the right authorizations to perform the operation.
>
> -- ljk
>
>
Well, we were originally going to have the admin setup printers in
advance. But that appeared to be too inflexible. However, you are
right that user printer allocation appears to be more of a workstation
feature for directly-attached printers than a server feature. So I
agree that we should restrict print queue setup to admins. We may
still want the device allocator for other purposes in the future.
Let's please discuss this during the Monday meeting.
Thanks,
George Wilson
IBM LTC Security Development
-- redhat-lspp mailing list [email protected] https://www.redhat.com/mailman/listinfo/redhat-lspp
