<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta http-equiv="content-type"
content="text/html; charset=ISO-8859-1">
</head>
<body bgcolor="#ffffff" text="#000000">
My environment is Red Hat Enterprise Linux Server
release 5.4 (in SELinux enforcing mode), with cups-1.3.7-11.el5. I'm
creating a printer which has a SystemV interface script, using a
command of this form:<br>
<br>
<blockquote>lpadmin -p <PRTNAME> -v <DEVICE> -i
<INTERFACE> -E<br>
</blockquote>
<br>
My problem is that I get SELinux
alerts like this:<br>
<br>
<blockquote>SELinux is preventing cupsd (cupsd_t) "execute" to
../<PRTNAME> (cupsd_rw_etc_t)<br>
SELinux is preventing cupsd (cupsd_t) "execute_no_trans" to
../<PRTNAME> (cupsd_rw_etc_t)<br>
</blockquote>
<br>
The ./<PRTNAME> to which these messages refer is my
<INTERFACE> script, which has been copied to
/etc/cups/interfaces by lpadmin (or probably by cupsd, in response to a
request from lpadmin). The "execute" alert happens when creating the
printer, and the "execute_no_trans" one when trying to print to it.<br>
<br>
I can avoid these alerts by installing a local SELinux policy module
that looks like
this:<br>
<br>
<blockquote>require { <br>
type cupsd_rw_etc_t; <br>
type cupsd_t; <br>
class file { execute execute_no_trans }; <br>
} <br>
<br>
#============= cupsd_t ============== <br>
allow cupsd_t cupsd_rw_etc_t:file { execute execute_no_trans }; <br>
</blockquote>
<br>
However, I am surprised that I have to do this. Since scripts
under /etc/cups/interfaces are intended to be executable, why does the
standard CUPS SELinux policy apparently not recognise this? I
am concerned that I may be introducing a security vulnerability by
installing my policy module, and that there may be a better way of
achieving the desired effect.<br>
<br>
Does anyone have any ideas about this? I don't know if I'm seeing a
CUPS problem, or an SELinux problem, or (most likely) a problem caused
by my incomplete understanding of either. Please don't suggest that I
just turn off SELinux enforcing mode: this is targeted at environments
over which I have no control, and I figure that if people are using
enforcing mode then that's what they want to do.<br>
<br>
Thanks,<br>
<br>
--<br>
Bill<br>
</body>
</html>