system-config-printer/cups: unconfined_t:fifo_file {read write} ?

[Tom London]

Running targeted, latest development stuff.

Configuring a 'new' USB printer from 'Desktop->System
Settings->Printing' produces a wealth of avcs like:

Mar 23 08:08:14 localhost kernel: audit(1111594094.345:0): avc: 
denied  { read } for  pid=19983 exe=/usr/sbin/cupsd path=pipe:[194059]
dev=pipefs ino=194059 scontext=root:system_r:cupsd_t
tcontext=root:system_r:unconfined_t tclass=fifo_file
Mar 23 08:08:14 localhost kernel: audit(1111594094.345:0): avc: 
denied  { write } for  pid=19983 exe=/usr/sbin/cupsd
path=pipe:[194059] dev=pipefs ino=194059
scontext=root:system_r:cupsd_t tcontext=root:system_r:unconfined_t
tclass=fifo_file

Appears to be asking for
allow cupsd_t unconfined_t:fifo_file { read write };

This denial appears not to cause a problem, since the printer works.
Should this be a 'dontaudit'? Something else (like a missing
transition)?

thanks,
   tom
-- 
Tom London

[Tim Waugh]

On Wed, Mar 23, 2005 at 08:20:35AM -0800, Tom London wrote:

>  Running targeted, latest development stuff. 
In enforcing mode?

>  This denial appears not to cause a problem, since the printer works.
>  Should this be a 'dontaudit'? Something else (like a missing
>  transition)? 
What kind of printer is it?  Is it an HPOJ device, with a PTAL
transport?

Tim.
*/

[Tom London]

On Wed, 23 Mar 2005 16:33:13 +0000, Tim Waugh <twaugh(a)redhat.com&gt; wrote:
>  On Wed, Mar 23, 2005 at 08:20:35AM -0800, Tom London wrote:
>  
>  > Running targeted, latest development stuff.
>  
>  In enforcing mode? 
Sorry, yes targeted/enforcing.

>  
>  > This denial appears not to cause a problem, since the printer works.
>  > Should this be a 'dontaudit'? Something else (like a missing
>  > transition)?
>  
>  What kind of printer is it?  Is it an HPOJ device, with a PTAL
>  transport? 
I believe so: an HP PSC950 (combined scanner, printer, copier).

>  
>  Tim.
>  */ 
-- 
Tom London

[Tim Waugh]

On Wed, Mar 23, 2005 at 08:42:15AM -0800, Tom London wrote:

>  I believe so: an HP PSC950 (combined scanner, printer, copier).
Okay, what's going on then is that the ptal backend
(/usr/lib*/cups/backend/ptal) needs to write to the named pipe in
/var/run/ptal-printd.

That named pipe should be getting its label set correctly, but it
doesn't look like that's happening.

Tim.
*/

[Daniel J Walsh]

Tim Waugh wrote:

> On Wed, Mar 23, 2005 at 08:42:15AM -0800, Tom London wrote:
>
>   
>
> >I believe so: an HP PSC950 (combined scanner, printer, copier).
> >    
> >
>
> Okay, what's going on then is that the ptal backend
> (/usr/lib*/cups/backend/ptal) needs to write to the named pipe in
> /var/run/ptal-printd.
>
> That named pipe should be getting its label set correctly, but it
> doesn't look like that's happening.
>
>   
>  
What is creating the pipe?
Looks like
file_type_auto_trans(ptal_t, var_run_t, ptal_var_run_t, { sock_file 
fifo_file })
is required.


> Tim.
> */
>   
>
> ------------------------------------------------------------------------
>
> --
> fedora-selinux-list mailing list
> fedora-selinux-list(a)redhat.com
> http://www.redhat.com/mailman/listinfo/fedora-selinux-list
>  

--

[Tom London]

>  What is creating the pipe?
>  Looks like
>  file_type_auto_trans(ptal_t, var_run_t, ptal_var_run_t, { sock_file
>  fifo_file })
>  is required.
>  
>  >Tim.
>  >*/
>  > 
Uhh... I can't seem to find ptal on my system.

I have hpijs installed, but not hpoj (that right?) 

I don't seem to have anything in /etc/init.d for ptal. No ptal, no pipe?

Again, I just tried to connect this printer 'for the first time'. I
was just trying to print on it.... Do I need hpoj for this? s-c-p
didn't seem to complain, and printing works.

Could this be an operator (me) miscue? (if so, sorry....)
  tom

-- 
Tom London

[Daniel J Walsh]

Tim Waugh wrote:

> On Wed, Mar 23, 2005 at 08:42:15AM -0800, Tom London wrote:
>
>   
>
> >I believe so: an HP PSC950 (combined scanner, printer, copier).
> >    
> >
>
> Okay, what's going on then is that the ptal backend
> (/usr/lib*/cups/backend/ptal) needs to write to the named pipe in
> /var/run/ptal-printd.
>
> That named pipe should be getting its label set correctly, but it
> doesn't look like that's happening.
>
> Tim.
> */
>   
>
>   
>  
Updated policy on my people page to handle this situation.

selinux-policy-targeted-1.23.4-4

Dan

> ------------------------------------------------------------------------
>
> --
> fedora-selinux-list mailing list
> fedora-selinux-list(a)redhat.com
> http://www.redhat.com/mailman/listinfo/fedora-selinux-list
>  

--