diff -up cups-1.7.1/config.h.in.lspp cups-1.7.1/config.h.in

--- cups-1.7.1/config.h.in.lspp	2014-01-08 18:43:27.282821790 +0100

+++ cups-1.7.1/config.h.in	2014-01-08 18:43:27.295821610 +0100

@@ -717,6 +717,13 @@ static __inline int _cups_abs(int i) { r

 #  endif /* __GNUC__ || __STDC_VERSION__ */

 #endif /* !HAVE_ABS && !abs */

+/*

+ * Are we trying to meet LSPP requirements?

+ */

+

+#undef WITH_LSPP

+

+

 #endif /* !_CUPS_CONFIG_H_ */

 /*

diff -up cups-1.7.1/config-scripts/cups-lspp.m4.lspp cups-1.7.1/config-scripts/cups-lspp.m4

--- cups-1.7.1/config-scripts/cups-lspp.m4.lspp	2014-01-08 18:43:27.295821610 +0100

+++ cups-1.7.1/config-scripts/cups-lspp.m4	2014-01-08 18:43:27.295821610 +0100

@@ -0,0 +1,36 @@

+dnl

+dnl   LSPP code for the Common UNIX Printing System (CUPS).

+dnl

+dnl   Copyright 2005-2006 by Hewlett-Packard Development Company, L.P.

+dnl

+dnl   This program is free software; you can redistribute it and/or modify

+dnl   it under the terms of the GNU General Public License as published by

+dnl   the Free Software Foundation; version 2.

+dnl

+dnl   This program is distributed in the hope that it will be useful, but

+dnl   WITHOUT ANY WARRANTY; without even the implied warranty of

+dnl   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU

+dnl   General Public License for more details.

+dnl

+dnl   You should have received a copy of the GNU General Public License

+dnl   along with this program; if not, write to the Free Software Foundation,

+dnl   Inc., 51 Franklin Street, Fifth Floor Boston, MA 02110-1301 USA

+dnl

+

+dnl Are we trying to meet LSPP requirements

+AC_ARG_ENABLE(lspp, [  --enable-lspp           turn on auditing and label support, default=no])

+

+if test x"$enable_lspp" != xno; then

+    case "$uname" in

+        Linux)

+            AC_CHECK_LIB(audit,audit_log_user_message, [LIBAUDIT="-laudit" AC_SUBST(LIBAUDIT)])

+            AC_CHECK_HEADER(libaudit.h)

+            AC_CHECK_LIB(selinux,getpeercon, [LIBSELINUX="-lselinux" AC_SUBST(LIBSELINUX)])

+            AC_CHECK_HEADER(selinux/selinux.h)

+            AC_DEFINE(WITH_LSPP)

+            ;;

+        *)

+            # All others

+            ;;

+    esac

+fi

diff -up cups-1.7.1/configure.in.lspp cups-1.7.1/configure.in

--- cups-1.7.1/configure.in.lspp	2014-01-08 18:43:27.228822537 +0100

+++ cups-1.7.1/configure.in	2014-01-08 18:43:27.296821596 +0100

@@ -37,6 +37,8 @@ sinclude(config-scripts/cups-systemd.m4)

 sinclude(config-scripts/cups-defaults.m4)

 sinclude(config-scripts/cups-scripting.m4)

+sinclude(config-scripts/cups-lspp.m4)

+

 INSTALL_LANGUAGES=""

 UNINSTALL_LANGUAGES=""

 LANGFILES=""

diff -up cups-1.7.1/filter/common.c.lspp cups-1.7.1/filter/common.c

--- cups-1.7.1/filter/common.c.lspp	2013-05-29 13:51:34.000000000 +0200

+++ cups-1.7.1/filter/common.c	2014-01-08 18:43:27.296821596 +0100

@@ -30,6 +30,12 @@

  * Include necessary headers...

  */

+#include "config.h"

+#ifdef WITH_LSPP

+#define _GNU_SOURCE

+#include <string.h>

+#endif /* WITH_LSPP */

+

 #include "common.h"

 #include <locale.h>

@@ -312,6 +318,18 @@ WriteLabelProlog(const char *label,	/* I

 {

   const char	*classification;	/* CLASSIFICATION environment variable */

   const char	*ptr;			/* Temporary string pointer */

+#ifdef WITH_LSPP

+  int           i,                      /* counter */

+                n,                      /* counter */

+                lines,                  /* number of lines needed */

+                line_len,               /* index into tmp_label */

+                label_len,              /* length of the label in characters */

+                label_index,            /* index into the label */

+                longest,                /* length of the longest line */

+                longest_line,           /* index to the longest line */

+                max_width;              /* maximum width in characters */

+  char          **wrapped_label;        /* label with line breaks */

+#endif /* WITH_LSPP */

  /*

@@ -334,6 +352,124 @@ WriteLabelProlog(const char *label,	/* I

     return;

   }

+#ifdef WITH_LSPP

+  if (strncmp(classification, "LSPP:", 5) == 0 && label == NULL)

+  {

+   /*

+    * Based on the 12pt fixed width font below determine the max_width

+    */

+    max_width = width / 8;

+    longest_line = 0;

+    longest = 0;

+    classification += 5; // Skip the "LSPP:"

+    label_len = strlen(classification);

+

+    if (label_len > max_width)

+    {

+      lines = 1 + (int)(label_len / max_width);

+      line_len = (int)(label_len / lines);

+      wrapped_label = malloc(sizeof(*wrapped_label) * lines);

+      label_index = i = n = 0;

+      while (classification[label_index])

+      {

+        if ((label_index + line_len) > label_len)

+          break;

+        switch (classification[label_index + line_len + i])

+        {

+          case ':':

+          case ',':

+          case '-':

+            i++;

+            wrapped_label[n++] = strndup(&classification[label_index], (line_len + i));

+            label_index += line_len + i;

+            i = 0;

+            break;

+          default:

+            i++;

+            break;

+        }

+        if ((i + line_len) == max_width)

+        {

+          wrapped_label[n++] = strndup(&(classification[label_index]), (line_len + i));

+          label_index = label_index + line_len + i;

+          i = 0;

+        }

+      }

+      wrapped_label[n] = strndup(&classification[label_index], label_len - label_index);

+    }

+    else

+    {

+      lines = 1;

+      wrapped_label = malloc(sizeof(*wrapped_label));

+      wrapped_label[0] = (char*)classification;

+    }

+

+    for (n = 0; n < lines; n++ )

+    {

+      printf("userdict/ESPp%c(", ('a' + n));

+      for (ptr = wrapped_label[n], i = 0; *ptr; ptr ++, i++)

+        if (*ptr < 32 || *ptr > 126)

+          printf("\\%03o", *ptr);

+        else

+        {

+          if (*ptr == '(' || *ptr == ')' || *ptr == '\\')

+            putchar('\\');

+

+          printf("%c", *ptr);

+        }

+      if (i > longest)

+      {

+        longest = i;

+        longest_line = n;

+      }

+      printf(")put\n");

+    }

+

+   /*

+    * For LSPP use a fixed width font so that line wrapping can be calculated

+    */

+

+    puts("userdict/ESPlf /Nimbus-Mono findfont 12 scalefont put");

+

+   /*

+    * Finally, the procedure to write the labels on the page...

+    */

+

+    printf("userdict/ESPwl{\n"

+           "  ESPlf setfont\n");

+    printf("  ESPp%c stringwidth pop dup 12 add exch -0.5 mul %.0f add\n ",

+           'a' + longest_line, width * 0.5f);

+    for (n = 1; n < lines; n++)

+      printf(" dup");

+    printf("\n  1 setgray\n");

+    printf("  dup 6 sub %.0f %d index %.0f ESPrf\n",

+           (bottom - 2.0), (2 + lines), 6.0 + (16.0 * lines));

+    printf("  dup 6 sub %.0f %d index %.0f ESPrf\n",

+           (top - 6.0 - (16.0 * lines)), (2 + lines), 4.0 + (16.0 * lines));

+    printf("  0 setgray\n");

+    printf("  dup 6 sub %.0f %d index %.0f ESPrs\n",

+           (bottom - 2.0), (2 + lines), 6.0 + (16.0 * lines));

+    printf("  dup 6 sub %.0f %d index %.0f ESPrs\n",

+           (top - 6.0 - (16.0 * lines)), (2 + lines), 4.0 + (16.0 * lines));

+    for (n = 0; n < lines; n ++)

+    {

+      printf("  dup %.0f moveto ESPp%c show\n",

+             bottom + 6.0 + ((lines - (n+1)) * 16.0), 'a' + n);

+      printf("  %.0f moveto ESPp%c show\n", top + 2.0 - ((n + 1) * 16.0), 'a' + n);

+    }

+    printf("  pop\n"

+           "}bind put\n");

+

+   /*

+    * Do some clean up at the end of the LSPP special case

+    */

+    free(wrapped_label);

+

+  }

+  else

+  {

+#endif /* !WITH_LSPP */

+  

  /*

   * Set the classification + page label string...

   */

@@ -414,7 +550,10 @@ WriteLabelProlog(const char *label,	/* I

   printf("  %.0f moveto ESPpl show\n", top - 14.0);

   puts("pop");

   puts("}bind put");

+  }

+#ifdef WITH_LSPP

 }

+#endif /* WITH_LSPP */

 /*

diff -up cups-1.7.1/filter/pstops.c.lspp cups-1.7.1/filter/pstops.c

--- cups-1.7.1/filter/pstops.c.lspp	2013-05-29 13:51:34.000000000 +0200

+++ cups-1.7.1/filter/pstops.c	2014-01-08 18:43:27.297821582 +0100

@@ -3203,6 +3203,18 @@ write_label_prolog(pstops_doc_t *doc,	/*

 {

   const char	*classification;	/* CLASSIFICATION environment variable */

   const char	*ptr;			/* Temporary string pointer */

+#ifdef WITH_LSPP

+  int           i,                      /* counter */

+                n,                      /* counter */

+                lines,                  /* number of lines needed */

+                line_len,               /* index into tmp_label */

+                label_len,              /* length of the label in characters */

+                label_index,            /* index into the label */

+                longest,                /* length of the longest line */

+                longest_line,           /* index to the longest line */

+                max_width;              /* maximum width in characters */

+  char          **wrapped_label;        /* label with line breaks */

+#endif /* WITH_LSPP */

  /*

@@ -3225,6 +3237,124 @@ write_label_prolog(pstops_doc_t *doc,	/*

     return;

   }

+#ifdef WITH_LSPP

+  if (strncmp(classification, "LSPP:", 5) == 0 && label == NULL)

+  {

+   /*

+    * Based on the 12pt fixed width font below determine the max_width

+    */

+    max_width = width / 8;

+    longest_line = 0;

+    longest = 0;

+    classification += 5; // Skip the "LSPP:"

+    label_len = strlen(classification);

+

+    if (label_len > max_width)

+    {

+      lines = 1 + (int)(label_len / max_width);

+      line_len = (int)(label_len / lines);

+      wrapped_label = malloc(sizeof(*wrapped_label) * lines);

+      label_index = i = n = 0;

+      while (classification[label_index])

+      {

+        if ((label_index + line_len) > label_len)

+          break;

+        switch (classification[label_index + line_len + i])

+        {

+          case ':':

+          case ',':

+          case '-':

+            i++;

+            wrapped_label[n++] = strndup(&classification[label_index], (line_len + i));

+            label_index += line_len + i;

+            i = 0;

+            break;

+          default:

+            i++;

+            break;

+        }

+        if ((i + line_len) == max_width)

+        {

+          wrapped_label[n++] = strndup(&(classification[label_index]), (line_len + i));

+          label_index = label_index + line_len + i;

+          i = 0;

+        }

+      }

+      wrapped_label[n] = strndup(&classification[label_index], label_len - label_index);

+    }

+    else

+    {

+      lines = 1;

+      wrapped_label = malloc(sizeof(*wrapped_label));

+      wrapped_label[0] = (char*)classification;

+    }

+

+    for (n = 0; n < lines; n++ )

+    {

+      printf("userdict/ESPp%c(", ('a' + n));

+      for (ptr = wrapped_label[n], i = 0; *ptr; ptr ++, i++)

+        if (*ptr < 32 || *ptr > 126)

+          printf("\\%03o", *ptr);

+        else

+        {

+          if (*ptr == '(' || *ptr == ')' || *ptr == '\\')

+            putchar('\\');

+

+          printf("%c", *ptr);

+        }

+      if (i > longest)

+      {

+        longest = i;

+        longest_line = n;

+      }

+      printf(")put\n");

+    }

+

+   /*

+    * For LSPP use a fixed width font so that line wrapping can be calculated

+    */

+

+    puts("userdict/ESPlf /Nimbus-Mono findfont 12 scalefont put");

+

+   /*

+    * Finally, the procedure to write the labels on the page...

+    */

+

+    printf("userdict/ESPwl{\n"

+           "  ESPlf setfont\n");

+    printf("  ESPp%c stringwidth pop dup 12 add exch -0.5 mul %.0f add\n ",

+           'a' + longest_line, width * 0.5f);

+    for (n = 1; n < lines; n++)

+      printf(" dup");

+    printf("\n  1 setgray\n");

+    printf("  dup 6 sub %.0f %d index %.0f ESPrf\n",

+           (bottom - 2.0), (2 + lines), 6.0 + (16.0 * lines));

+    printf("  dup 6 sub %.0f %d index %.0f ESPrf\n",

+           (top - 6.0 - (16.0 * lines)), (2 + lines), 4.0 + (16.0 * lines));

+    printf("  0 setgray\n");

+    printf("  dup 6 sub %.0f %d index %.0f ESPrs\n",

+           (bottom - 2.0), (2 + lines), 6.0 + (16.0 * lines));

+    printf("  dup 6 sub %.0f %d index %.0f ESPrs\n",

+           (top - 6.0 - (16.0 * lines)), (2 + lines), 4.0 + (16.0 * lines));

+    for (n = 0; n < lines; n ++)

+    {

+      printf("  dup %.0f moveto ESPp%c show\n",

+             bottom + 6.0 + ((lines - (n+1)) * 16.0), 'a' + n);

+      printf("  %.0f moveto ESPp%c show\n", top + 2.0 - ((n + 1) * 16.0), 'a' + n);

+    }

+    printf("  pop\n"

+           "}bind put\n");

+

+   /*

+    * Do some clean up at the end of the LSPP special case

+    */

+    free(wrapped_label);

+

+  }

+  else

+  {

+#endif /* !WITH_LSPP */

+

  /*

   * Set the classification + page label string...

   */

@@ -3303,7 +3433,10 @@ write_label_prolog(pstops_doc_t *doc,	/*

   doc_printf(doc, "  %.0f moveto ESPpl show\n", top - 14.0);

   doc_puts(doc, "pop\n");

   doc_puts(doc, "}bind put\n");

+  }

+#ifdef WITH_LSPP

 }

+#endif /* WITH_LSPP */

 /*

diff -up cups-1.7.1/Makedefs.in.lspp cups-1.7.1/Makedefs.in

--- cups-1.7.1/Makedefs.in.lspp	2014-01-08 18:43:27.282821790 +0100

+++ cups-1.7.1/Makedefs.in	2014-01-08 18:43:27.295821610 +0100

@@ -149,7 +149,7 @@ LDFLAGS		=	-L../cgi-bin -L../cups -L../f

 			@LDFLAGS@ @RELROFLAGS@ @PIEFLAGS@ $(OPTIM)

 LINKCUPS	=	@LINKCUPS@ $(LIBGSSAPI) $(SSLLIBS) $(DNSSDLIBS) $(LIBZ)

 LINKCUPSIMAGE	=	@LINKCUPSIMAGE@

-LIBS		=	$(LINKCUPS) $(COMMONLIBS)

+LIBS		=	$(LINKCUPS) $(COMMONLIBS) @LIBAUDIT@ @LIBSELINUX@

 OPTIM		=	@OPTIM@

 OPTIONS		=

 PAMLIBS		=	@PAMLIBS@

diff -up cups-1.7.1/scheduler/client.c.lspp cups-1.7.1/scheduler/client.c

--- cups-1.7.1/scheduler/client.c.lspp	2013-09-27 16:09:25.000000000 +0200

+++ cups-1.7.1/scheduler/client.c	2014-01-08 18:43:27.298821568 +0100

@@ -49,6 +50,7 @@

 #include "cupsd.h"

+#define _GNU_SOURCE

 #ifdef __APPLE__

 #  include <libproc.h>

 #endif /* __APPLE__ */

@@ -56,6 +58,11 @@

 #  include <tcpd.h>

 #endif /* HAVE_TCPD_H */

+#ifdef WITH_LSPP

+#include <selinux/selinux.h>

+#include <selinux/context.h>

+#include <fcntl.h>

+#endif /* WITH_LSPP */

 /*

  * Local globals...

@@ -378,6 +385,57 @@ cupsdAcceptClient(cupsd_listener_t *lis)

   }

 #endif /* HAVE_TCPD_H */

+#ifdef WITH_LSPP

+  if (is_lspp_config())

+  {

+    struct ucred cr;

+    unsigned int cl=sizeof(cr);

+

+    if (getsockopt(con->http.fd, SOL_SOCKET, SO_PEERCRED, &cr, &cl) == 0)

+    {

+     /*

+      * client_pid_to_auid() can be racey

+      * In this case the pid is based on a socket connected to the client

+      */

+      if ((con->auid = client_pid_to_auid(cr.pid)) == -1)

+      {

+        close(con->http.fd);

+        cupsdLogMessage(CUPSD_LOG_ERROR, "cupsdAcceptClient: "

+                        "unable to determine client auid for client pid=%d", cr.pid);

+        free(con);

+        return;

+      }

+      cupsdLogMessage(CUPSD_LOG_INFO, "cupsdAcceptClient: peer's pid=%d, uid=%d, gid=%d, auid=%d",

+                      cr.pid, cr.uid, cr.gid, con->auid);

+    }

+    else

+    {

+      close(con->http.fd);

+      cupsdLogMessage(CUPSD_LOG_ERROR, "cupsdAcceptClient: getsockopt() failed");

+      free(con);

+      return; 

+    }

+

+   /*

+    * get the context of the peer connection

+    */

+    if (getpeercon(con->http.fd, &con->scon))

+    {

+      close(con->http.fd);

+      cupsdLogMessage(CUPSD_LOG_ERROR, "cupsdAcceptClient: getpeercon() failed");

+      free(con);

+      return; 

+    }

+

+    cupsdLogMessage(CUPSD_LOG_INFO, "cupsdAcceptClient: client context=%s", con->scon);

+  }

+  else

+  {

+    cupsdLogMessage(CUPSD_LOG_DEBUG, "cupsdAcceptClient: skipping getpeercon()");

+    cupsdSetString(&con->scon, UNKNOWN_SL);

+  }

+#endif /* WITH_LSPP */

+

 #ifdef AF_LOCAL

   if (con->http.hostaddr->addr.sa_family == AF_LOCAL)

   {

@@ -714,6 +772,13 @@ cupsdReadClient(cupsd_client_t *con)	/*

   mime_type_t		*type;		/* MIME type of file */

   cupsd_printer_t	*p;		/* Printer */

   static unsigned	request_id = 0;	/* Request ID for temp files */

+#ifdef WITH_LSPP

+  security_context_t	spoolcon;	/* context of the job file */

+  context_t		clicon;		/* contex_t container for con->scon */

+  context_t		tmpcon;		/* temp context to swap the level */

+  char			*clirange;	/* SELinux sensitivity range */

+  char			*cliclearance;	/* SELinux low end clearance */

+#endif /* WITH_LSPP */

   status = HTTP_CONTINUE;

@@ -2231,6 +2296,67 @@ cupsdReadClient(cupsd_client_t *con)	/*

 	    fchmod(con->file, 0640);

 	    fchown(con->file, RunUser, Group);

             fcntl(con->file, F_SETFD, fcntl(con->file, F_GETFD) | FD_CLOEXEC);

+#ifdef WITH_LSPP

+	    if (strncmp(con->scon, UNKNOWN_SL, strlen(UNKNOWN_SL)) != 0)

+	    {

+	      if (getfilecon(con->filename, &spoolcon) == -1)

+	      {

+		cupsdSendError(con, HTTP_SERVER_ERROR, CUPSD_AUTH_NONE);

+		return (cupsdCloseClient(con));

+	      }

+	      clicon = context_new(con->scon);

+	      tmpcon = context_new(spoolcon);

+	      freecon(spoolcon);

+	      if (!clicon || !tmpcon)

+	      {

+		cupsdSendError(con, HTTP_SERVER_ERROR, CUPSD_AUTH_NONE);

+		if (clicon)

+		  context_free(clicon);

+		if (tmpcon)

+		  context_free(tmpcon);

+		return (cupsdCloseClient(con));

+	      }

+	      clirange = context_range_get(clicon);

+	      if (clirange)

+	      {

+		clirange = strdup(clirange);

+		if ((cliclearance = strtok(clirange, "-")) != NULL)

+		{

+		  if (context_range_set(tmpcon, cliclearance) == -1)

+		  {

+		    cupsdSendError(con, HTTP_SERVER_ERROR, CUPSD_AUTH_NONE);

+		    free(clirange);

+		    context_free(tmpcon);

+		    context_free(clicon);

+		    return (cupsdCloseClient(con));

+		  }

+		}

+		else

+		{

+		  if (context_range_set(tmpcon, (context_range_get(clicon))) == -1)

+		  {

+		    cupsdSendError(con, HTTP_SERVER_ERROR, CUPSD_AUTH_NONE);

+		    free(clirange);

+		    context_free(tmpcon);

+		    context_free(clicon);

+		    return (cupsdCloseClient(con));

+		  }

+		}

+		free(clirange);

+	      }

+	      if (setfilecon(con->filename, context_str(tmpcon)) == -1)

+	      {

+		cupsdSendError(con, HTTP_SERVER_ERROR, CUPSD_AUTH_NONE);

+		context_free(tmpcon);

+		context_free(clicon);

+		return (cupsdCloseClient(con));

+	      }

+	      cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdReadClient: %s set to %s", 

+			      con->filename, context_str(tmpcon));

+	      context_free(tmpcon);

+	      context_free(clicon);

+	    }

+#endif /* WITH_LSPP */

 	  }

 	  if (con->http.state != HTTP_STATE_POST_SEND)

@@ -3727,6 +3853,49 @@ is_path_absolute(const char *path)	/* I

   return (1);

 }

+#ifdef WITH_LSPP

+/*

+ * 'client_pid_to_auid()' - Using the client's pid, read /proc and determine the loginuid.

+ */

+

+uid_t client_pid_to_auid(pid_t clipid)

+{

+  uid_t uid;

+  int len, in;

+  char buf[16] = {0};

+  char fname[32] = {0};

+

+

+ /*

+  * Hopefully this pid is still the one we are interested in.

+  */

+  snprintf(fname, 32, "/proc/%d/loginuid", clipid);

+  in = open(fname, O_NOFOLLOW|O_RDONLY);

+

+  if (in < 0)

+    return -1;

+

+  errno = 0;

+

+  do {

+    len = read(in, buf, sizeof(buf));

+  } while (len < 0 && errno == EINTR);

+

+  close(in);

+

+  if (len < 0 || len >= sizeof(buf))

+    return -1;

+

+  errno = 0;

+  buf[len] = 0;

+  uid = strtol(buf, 0, 10);

+

+  if (errno != 0)

+    return -1;

+  else

+    return uid;

+}

+#endif /* WITH_LSPP */

 /*

  * 'pipe_command()' - Pipe the output of a command to the remote client.

diff -up cups-1.7.1/scheduler/client.h.lspp cups-1.7.1/scheduler/client.h

--- cups-1.7.1/scheduler/client.h.lspp	2014-01-08 18:43:27.231822495 +0100

+++ cups-1.7.1/scheduler/client.h	2014-01-08 18:43:27.298821568 +0100

@@ -18,6 +18,13 @@

 #endif /* HAVE_AUTHORIZATION_H */

+/* Copyright (C) 2005 Trusted Computer Solutions, Inc. */

+/* (c) Copyright 2005-2006 Hewlett-Packard Development Company, L.P. */

+

+#ifdef WITH_LSPP

+#include <selinux/selinux.h>

+#endif /* WITH_LSPP */

+

 /*

  * HTTP client structure...

  */

@@ -65,6 +72,10 @@ struct cupsd_client_s

 #ifdef HAVE_AUTHORIZATION_H

   AuthorizationRef	authref;	/* Authorization ref */

 #endif /* HAVE_AUTHORIZATION_H */

+#ifdef WITH_LSPP

+  security_context_t	scon;		/* Security context of connection */

+  uid_t			auid;		/* Audit loginuid of the client */

+#endif /* WITH_LSPP */

 };

 #define HTTP(con) &((con)->http)

@@ -137,6 +148,9 @@ extern void	cupsdStartListening(void);

 extern void	cupsdStopListening(void);

 extern void	cupsdUpdateCGI(void);

 extern void	cupsdWriteClient(cupsd_client_t *con);

+#ifdef WITH_LSPP

+extern uid_t	client_pid_to_auid(pid_t clipid);

+#endif /* WITH_LSPP */

 #ifdef HAVE_SSL

 extern int	cupsdEndTLS(cupsd_client_t *con);

diff -up cups-1.7.1/scheduler/conf.c.lspp cups-1.7.1/scheduler/conf.c

--- cups-1.7.1/scheduler/conf.c.lspp	2014-01-08 18:43:27.291821665 +0100

+++ cups-1.7.1/scheduler/conf.c	2014-01-08 18:43:27.300821540 +0100

@@ -36,6 +36,9 @@

 #  define INADDR_NONE	0xffffffff

 #endif /* !INADDR_NONE */

+#ifdef WITH_LSPP

+#  include <libaudit.h>

+#endif /* WITH_LSPP */

 /*

  * Configuration variable structure...

@@ -123,6 +126,10 @@ static const cupsd_var_t	cupsd_vars[] =

   { "ServerName",		&ServerName,		CUPSD_VARTYPE_STRING },

   { "StrictConformance",	&StrictConformance,	CUPSD_VARTYPE_BOOLEAN },

   { "Timeout",			&Timeout,		CUPSD_VARTYPE_TIME },

+#ifdef WITH_LSPP

+  { "AuditLog",			&AuditLog,		CUPSD_VARTYPE_INTEGER },

+  { "PerPageLabels",		&PerPageLabels,		CUPSD_VARTYPE_BOOLEAN },

+#endif /* WITH_LSPP */

   { "WebInterface",		&WebInterface,		CUPSD_VARTYPE_BOOLEAN }

 };

 static const cupsd_var_t	cupsfiles_vars[] =

@@ -523,6 +530,9 @@ cupsdReadConfiguration(void)

   const char	*tmpdir;		/* TMPDIR environment variable */

   struct stat	tmpinfo;		/* Temporary directory info */

   cupsd_policy_t *p;			/* Policy */

+#ifdef WITH_LSPP

+  char		*audit_message;		/* Audit message string */

+#endif /* WITH_LSPP */

  /*

@@ -829,6 +839,25 @@ cupsdReadConfiguration(void)

   RunUser = getuid();

+#ifdef WITH_LSPP

+  if (AuditLog != -1)

+  {

+   /*

+    * ClassifyOverride is set during read_configuration, if its ON, report it now

+    */

+    if (ClassifyOverride)

+      audit_log_user_message(AuditLog, AUDIT_USYS_CONFIG,

+                "[Config] ClassifyOverride=enabled Users can override print banners",

+                ServerName, NULL, NULL, 1);

+   /*

+    * PerPageLabel is set during read_configuration, if its OFF, report it now

+    */

+    if (!PerPageLabels)

+      audit_log_user_message(AuditLog, AUDIT_USYS_CONFIG,

+                "[Config] PerPageLabels=disabled", ServerName, NULL, NULL, 1);

+  }