2d7496
--- cups-1.2.4-orig/config.h.in	2006-06-05 14:42:53.000000000 -0400
2d7496
+++ cups-1.2.4/config.h.in	2006-09-28 16:31:29.000000000 -0400
21b0f2
@@ -443,6 +443,13 @@
21b0f2
 #undef HAVE_APPLETALK_AT_PROTO_H
21b0f2
 
21b0f2
 
21b0f2
+/*
21b0f2
+ * Are we trying to meet LSPP requirements?
21b0f2
+ */
45f372
+
21b0f2
+#undef WITH_LSPP
45f372
+
21b0f2
+
21b0f2
 #endif /* !_CUPS_CONFIG_H_ */
21b0f2
 
21b0f2
 /*
2d7496
--- cups-1.2.4-orig/configure.in	2006-08-04 12:51:58.000000000 -0400
2d7496
+++ cups-1.2.4/configure.in	2006-09-28 16:31:29.000000000 -0400
45f372
@@ -47,6 +47,8 @@
45f372
 sinclude(config-scripts/cups-pdf.m4)
45f372
 sinclude(config-scripts/cups-scripting.m4)
45f372
 
45f372
+sinclude(config-scripts/cups-lspp.m4)
45f372
+
45f372
 INSTALL_LANGUAGES=""
45f372
 UNINSTALL_LANGUAGES=""
45f372
 LANGFILES=""
2d7496
--- cups-1.2.4-orig/config-scripts/cups-lspp.m4	1969-12-31 19:00:00.000000000 -0500
2d7496
+++ cups-1.2.4/config-scripts/cups-lspp.m4	2006-09-28 16:31:29.000000000 -0400
ddd55f
@@ -0,0 +1,36 @@
ddd55f
+dnl
ddd55f
+dnl   LSPP code for the Common UNIX Printing System (CUPS).
ddd55f
+dnl
ddd55f
+dnl   Copyright 2005-2006 by Hewlett-Packard Development Company, L.P.
ddd55f
+dnl
ddd55f
+dnl   This program is free software; you can redistribute it and/or modify
ddd55f
+dnl   it under the terms of the GNU General Public License as published by
ddd55f
+dnl   the Free Software Foundation; version 2.
ddd55f
+dnl
ddd55f
+dnl   This program is distributed in the hope that it will be useful, but
ddd55f
+dnl   WITHOUT ANY WARRANTY; without even the implied warranty of
ddd55f
+dnl   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
ddd55f
+dnl   General Public License for more details.
ddd55f
+dnl
ddd55f
+dnl   You should have received a copy of the GNU General Public License
ddd55f
+dnl   along with this program; if not, write to the Free Software Foundation,
ddd55f
+dnl   Inc., 51 Franklin Street, Fifth Floor Boston, MA 02110-1301 USA
ddd55f
+dnl
ddd55f
+
ddd55f
+dnl Are we trying to meet LSPP requirements
ddd55f
+AC_ARG_ENABLE(lspp, [  --enable-lspp           turn on auditing and label support, default=no])
ddd55f
+
ddd55f
+if test x"$enable_lspp" != xno; then
ddd55f
+    case "$uname" in
ddd55f
+        Linux)
ddd55f
+            AC_CHECK_LIB(audit,audit_log_user_message, [LIBAUDIT="-laudit" AC_SUBST(LIBAUDIT)])
ddd55f
+            AC_CHECK_HEADER(libaudit.h)
ddd55f
+            AC_CHECK_LIB(selinux,getpeercon, [LIBSELINUX="-lselinux" AC_SUBST(LIBSELINUX)])
ddd55f
+            AC_CHECK_HEADER(selinux/selinux.h)
ddd55f
+            AC_DEFINE(WITH_LSPP)
ddd55f
+            ;;
ddd55f
+        *)
ddd55f
+            # All others
ddd55f
+            ;;
ddd55f
+    esac
ddd55f
+fi
2d7496
--- cups-1.2.4-orig/cups/cups.h	2006-09-07 15:49:34.000000000 -0400
2d7496
+++ cups-1.2.4/cups/cups.h	2006-09-28 16:31:29.000000000 -0400
2d7496
@@ -24,6 +24,9 @@
21b0f2
  *   This file is subject to the Apple OS-Developed Software exception.
21b0f2
  */
21b0f2
 
21b0f2
+/* Copyright (C) 2005 Trusted Computer Solutions, Inc. */
2d7496
+/* (c) Copyright 2005-2006 Hewlett-Packard Development Company, L.P. */
21b0f2
+
21b0f2
 #ifndef _CUPS_CUPS_H_
21b0f2
 #  define _CUPS_CUPS_H_
21b0f2
 
2d7496
@@ -68,6 +71,12 @@
21b0f2
 #  define CUPS_DATE_ANY		-1
21b0f2
 
21b0f2
 
21b0f2
+# ifdef WITH_LSPP
21b0f2
+# define MLS_CONFIG "mls"
21b0f2
+# define TE_CONFIG "te"
21b0f2
+# define SELINUX_CONFIG "SELinux"
21b0f2
+# define UNKNOWN_SL "UNKNOWN SL"
21b0f2
+# endif /* WITH_LSPP */
21b0f2
 /*
21b0f2
  * Types and structures...
21b0f2
  */
2d7496
--- cups-1.2.4-orig/data/Makefile	2006-03-18 22:23:34.000000000 -0500
2d7496
+++ cups-1.2.4/data/Makefile	2006-09-28 16:31:29.000000000 -0400
21b0f2
@@ -34,7 +34,10 @@
21b0f2
 		secret \
21b0f2
 		standard \
21b0f2
 		topsecret \
21b0f2
-		unclassified
21b0f2
+		unclassified \
21b0f2
+		selinux \
21b0f2
+		mls \
21b0f2
+		te
21b0f2
 
21b0f2
 CHARMAPS =	\
21b0f2
 		euc-cn.txt \
2d7496
--- cups-1.2.4-orig/data/mls	1969-12-31 19:00:00.000000000 -0500
2d7496
+++ cups-1.2.4/data/mls	2006-09-28 16:31:29.000000000 -0400
45f372
@@ -0,0 +1,277 @@
45f372
+%!PS-Adobe-3.0
45f372
+%%BoundingBox: 0 0 612 792
45f372
+%%Pages: 1
45f372
+%%LanguageLevel: 1
45f372
+%%DocumentData: Clean7Bit
45f372
+%%DocumentSuppliedResources: procset bannerprint/1.0
45f372
+%%DocumentNeededResources: font Helvetica Helvetica-Bold Times-Roman
45f372
+%%Creator: Michael Sweet, Easy Software Products
45f372
+%%CreationDate: May 10, 2000
45f372
+%%Title: Test Page
45f372
+%%EndComments
45f372
+%%BeginProlog
45f372
+%%BeginResource procset bannerprint 1.1 0
45f372
+%
45f372
+%   PostScript banner page for the Common UNIX Printing System ("CUPS").
45f372
+%
45f372
+%   Copyright 1993-2005 by Easy Software Products
45f372
+%
45f372
+%   These coded instructions, statements, and computer programs are the
45f372
+%   property of Easy Software Products and are protected by Federal
45f372
+%   copyright law.  Distribution and use rights are outlined in the file
45f372
+%   "LICENSE.txt" which should have been included with this file.  If this
45f372
+%   file is missing or damaged please contact Easy Software Products
45f372
+%   at:
45f372
+%
45f372
+%       Attn: CUPS Licensing Information
45f372
+%       Easy Software Products
45f372
+%       44141 Airport View Drive, Suite 204
45f372
+%       Hollywood, Maryland 20636 USA
45f372
+%
45f372
+%       Voice: (301) 373-9600
45f372
+%       EMail: cups-info@cups.org
45f372
+%         WWW: http://www.cups.org
45f372
+%
45f372
+/CENTER {			% Draw centered text
45f372
+				% (name) CENTER -
45f372
+  dup stringwidth pop		% Get the width of the string
45f372
+  0.5 mul neg 0 rmoveto		% Shift left 1/2 of the distance
45f372
+  show				% Show the string
45f372
+} bind def
45f372
+/RIGHT {			% Draw right-justified text
45f372
+				% (name) RIGHT -
45f372
+  dup stringwidth pop		% Get the width of the string
45f372
+  neg 0 rmoveto			% Shift left the entire distance
45f372
+  show				% Show the string
45f372
+} bind def
45f372
+/NUMBER {			% Draw a number
45f372
+				% power n NUMBER -
45f372
+  1 index 1 eq {		% power == 1?
45f372
+    round cvi exch pop		% Convert "n" to integer
45f372
+  } {
45f372
+    1 index mul round exch div	% Truncate extra decimal places
45f372
+  } ifelse
45f372
+  100 string cvs show		% Convert to a string and show it...
45f372
+} bind def
45f372
+/CUPSLOGO {			% Draw the CUPS logo
45f372
+				% height CUPSLOGO
45f372
+  % Start with a big C...
45f372
+  /Helvetica findfont 1 index scalefont setfont
45f372
+  0 setgray
45f372
+  0 0 moveto
45f372
+  (C) show
45f372
+
45f372
+  % Then "UNIX Printing System" much smaller...
45f372
+  /Helvetica-Bold findfont 1 index 9 div scalefont setfont
45f372
+  0.25 mul
45f372
+  dup dup 2.0 mul moveto
45f372
+  (UNIX) show
45f372
+  dup dup 1.6 mul moveto
45f372
+  (Printing) show
45f372
+  dup 1.2 mul moveto
45f372
+  (System) show
45f372
+} bind def
45f372
+/ESPLOGO {			% Draw the ESP logo
45f372
+				% height ESPLOGO
45f372
+  % Compute the size of the logo...
45f372
+  0 0
45f372
+  2 index 1.5 mul 3 index
45f372
+
45f372
+  % Do the "metallic" fill from 10% black to 40% black...
45f372
+  1 -0.001 0 {
45f372
+    dup			% loopval
45f372
+    -0.15 mul		% loopval * -0.15
45f372
+    0.9 add		% 0.9 - loopval * 0.15
45f372
+    setgray		% set gray shade
45f372
+
45f372
+    0			% x
45f372
+    1 index neg		% loopval
45f372
+    1 add		% 1 - loopval
45f372
+    3 index		% height
45f372
+    mul			% height * (1 - loopval)
45f372
+    moveto		% starting point
45f372
+
45f372
+    dup			% loopval
45f372
+    3 index		% width
45f372
+    mul			% loopval * width
45f372
+    2 index		% height
45f372
+    lineto		% Next point
45f372
+
45f372
+    0			% x
45f372
+    2 index		% height
45f372
+    lineto		% Next point
45f372
+
45f372
+    closepath
45f372
+    fill
45f372
+
45f372
+    dup			% loopval
45f372
+    0.15 mul		% loopval * 0.15
45f372
+    0.6 add		% 0.6 + loopval * 0.15
45f372
+    setgray
45f372
+
45f372
+    dup			% loopval
45f372
+    neg 1 add		% 1 - loopval
45f372
+    3 index		% width
45f372
+    mul			% (1 - loopval) * width
45f372
+    0			% y
45f372
+    moveto		% Starting point
45f372
+
45f372
+    2 index		% width
45f372
+    exch		% loopval
45f372
+    2 index		% height
45f372
+    mul			% loopval * height
45f372
+    lineto		% Next point
45f372
+
45f372
+    1 index		% width
45f372
+    0			% y
45f372
+    lineto		% Next point
45f372
+
45f372
+    closepath
45f372
+    fill
45f372
+  } for
45f372
+
45f372
+  0 setgray rectstroke
45f372
+
45f372
+  /Helvetica-BoldOblique findfont 1 index 3 div scalefont setfont
45f372
+  dup 40 div
45f372
+
45f372
+  dup 4 mul 1 index 25 mul moveto (E) show
45f372
+  dup 10 mul 1 index 15 mul moveto (S) show
45f372
+  dup 16 mul 1 index 5 mul moveto (P) show
45f372
+
45f372
+  /Helvetica-BoldOblique findfont 2 index 5 div scalefont setfont
45f372
+  dup 14 mul 1 index 29 mul moveto (asy) show
45f372
+  dup 20 mul 1 index 19 mul moveto (oftware) show
45f372
+  dup 26 mul 1 index 9 mul moveto (roducts) show
45f372
+
45f372
+  pop
45f372
+} bind def
45f372
+%%EndResource
45f372
+%%EndProlog
45f372
+%%Page: 1 1
45f372
+gsave
45f372
+
45f372
+  % Determine the imageable area and device resolution...
45f372
+  initclip newpath clippath pathbbox	% Get bounding rectangle
45f372
+  72 div /pageTop exch def		% Get top margin in inches
45f372
+  72 div /pageRight exch def		% Get right margin in inches
45f372
+  72 div /pageBottom exch def		% Get bottom margin in inches
45f372
+  72 div /pageLeft exch def		% Get left margin in inches
45f372
+
45f372
+  /pageWidth pageRight pageLeft sub def	% pageWidth = pageRight - pageLeft
45f372
+  /pageHeight pageTop pageBottom sub def% pageHeight = pageTop - pageBottom
45f372
+
45f372
+  /boxWidth				% width of text box
45f372
+  pageWidth pageHeight lt
45f372
+  { pageWidth 54 mul }
45f372
+  { pageHeight 42 mul }
45f372
+  ifelse def
45f372
+
45f372
+  newpath				% Clear bounding path
45f372
+
45f372
+  % Create fonts...
45f372
+  /bigFont /Helvetica-Bold findfont	% bigFont = Helvetica-Bold
45f372
+  pageHeight 3 mul scalefont def	% size = pageHeight * 3 (nominally 33)
45f372
+
45f372
+  /mediumFont /Helvetica findfont	% mediumFont = Helvetica
45f372
+  pageHeight 1.5 mul scalefont def	% size = pageHeight * 1.5 (nominally 16.5)
45f372
+
45f372
+  % Offset page to account for lower-left margin...
45f372
+  pageLeft 72 mul
45f372
+  pageBottom 72 mul
45f372
+  translate
45f372
+
45f372
+  % Draw the label at the top and bottom...
45f372
+  0 setgray				% Color
45f372
+
45f372
+  pageWidth 36 mul			% Center of page
45f372
+  pageHeight 72 mul			% Top of page
45f372
+  pageWidth -7 mul add			% - 2 lines
45f372
+  moveto				% Position text
45f372
+  bigFont setfont			% Font
45f372
+  ({mls-label}) CENTER		% Show text centered
45f372
+
45f372
+  pageWidth 36 mul			% Center of page
45f372
+  pageHeight 6 mul			% Bottom of page
45f372
+  moveto				% Position text
45f372
+  bigFont setfont			% Font
45f372
+  ({mls-label}) CENTER		% Show text centered
45f372
+
45f372
+  % Job information box...
45f372
+  pageWidth 36 mul 9 add		% x = pageWidth * 1/2 * 72 + 9
45f372
+  boxWidth 0.5 mul sub			% x-= 1/2 box width
45f372
+  pageHeight 30 mul 9 sub		% y = pageHeight * 1/2 * 72 - 9
45f372
+  boxWidth				% w = box width
45f372
+  pageHeight 14 mul			% h = pageHeight * 1/2 * 72
45f372
+  0.5 setgray rectfill			% Draw a shadow
45f372
+
45f372
+  pageWidth 36 mul			% x = pageWidth * 1/2 * 72
45f372
+  boxWidth 0.5 mul sub			% x-= 1/2 box width
45f372
+  pageHeight 30 mul			% y = pageHeight * 1/4 * 72
45f372
+  boxWidth				% w = box width
45f372
+  pageHeight 14 mul			% h = pageHeight * 1/2 * 72
45f372
+
45f372
+  4 copy 1 setgray rectfill		% Clear the box to white
45f372
+  0 setgray rectstroke			% Draw a black box around it...
45f372
+
45f372
+  % Job information text...
45f372
+  mediumFont setfont			% Medium sized font
45f372
+
45f372
+  pageWidth 36 mul			% x = pageWidth * 1/2 * 72
45f372
+  pageHeight 36 mul			% y = pageHeight * 1/2 * 72
45f372
+  pageHeight 5 mul add			% y += 2 lines
45f372
+  2 copy				% Copy X & Y
45f372
+  moveto
45f372
+  (Job ID: ) RIGHT
45f372
+  moveto
45f372
+  ({printer-name}-{job-id}) show
45f372
+
45f372
+  pageWidth 36 mul			% x = pageWidth * 1/2 * 72
45f372
+  pageHeight 36 mul			% y = pageHeight * 1/2 * 72
45f372
+  pageHeight 2 mul add			% y += 1 line
45f372
+  2 copy				% Copy X & Y
45f372
+  moveto
45f372
+  (Title: ) RIGHT
45f372
+  moveto
45f372
+  ({job-name}) show
45f372
+
45f372
+  pageWidth 36 mul			% x = pageWidth * 1/2 * 72
45f372
+  pageHeight 36 mul			% y = pageHeight * 1/2 * 72
45f372
+  pageHeight -1 mul add			% y -= 1 line
45f372
+  2 copy				% Copy X & Y
45f372
+  moveto
45f372
+  (Requesting User: ) RIGHT
45f372
+  moveto
45f372
+  ({job-originating-user-name}) show
45f372
+
45f372
+  pageWidth 36 mul			% x = pageWidth * 1/2 * 72
45f372
+  pageHeight 36 mul			% y = pageHeight * 1/2 * 72
45f372
+  pageHeight -4 mul add			% y -= 2 lines
45f372
+  2 copy				% Copy X & Y
45f372
+  moveto
45f372
+  (Billing Info: ) RIGHT
45f372
+  moveto
45f372
+  ({?job-billing}) show
45f372
+
45f372
+  % Then the CUPS logo....
45f372
+  gsave
45f372
+    pageWidth 4 mul
45f372
+    pageWidth 6 mul
45f372
+    translate
45f372
+    pageWidth 9 mul CUPSLOGO
45f372
+  grestore
45f372
+
45f372
+  % And the ESP logo....
45f372
+  gsave
45f372
+    pageWidth 59 mul
45f372
+    pageWidth 6 mul
45f372
+    translate
45f372
+    pageWidth 6 mul ESPLOGO
45f372
+  grestore
45f372
+% Show the page...
45f372
+grestore
45f372
+showpage
45f372
+%
45f372
+% End of "$Id: mls_template,v 1.1 2005/06/27 18:44:46 colmo Exp $".
45f372
+%
45f372
+%%EOF
2d7496
--- cups-1.2.4-orig/data/selinux	1969-12-31 19:00:00.000000000 -0500
2d7496
+++ cups-1.2.4/data/selinux	2006-09-28 16:31:29.000000000 -0400
45f372
@@ -0,0 +1,277 @@
45f372
+%!PS-Adobe-3.0
45f372
+%%BoundingBox: 0 0 612 792
45f372
+%%Pages: 1
45f372
+%%LanguageLevel: 1
45f372
+%%DocumentData: Clean7Bit
45f372
+%%DocumentSuppliedResources: procset bannerprint/1.0
45f372
+%%DocumentNeededResources: font Helvetica Helvetica-Bold Times-Roman
45f372
+%%Creator: Michael Sweet, Easy Software Products
45f372
+%%CreationDate: May 10, 2000
45f372
+%%Title: Test Page
45f372
+%%EndComments
45f372
+%%BeginProlog
45f372
+%%BeginResource procset bannerprint 1.1 0
45f372
+%
45f372
+%   PostScript banner page for the Common UNIX Printing System ("CUPS").
45f372
+%
45f372
+%   Copyright 1993-2005 by Easy Software Products
45f372
+%
45f372
+%   These coded instructions, statements, and computer programs are the
45f372
+%   property of Easy Software Products and are protected by Federal
45f372
+%   copyright law.  Distribution and use rights are outlined in the file
45f372
+%   "LICENSE.txt" which should have been included with this file.  If this
45f372
+%   file is missing or damaged please contact Easy Software Products
45f372
+%   at:
45f372
+%
45f372
+%       Attn: CUPS Licensing Information
45f372
+%       Easy Software Products
45f372
+%       44141 Airport View Drive, Suite 204
45f372
+%       Hollywood, Maryland 20636 USA
45f372
+%
45f372
+%       Voice: (301) 373-9600
45f372
+%       EMail: cups-info@cups.org
45f372
+%         WWW: http://www.cups.org
45f372
+%
45f372
+/CENTER {			% Draw centered text
45f372
+				% (name) CENTER -
45f372
+  dup stringwidth pop		% Get the width of the string
45f372
+  0.5 mul neg 0 rmoveto		% Shift left 1/2 of the distance
45f372
+  show				% Show the string
45f372
+} bind def
45f372
+/RIGHT {			% Draw right-justified text
45f372
+				% (name) RIGHT -
45f372
+  dup stringwidth pop		% Get the width of the string
45f372
+  neg 0 rmoveto			% Shift left the entire distance
45f372
+  show				% Show the string
45f372
+} bind def
45f372
+/NUMBER {			% Draw a number
45f372
+				% power n NUMBER -
45f372
+  1 index 1 eq {		% power == 1?
45f372
+    round cvi exch pop		% Convert "n" to integer
45f372
+  } {
45f372
+    1 index mul round exch div	% Truncate extra decimal places
45f372
+  } ifelse
45f372
+  100 string cvs show		% Convert to a string and show it...
45f372
+} bind def
45f372
+/CUPSLOGO {			% Draw the CUPS logo
45f372
+				% height CUPSLOGO
45f372
+  % Start with a big C...
45f372
+  /Helvetica findfont 1 index scalefont setfont
45f372
+  0 setgray
45f372
+  0 0 moveto
45f372
+  (C) show
45f372
+
45f372
+  % Then "UNIX Printing System" much smaller...
45f372
+  /Helvetica-Bold findfont 1 index 9 div scalefont setfont
45f372
+  0.25 mul
45f372
+  dup dup 2.0 mul moveto
45f372
+  (UNIX) show
45f372
+  dup dup 1.6 mul moveto
45f372
+  (Printing) show
45f372
+  dup 1.2 mul moveto
45f372
+  (System) show
45f372
+} bind def
45f372
+/ESPLOGO {			% Draw the ESP logo
45f372
+				% height ESPLOGO
45f372
+  % Compute the size of the logo...
45f372
+  0 0
45f372
+  2 index 1.5 mul 3 index
45f372
+
45f372
+  % Do the "metallic" fill from 10% black to 40% black...
45f372
+  1 -0.001 0 {
45f372
+    dup			% loopval
45f372
+    -0.15 mul		% loopval * -0.15
45f372
+    0.9 add		% 0.9 - loopval * 0.15
45f372
+    setgray		% set gray shade
45f372
+
45f372
+    0			% x
45f372
+    1 index neg		% loopval
45f372
+    1 add		% 1 - loopval
45f372
+    3 index		% height
45f372
+    mul			% height * (1 - loopval)
45f372
+    moveto		% starting point
45f372
+
45f372
+    dup			% loopval
45f372
+    3 index		% width
45f372
+    mul			% loopval * width
45f372
+    2 index		% height
45f372
+    lineto		% Next point
45f372
+
45f372
+    0			% x
45f372
+    2 index		% height
45f372
+    lineto		% Next point
45f372
+
45f372
+    closepath
45f372
+    fill
45f372
+
45f372
+    dup			% loopval
45f372
+    0.15 mul		% loopval * 0.15
45f372
+    0.6 add		% 0.6 + loopval * 0.15
45f372
+    setgray
45f372
+
45f372
+    dup			% loopval
45f372
+    neg 1 add		% 1 - loopval
45f372
+    3 index		% width
45f372
+    mul			% (1 - loopval) * width
45f372
+    0			% y
45f372
+    moveto		% Starting point
45f372
+
45f372
+    2 index		% width
45f372
+    exch		% loopval
45f372
+    2 index		% height
45f372
+    mul			% loopval * height
45f372
+    lineto		% Next point
45f372
+
45f372
+    1 index		% width
45f372
+    0			% y
45f372
+    lineto		% Next point
45f372
+
45f372
+    closepath
45f372
+    fill
45f372
+  } for
45f372
+
45f372
+  0 setgray rectstroke
45f372
+
45f372
+  /Helvetica-BoldOblique findfont 1 index 3 div scalefont setfont
45f372
+  dup 40 div
45f372
+
45f372
+  dup 4 mul 1 index 25 mul moveto (E) show
45f372
+  dup 10 mul 1 index 15 mul moveto (S) show
45f372
+  dup 16 mul 1 index 5 mul moveto (P) show
45f372
+
45f372
+  /Helvetica-BoldOblique findfont 2 index 5 div scalefont setfont
45f372
+  dup 14 mul 1 index 29 mul moveto (asy) show
45f372
+  dup 20 mul 1 index 19 mul moveto (oftware) show
45f372
+  dup 26 mul 1 index 9 mul moveto (roducts) show
45f372
+
45f372
+  pop
45f372
+} bind def
45f372
+%%EndResource
45f372
+%%EndProlog
45f372
+%%Page: 1 1
45f372
+gsave
45f372
+
45f372
+  % Determine the imageable area and device resolution...
45f372
+  initclip newpath clippath pathbbox	% Get bounding rectangle
45f372
+  72 div /pageTop exch def		% Get top margin in inches
45f372
+  72 div /pageRight exch def		% Get right margin in inches
45f372
+  72 div /pageBottom exch def		% Get bottom margin in inches
45f372
+  72 div /pageLeft exch def		% Get left margin in inches
45f372
+
45f372
+  /pageWidth pageRight pageLeft sub def	% pageWidth = pageRight - pageLeft
45f372
+  /pageHeight pageTop pageBottom sub def% pageHeight = pageTop - pageBottom
45f372
+
45f372
+  /boxWidth				% width of text box
45f372
+  pageWidth pageHeight lt
45f372
+  { pageWidth 54 mul }
45f372
+  { pageHeight 42 mul }
45f372
+  ifelse def
45f372
+
45f372
+  newpath				% Clear bounding path
45f372
+
45f372
+  % Create fonts...
45f372
+  /bigFont /Helvetica-Bold findfont	% bigFont = Helvetica-Bold
45f372
+  pageHeight 3 mul scalefont def	% size = pageHeight * 3 (nominally 33)
45f372
+
45f372
+  /mediumFont /Helvetica findfont	% mediumFont = Helvetica
45f372
+  pageHeight 1.5 mul scalefont def	% size = pageHeight * 1.5 (nominally 16.5)
45f372
+
45f372
+  % Offset page to account for lower-left margin...
45f372
+  pageLeft 72 mul
45f372
+  pageBottom 72 mul
45f372
+  translate
45f372
+
45f372
+  % Draw the label at the top and bottom...
45f372
+  0 setgray				% Color
45f372
+
45f372
+  pageWidth 36 mul			% Center of page
45f372
+  pageHeight 72 mul			% Top of page
45f372
+  pageWidth -7 mul add			% - 2 lines
45f372
+  moveto				% Position text
45f372
+  bigFont setfont			% Font
45f372
+  ({mls-label}) CENTER		% Show text centered
45f372
+
45f372
+  pageWidth 36 mul			% Center of page
45f372
+  pageHeight 6 mul			% Bottom of page
45f372
+  moveto				% Position text
45f372
+  bigFont setfont			% Font
45f372
+  ({mls-label}) CENTER		% Show text centered
45f372
+
45f372
+  % Job information box...
45f372
+  pageWidth 36 mul 9 add		% x = pageWidth * 1/2 * 72 + 9
45f372
+  boxWidth 0.5 mul sub			% x-= 1/2 box width
45f372
+  pageHeight 30 mul 9 sub		% y = pageHeight * 1/2 * 72 - 9
45f372
+  boxWidth				% w = box width
45f372
+  pageHeight 14 mul			% h = pageHeight * 1/2 * 72
45f372
+  0.5 setgray rectfill			% Draw a shadow
45f372
+
45f372
+  pageWidth 36 mul			% x = pageWidth * 1/2 * 72
45f372
+  boxWidth 0.5 mul sub			% x-= 1/2 box width
45f372
+  pageHeight 30 mul			% y = pageHeight * 1/4 * 72
45f372
+  boxWidth				% w = box width
45f372
+  pageHeight 14 mul			% h = pageHeight * 1/2 * 72
45f372
+
45f372
+  4 copy 1 setgray rectfill		% Clear the box to white
45f372
+  0 setgray rectstroke			% Draw a black box around it...
45f372
+
45f372
+  % Job information text...
45f372
+  mediumFont setfont			% Medium sized font
45f372
+
45f372
+  pageWidth 36 mul			% x = pageWidth * 1/2 * 72
45f372
+  pageHeight 36 mul			% y = pageHeight * 1/2 * 72
45f372
+  pageHeight 5 mul add			% y += 2 lines
45f372
+  2 copy				% Copy X & Y
45f372
+  moveto
45f372
+  (Job ID: ) RIGHT
45f372
+  moveto
45f372
+  ({printer-name}-{job-id}) show
45f372
+
45f372
+  pageWidth 36 mul			% x = pageWidth * 1/2 * 72
45f372
+  pageHeight 36 mul			% y = pageHeight * 1/2 * 72
45f372
+  pageHeight 2 mul add			% y += 1 line
45f372
+  2 copy				% Copy X & Y
45f372
+  moveto
45f372
+  (Title: ) RIGHT
45f372
+  moveto
45f372
+  ({job-name}) show
45f372
+
45f372
+  pageWidth 36 mul			% x = pageWidth * 1/2 * 72
45f372
+  pageHeight 36 mul			% y = pageHeight * 1/2 * 72
45f372
+  pageHeight -1 mul add			% y -= 1 line
45f372
+  2 copy				% Copy X & Y
45f372
+  moveto
45f372
+  (Requesting User: ) RIGHT
45f372
+  moveto
45f372
+  ({job-originating-user-name}) show
45f372
+
45f372
+  pageWidth 36 mul			% x = pageWidth * 1/2 * 72
45f372
+  pageHeight 36 mul			% y = pageHeight * 1/2 * 72
45f372
+  pageHeight -4 mul add			% y -= 2 lines
45f372
+  2 copy				% Copy X & Y
45f372
+  moveto
45f372
+  (Billing Info: ) RIGHT
45f372
+  moveto
45f372
+  ({?job-billing}) show
45f372
+
45f372
+  % Then the CUPS logo....
45f372
+  gsave
45f372
+    pageWidth 4 mul
45f372
+    pageWidth 6 mul
45f372
+    translate
45f372
+    pageWidth 9 mul CUPSLOGO
45f372
+  grestore
45f372
+
45f372
+  % And the ESP logo....
45f372
+  gsave
45f372
+    pageWidth 59 mul
45f372
+    pageWidth 6 mul
45f372
+    translate
45f372
+    pageWidth 6 mul ESPLOGO
45f372
+  grestore
45f372
+% Show the page...
45f372
+grestore
45f372
+showpage
45f372
+%
45f372
+% End of "$Id: mls_template,v 1.1 2005/06/27 18:44:46 colmo Exp $".
45f372
+%
45f372
+%%EOF
2d7496
--- cups-1.2.4-orig/data/te	1969-12-31 19:00:00.000000000 -0500
2d7496
+++ cups-1.2.4/data/te	2006-09-28 16:31:29.000000000 -0400
45f372
@@ -0,0 +1,277 @@
45f372
+%!PS-Adobe-3.0
45f372
+%%BoundingBox: 0 0 612 792
45f372
+%%Pages: 1
45f372
+%%LanguageLevel: 1
45f372
+%%DocumentData: Clean7Bit
45f372
+%%DocumentSuppliedResources: procset bannerprint/1.0
45f372
+%%DocumentNeededResources: font Helvetica Helvetica-Bold Times-Roman
45f372
+%%Creator: Michael Sweet, Easy Software Products
45f372
+%%CreationDate: May 10, 2000
45f372
+%%Title: Test Page
45f372
+%%EndComments
45f372
+%%BeginProlog
45f372
+%%BeginResource procset bannerprint 1.1 0
45f372
+%
45f372
+%   PostScript banner page for the Common UNIX Printing System ("CUPS").
45f372
+%
45f372
+%   Copyright 1993-2005 by Easy Software Products
45f372
+%
45f372
+%   These coded instructions, statements, and computer programs are the
45f372
+%   property of Easy Software Products and are protected by Federal
45f372
+%   copyright law.  Distribution and use rights are outlined in the file
45f372
+%   "LICENSE.txt" which should have been included with this file.  If this
45f372
+%   file is missing or damaged please contact Easy Software Products
45f372
+%   at:
45f372
+%
45f372
+%       Attn: CUPS Licensing Information
45f372
+%       Easy Software Products
45f372
+%       44141 Airport View Drive, Suite 204
45f372
+%       Hollywood, Maryland 20636 USA
45f372
+%
45f372
+%       Voice: (301) 373-9600
45f372
+%       EMail: cups-info@cups.org
45f372
+%         WWW: http://www.cups.org
45f372
+%
45f372
+/CENTER {			% Draw centered text
45f372
+				% (name) CENTER -
45f372
+  dup stringwidth pop		% Get the width of the string
45f372
+  0.5 mul neg 0 rmoveto		% Shift left 1/2 of the distance
45f372
+  show				% Show the string
45f372
+} bind def
45f372
+/RIGHT {			% Draw right-justified text
45f372
+				% (name) RIGHT -
45f372
+  dup stringwidth pop		% Get the width of the string
45f372
+  neg 0 rmoveto			% Shift left the entire distance
45f372
+  show				% Show the string
45f372
+} bind def
45f372
+/NUMBER {			% Draw a number
45f372
+				% power n NUMBER -
45f372
+  1 index 1 eq {		% power == 1?
45f372
+    round cvi exch pop		% Convert "n" to integer
45f372
+  } {
45f372
+    1 index mul round exch div	% Truncate extra decimal places
45f372
+  } ifelse
45f372
+  100 string cvs show		% Convert to a string and show it...
45f372
+} bind def
45f372
+/CUPSLOGO {			% Draw the CUPS logo
45f372
+				% height CUPSLOGO
45f372
+  % Start with a big C...
45f372
+  /Helvetica findfont 1 index scalefont setfont
45f372
+  0 setgray
45f372
+  0 0 moveto
45f372
+  (C) show
45f372
+
45f372
+  % Then "UNIX Printing System" much smaller...
45f372
+  /Helvetica-Bold findfont 1 index 9 div scalefont setfont
45f372
+  0.25 mul
45f372
+  dup dup 2.0 mul moveto
45f372
+  (UNIX) show
45f372
+  dup dup 1.6 mul moveto
45f372
+  (Printing) show
45f372
+  dup 1.2 mul moveto
45f372
+  (System) show
45f372
+} bind def
45f372
+/ESPLOGO {			% Draw the ESP logo
45f372
+				% height ESPLOGO
45f372
+  % Compute the size of the logo...
45f372
+  0 0
45f372
+  2 index 1.5 mul 3 index
45f372
+
45f372
+  % Do the "metallic" fill from 10% black to 40% black...
45f372
+  1 -0.001 0 {
45f372
+    dup			% loopval
45f372
+    -0.15 mul		% loopval * -0.15
45f372
+    0.9 add		% 0.9 - loopval * 0.15
45f372
+    setgray		% set gray shade
45f372
+
45f372
+    0			% x
45f372
+    1 index neg		% loopval
45f372
+    1 add		% 1 - loopval
45f372
+    3 index		% height
45f372
+    mul			% height * (1 - loopval)
45f372
+    moveto		% starting point
45f372
+
45f372
+    dup			% loopval
45f372
+    3 index		% width
45f372
+    mul			% loopval * width
45f372
+    2 index		% height
45f372
+    lineto		% Next point
45f372
+
45f372
+    0			% x
45f372
+    2 index		% height
45f372
+    lineto		% Next point
45f372
+
45f372
+    closepath
45f372
+    fill
45f372
+
45f372
+    dup			% loopval
45f372
+    0.15 mul		% loopval * 0.15
45f372
+    0.6 add		% 0.6 + loopval * 0.15
45f372
+    setgray
45f372
+
45f372
+    dup			% loopval
45f372
+    neg 1 add		% 1 - loopval
45f372
+    3 index		% width
45f372
+    mul			% (1 - loopval) * width
45f372
+    0			% y
45f372
+    moveto		% Starting point
45f372
+
45f372
+    2 index		% width
45f372
+    exch		% loopval
45f372
+    2 index		% height
45f372
+    mul			% loopval * height
45f372
+    lineto		% Next point
45f372
+
45f372
+    1 index		% width
45f372
+    0			% y
45f372
+    lineto		% Next point
45f372
+
45f372
+    closepath
45f372
+    fill
45f372
+  } for
45f372
+
45f372
+  0 setgray rectstroke
45f372
+
45f372
+  /Helvetica-BoldOblique findfont 1 index 3 div scalefont setfont
45f372
+  dup 40 div
45f372
+
45f372
+  dup 4 mul 1 index 25 mul moveto (E) show
45f372
+  dup 10 mul 1 index 15 mul moveto (S) show
45f372
+  dup 16 mul 1 index 5 mul moveto (P) show
45f372
+
45f372
+  /Helvetica-BoldOblique findfont 2 index 5 div scalefont setfont
45f372
+  dup 14 mul 1 index 29 mul moveto (asy) show
45f372
+  dup 20 mul 1 index 19 mul moveto (oftware) show
45f372
+  dup 26 mul 1 index 9 mul moveto (roducts) show
45f372
+
45f372
+  pop
45f372
+} bind def
45f372
+%%EndResource
45f372
+%%EndProlog
45f372
+%%Page: 1 1
45f372
+gsave
45f372
+
45f372
+  % Determine the imageable area and device resolution...
45f372
+  initclip newpath clippath pathbbox	% Get bounding rectangle
45f372
+  72 div /pageTop exch def		% Get top margin in inches
45f372
+  72 div /pageRight exch def		% Get right margin in inches
45f372
+  72 div /pageBottom exch def		% Get bottom margin in inches
45f372
+  72 div /pageLeft exch def		% Get left margin in inches
45f372
+
45f372
+  /pageWidth pageRight pageLeft sub def	% pageWidth = pageRight - pageLeft
45f372
+  /pageHeight pageTop pageBottom sub def% pageHeight = pageTop - pageBottom
45f372
+
45f372
+  /boxWidth				% width of text box
45f372
+  pageWidth pageHeight lt
45f372
+  { pageWidth 54 mul }
45f372
+  { pageHeight 42 mul }
45f372
+  ifelse def
45f372
+
45f372
+  newpath				% Clear bounding path
45f372
+
45f372
+  % Create fonts...
45f372
+  /bigFont /Helvetica-Bold findfont	% bigFont = Helvetica-Bold
45f372
+  pageHeight 3 mul scalefont def	% size = pageHeight * 3 (nominally 33)
45f372
+
45f372
+  /mediumFont /Helvetica findfont	% mediumFont = Helvetica
45f372
+  pageHeight 1.5 mul scalefont def	% size = pageHeight * 1.5 (nominally 16.5)
45f372
+
45f372
+  % Offset page to account for lower-left margin...
45f372
+  pageLeft 72 mul
45f372
+  pageBottom 72 mul
45f372
+  translate
45f372
+
45f372
+  % Draw the label at the top and bottom...
45f372
+  0 setgray				% Color
45f372
+
45f372
+  pageWidth 36 mul			% Center of page
45f372
+  pageHeight 72 mul			% Top of page
45f372
+  pageWidth -7 mul add			% - 2 lines
45f372
+  moveto				% Position text
45f372
+  bigFont setfont			% Font
45f372
+  ({mls-label}) CENTER		% Show text centered
45f372
+
45f372
+  pageWidth 36 mul			% Center of page
45f372
+  pageHeight 6 mul			% Bottom of page
45f372
+  moveto				% Position text
45f372
+  bigFont setfont			% Font
45f372
+  ({mls-label}) CENTER		% Show text centered
45f372
+
45f372
+  % Job information box...
45f372
+  pageWidth 36 mul 9 add		% x = pageWidth * 1/2 * 72 + 9
45f372
+  boxWidth 0.5 mul sub			% x-= 1/2 box width
45f372
+  pageHeight 30 mul 9 sub		% y = pageHeight * 1/2 * 72 - 9
45f372
+  boxWidth				% w = box width
45f372
+  pageHeight 14 mul			% h = pageHeight * 1/2 * 72
45f372
+  0.5 setgray rectfill			% Draw a shadow
45f372
+
45f372
+  pageWidth 36 mul			% x = pageWidth * 1/2 * 72
45f372
+  boxWidth 0.5 mul sub			% x-= 1/2 box width
45f372
+  pageHeight 30 mul			% y = pageHeight * 1/4 * 72
45f372
+  boxWidth				% w = box width
45f372
+  pageHeight 14 mul			% h = pageHeight * 1/2 * 72
45f372
+
45f372
+  4 copy 1 setgray rectfill		% Clear the box to white
45f372
+  0 setgray rectstroke			% Draw a black box around it...
45f372
+
45f372
+  % Job information text...
45f372
+  mediumFont setfont			% Medium sized font
45f372
+
45f372
+  pageWidth 36 mul			% x = pageWidth * 1/2 * 72
45f372
+  pageHeight 36 mul			% y = pageHeight * 1/2 * 72
45f372
+  pageHeight 5 mul add			% y += 2 lines
45f372
+  2 copy				% Copy X & Y
45f372
+  moveto
45f372
+  (Job ID: ) RIGHT
45f372
+  moveto
45f372
+  ({printer-name}-{job-id}) show
45f372
+
45f372
+  pageWidth 36 mul			% x = pageWidth * 1/2 * 72
45f372
+  pageHeight 36 mul			% y = pageHeight * 1/2 * 72
45f372
+  pageHeight 2 mul add			% y += 1 line
45f372
+  2 copy				% Copy X & Y
45f372
+  moveto
45f372
+  (Title: ) RIGHT
45f372
+  moveto
45f372
+  ({job-name}) show
45f372
+
45f372
+  pageWidth 36 mul			% x = pageWidth * 1/2 * 72
45f372
+  pageHeight 36 mul			% y = pageHeight * 1/2 * 72
45f372
+  pageHeight -1 mul add			% y -= 1 line
45f372
+  2 copy				% Copy X & Y
45f372
+  moveto
45f372
+  (Requesting User: ) RIGHT
45f372
+  moveto
45f372
+  ({job-originating-user-name}) show
45f372
+
45f372
+  pageWidth 36 mul			% x = pageWidth * 1/2 * 72
45f372
+  pageHeight 36 mul			% y = pageHeight * 1/2 * 72
45f372
+  pageHeight -4 mul add			% y -= 2 lines
45f372
+  2 copy				% Copy X & Y
45f372
+  moveto
45f372
+  (Billing Info: ) RIGHT
45f372
+  moveto
45f372
+  ({?job-billing}) show
45f372
+
45f372
+  % Then the CUPS logo....
45f372
+  gsave
45f372
+    pageWidth 4 mul
45f372
+    pageWidth 6 mul
45f372
+    translate
45f372
+    pageWidth 9 mul CUPSLOGO
45f372
+  grestore
45f372
+
45f372
+  % And the ESP logo....
45f372
+  gsave
45f372
+    pageWidth 59 mul
45f372
+    pageWidth 6 mul
45f372
+    translate
45f372
+    pageWidth 6 mul ESPLOGO
45f372
+  grestore
45f372
+% Show the page...
45f372
+grestore
45f372
+showpage
45f372
+%
45f372
+% End of "$Id: mls_template,v 1.1 2005/06/27 18:44:46 colmo Exp $".
45f372
+%
45f372
+%%EOF
2d7496
--- cups-1.2.4-orig/Makedefs.in	2006-09-28 11:38:14.000000000 -0400
2d7496
+++ cups-1.2.4/Makedefs.in	2006-09-28 16:31:29.000000000 -0400
21b0f2
@@ -135,7 +135,7 @@
21b0f2
 			@LDFLAGS@ @RELROFLAG@ @PIEFLAGS@ $(OPTIM)
21b0f2
 LINKCUPS	=	@LINKCUPS@ $(SSLLIBS)
21b0f2
 LINKCUPSIMAGE	=	@LINKCUPSIMAGE@
21b0f2
-LIBS		=	$(LINKCUPS) $(COMMONLIBS)
21b0f2
+LIBS		=	$(LINKCUPS) $(COMMONLIBS) @LIBAUDIT@ @LIBSELINUX@
21b0f2
 OPTIM		=	@OPTIM@
21b0f2
 OPTIONS		=
21b0f2
 PAMLIBS		=	@PAMLIBS@
2d7496
--- cups-1.2.4-orig/scheduler/client.c	2006-09-19 16:44:07.000000000 -0400
276351
+++ cups-1.2.4/scheduler/client.c	2006-10-16 15:30:02.000000000 -0400
2d7496
@@ -44,12 +44,17 @@
21b0f2
  *   make_certificate()      - Make a self-signed SSL/TLS certificate.
21b0f2
  *   pipe_command()          - Pipe the output of a command to the remote client.
21b0f2
  *   write_file()            - Send a file via HTTP.
21b0f2
+ *   client_pid_to_auid()    - Get the audit login uid of the client.
45f372
  */
45f372
 
21b0f2
+/* Copyright (C) 2005 Trusted Computer Solutions, Inc. */
45f372
+/* (c) Copyright 2005-2006 Hewlett-Packard Development Company, L.P. */
45f372
+
45f372
 /*
45f372
  * Include necessary headers...
45f372
  */
45f372
 
21b0f2
+#define _GNU_SOURCE
21b0f2
 #include <cups http-private.h="">
21b0f2
 #include "cupsd.h"
45f372
 
2d7496
@@ -65,6 +70,12 @@
21b0f2
 #  include <gnutls x509.h="">
21b0f2
 #endif /* HAVE_GNUTLS */
45f372
 
45f372
+#ifdef WITH_LSPP
45f372
+#include <selinux selinux.h="">
2d7496
+#include <selinux context.h="">
21b0f2
+#include <fcntl.h>
45f372
+#endif /* WITH_LSPP */
21b0f2
+
45f372
 
45f372
 /*
21b0f2
  * Local functions...
d4dd75
@@ -323,6 +334,57 @@
d4dd75
     }
d4dd75
   }
45f372
 
45f372
+#ifdef WITH_LSPP
21b0f2
+  if (is_lspp_config())
45f372
+  {
21b0f2
+    struct ucred cr;
21b0f2
+    unsigned int cl=sizeof(cr);
21b0f2
+
21b0f2
+    if (getsockopt(con->http.fd, SOL_SOCKET, SO_PEERCRED, &cr, &cl) == 0)
21b0f2
+    {
21b0f2
+     /*
21b0f2
+      * client_pid_to_auid() can be racey
21b0f2
+      * In this case the pid is based on a socket connected to the client
21b0f2
+      */
21b0f2
+      if ((con->auid = client_pid_to_auid(cr.pid)) == -1)
21b0f2
+      {
21b0f2
+        close(con->http.fd);
d4dd75
+        cupsdLogMessage(CUPSD_LOG_ERROR, "cupsdAcceptClient: "
d4dd75
+                        "unable to determine client auid for client pid=%d", cr.pid);
6e297c
+        free(con);
6e297c
+        return;
21b0f2
+      }
21b0f2
+      cupsdLogMessage(CUPSD_LOG_INFO, "cupsdAcceptClient: peer's pid=%d, uid=%d, gid=%d, auid=%d",
21b0f2
+                      cr.pid, cr.uid, cr.gid, con->auid);
21b0f2
+    }
21b0f2
+    else
21b0f2
+    {
21b0f2
+      close(con->http.fd);
21b0f2
+      cupsdLogMessage(CUPSD_LOG_ERROR, "cupsdAcceptClient: getsockopt() failed");
6e297c
+      free(con);
6e297c
+      return; 
21b0f2
+    }
21b0f2
+
45f372
+   /*
21b0f2
+    * get the context of the peer connection
45f372
+    */
21b0f2
+    if (getpeercon(con->http.fd, &con->scon))
21b0f2
+    {
d4dd75
+      close(con->http.fd);
21b0f2
+      cupsdLogMessage(CUPSD_LOG_ERROR, "cupsdAcceptClient: getpeercon() failed");
d4dd75
+      free(con);
d4dd75
+      return; 
21b0f2
+    }
21b0f2
+
21b0f2
+    cupsdLogMessage(CUPSD_LOG_INFO, "cupsdAcceptClient: client context=%s", con->scon);
21b0f2
+  }
21b0f2
+  else
21b0f2
+  {
276351
+    cupsdLogMessage(CUPSD_LOG_DEBUG, "cupsdAcceptClient: skipping getpeercon()");
21b0f2
+    cupsdSetString(&con->scon, UNKNOWN_SL);
45f372
+  }
45f372
+#endif /* WITH_LSPP */
45f372
+
d4dd75
 #ifdef AF_INET6
d4dd75
   if (con->http.hostaddr->addr.sa_family == AF_INET6)
d4dd75
     cupsdLogMessage(CUPSD_LOG_DEBUG, "cupsdAcceptClient: %d from %s:%d (IPv6)",
d4dd75
@@ -711,6 +773,13 @@
2d7496
   mime_type_t		*type;		/* MIME type of file */
2d7496
   cupsd_printer_t	*p;		/* Printer */
2d7496
   static unsigned	request_id = 0;	/* Request ID for temp files */
2d7496
+#ifdef WITH_LSPP
2d7496
+  security_context_t	spoolcon;	/* context of the job file */
2d7496
+  context_t		clicon;		/* contex_t container for con->scon */
2d7496
+  context_t		tmpcon;		/* temp context to swap the level */
d4dd75
+  char			*clirange;	/* SELinux sensitivity range */
d4dd75
+  char			*cliclearance;	/* SELinux low end clearance */
2d7496
+#endif /* WITH_LSPP */
45f372
 
2d7496
 
2d7496
   status = HTTP_CONTINUE;
d4dd75
@@ -1797,6 +1866,63 @@
2d7496
 	  fchmod(con->file, 0640);
2d7496
 	  fchown(con->file, RunUser, Group);
2d7496
           fcntl(con->file, F_SETFD, fcntl(con->file, F_GETFD) | FD_CLOEXEC);
2d7496
+#ifdef WITH_LSPP
143ac5
+          if (strncmp(con->scon, UNKNOWN_SL, strlen(UNKNOWN_SL)) != 0)
2d7496
+          {
143ac5
+            if (getfilecon(con->filename, &spoolcon) == -1)
143ac5
+            {
143ac5
+              cupsdSendError(con, HTTP_SERVER_ERROR);
143ac5
+              return (cupsdCloseClient(con));
143ac5
+            }
143ac5
+            clicon = context_new(con->scon);
143ac5
+            tmpcon = context_new(spoolcon);
2d7496
+            freecon(spoolcon);
6e297c
+            if (!clicon || !tmpcon)
6e297c
+            {
6e297c
+              cupsdSendError(con, HTTP_SERVER_ERROR);
6e297c
+              if (clicon)
6e297c
+                context_free(clicon);
6e297c
+              if (tmpcon)
6e297c
+                context_free(tmpcon);
6e297c
+              return (cupsdCloseClient(con));
6e297c
+            }
d4dd75
+            clirange = strdup(context_range_get(clicon));
d4dd75
+            if ((cliclearance = strtok(clirange, "-")) != NULL)
143ac5
+            {
d4dd75
+              if (context_range_set(tmpcon, cliclearance) == -1)
d4dd75
+              {
d4dd75
+                cupsdSendError(con, HTTP_SERVER_ERROR);
d4dd75
+                free(clirange);
d4dd75
+                context_free(tmpcon);
d4dd75
+                context_free(clicon);
d4dd75
+                return (cupsdCloseClient(con));
d4dd75
+              }
143ac5
+            }
d4dd75
+            else
d4dd75
+            {
d4dd75
+              if (context_range_set(tmpcon, (context_range_get(clicon))) == -1)
d4dd75
+              {
d4dd75
+                cupsdSendError(con, HTTP_SERVER_ERROR);
d4dd75
+                free(clirange);
d4dd75
+                context_free(tmpcon);
d4dd75
+                context_free(clicon);
d4dd75
+                return (cupsdCloseClient(con));
d4dd75
+              }
d4dd75
+            }
d4dd75
+            free(clirange);
143ac5
+            if (setfilecon(con->filename, context_str(tmpcon)) == -1)
143ac5
+            {
143ac5
+              cupsdSendError(con, HTTP_SERVER_ERROR);
143ac5
+              context_free(tmpcon);
143ac5
+              context_free(clicon);
143ac5
+              return (cupsdCloseClient(con));
143ac5
+            }
143ac5
+            cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdReadClient: %s set to %s", 
143ac5
+                            con->filename, context_str(tmpcon));
2d7496
+            context_free(tmpcon);
2d7496
+            context_free(clicon);
2d7496
+          }
2d7496
+#endif /* WITH_LSPP */
2d7496
 	}
2d7496
 
2d7496
 	if (con->http.state != HTTP_POST_SEND)
d4dd75
@@ -3810,6 +3936,50 @@
21b0f2
 #endif /* HAVE_SSL */
45f372
 
45f372
 
45f372
+#ifdef WITH_LSPP
21b0f2
+/*
21b0f2
+ * 'client_pid_to_auid()' - Using the client's pid, read /proc and determine the loginuid.
21b0f2
+ */
45f372
+
21b0f2
+uid_t client_pid_to_auid(pid_t clipid)
21b0f2
+{
21b0f2
+  uid_t uid;
21b0f2
+  int len, in;
21b0f2
+  char buf[16] = {0};
21b0f2
+  char fname[32] = {0};
45f372
+
45f372
+
21b0f2
+ /*
21b0f2
+  * Hopefully this pid is still the one we are interested in.
21b0f2
+  */
21b0f2
+  snprintf(fname, 32, "/proc/%d/loginuid", clipid);
21b0f2
+  in = open(fname, O_NOFOLLOW|O_RDONLY);
45f372
+
21b0f2
+  if (in < 0)
21b0f2
+    return -1;
45f372
+
21b0f2
+  errno = 0;
45f372
+
21b0f2
+  do {
21b0f2
+    len = read(in, buf, sizeof(buf));
21b0f2
+  } while (len < 0 && errno == EINTR);
45f372
+
21b0f2
+  close(in);
45f372
+
21b0f2
+  if (len < 0 || len >= sizeof(buf))
21b0f2
+    return -1;
21b0f2
+
d4dd75
+  errno = 0;
21b0f2
+  buf[len] = 0;
21b0f2
+  uid = strtol(buf, 0, 10);
21b0f2
+
21b0f2
+  if (errno != 0)
21b0f2
+    return -1;
21b0f2
+  else
21b0f2
+    return uid;
21b0f2
+}
45f372
+#endif /* WITH_LSPP */
21b0f2
+
21b0f2
 /*
21b0f2
  * 'pipe_command()' - Pipe the output of a command to the remote client.
21b0f2
  */
2d7496
--- cups-1.2.4-orig/scheduler/client.h	2006-09-11 10:21:23.000000000 -0400
2d7496
+++ cups-1.2.4/scheduler/client.h	2006-09-28 16:31:29.000000000 -0400
45f372
@@ -22,6 +22,13 @@
45f372
  *         WWW: http://www.cups.org
45f372
  */
45f372
 
45f372
+/* Copyright (C) 2005 Trusted Computer Solutions, Inc. */
45f372
+/* (c) Copyright 2005-2006 Hewlett-Packard Development Company, L.P. */
45f372
+
45f372
+#ifdef WITH_LSPP
45f372
+#include <selinux selinux.h="">
45f372
+#endif /* WITH_LSPP */
45f372
+
45f372
 /*
45f372
  * HTTP client structure...
45f372
  */
45f372
@@ -55,6 +62,10 @@
45f372
   http_addr_t		clientaddr;	/* Client address */
45f372
   char			servername[256];/* Server name for connection */
45f372
   int			serverport;	/* Server port for connection */
45f372
+#ifdef WITH_LSPP
45f372
+  security_context_t	scon;		/* Security context of connection */
45f372
+  uid_t			auid;		/* Audit loginuid of the client */
45f372
+#endif /* WITH_LSPP */
45f372
 };
45f372
 
45f372
 #define HTTP(con) &((con)->http)
2d7496
@@ -119,6 +130,9 @@
45f372
 extern void	cupsdStopListening(void);
45f372
 extern void	cupsdUpdateCGI(void);
45f372
 extern int	cupsdWriteClient(cupsd_client_t *con);
45f372
+#ifdef WITH_LSPP
45f372
+extern uid_t	client_pid_to_auid(pid_t clipid);
45f372
+#endif /* WITH_LSPP */
45f372
 
45f372
 
45f372
 /*
2d7496
--- cups-1.2.4-orig/scheduler/conf.c	2006-09-28 11:38:08.000000000 -0400
2d7496
+++ cups-1.2.4/scheduler/conf.c	2006-09-29 18:23:37.000000000 -0400
21b0f2
@@ -35,6 +35,7 @@
21b0f2
  *   read_configuration()     - Read a configuration file.
21b0f2
  *   read_location()          - Read a <location path=""> definition.
21b0f2
  *   read_policy()            - Read a <policy name=""> definition.
21b0f2
+ *   is_lspp_config()         - Is the system configured for LSPP
45f372
  */
45f372
 
45f372
 /*
21b0f2
@@ -60,6 +61,9 @@
21b0f2
 #  define INADDR_NONE	0xffffffff
21b0f2
 #endif /* !INADDR_NONE */
45f372
 
45f372
+#ifdef WITH_LSPP
45f372
+#  include <libaudit.h>
45f372
+#endif /* WITH_LSPP */
45f372
 
45f372
 /*
21b0f2
  * Configuration variable structure...
21b0f2
@@ -161,6 +165,9 @@
21b0f2
   { "ServerKey",		&ServerKey,		CUPSD_VARTYPE_STRING },
21b0f2
 #  endif /* HAVE_LIBSSL || HAVE_GNUTLS */
21b0f2
 #endif /* HAVE_SSL */
21b0f2
+#ifdef WITH_LSPP
21b0f2
+  { "AuditLog",			&AuditLog,		CUPSD_VARTYPE_INTEGER },
21b0f2
+#endif /* WITH_LSPP */
21b0f2
 #ifdef HAVE_LAUNCHD
21b0f2
   { "LaunchdTimeout",		&LaunchdTimeout,	CUPSD_VARTYPE_INTEGER },
21b0f2
   { "LaunchdConf",		&LaunchdConf,		CUPSD_VARTYPE_STRING },
21b0f2
@@ -223,6 +230,9 @@
21b0f2
 		*old_requestroot;	/* Old RequestRoot */
21b0f2
   const char	*tmpdir;		/* TMPDIR environment variable */
21b0f2
   struct stat	tmpinfo;		/* Temporary directory info */
21b0f2
+#ifdef WITH_LSPP
21b0f2
+  char		*audit_message;		/* Audit message string */
21b0f2
+#endif /* WITH_LSPP */
21b0f2
 
21b0f2
 
21b0f2
  /*
2d7496
@@ -470,6 +480,16 @@
ddd55f
 
ddd55f
   RunUser = getuid();
ddd55f
 
45f372
+#ifdef WITH_LSPP
21b0f2
+  /*
21b0f2
+   * ClassifyOverride is set during read_configuration, if its on, report it now
21b0f2
+   */
ddd55f
+  if (ClassifyOverride && AuditLog != -1)
21b0f2
+    audit_log_user_message(AuditLog, AUDIT_USYS_CONFIG,
21b0f2
+              "[Config] ClassifyOverride=enabled Users can override print banners",
21b0f2
+              ServerName, NULL, NULL, 1);
45f372
+#endif /* WITH_LSPP */
45f372
+
45f372
  /*
ddd55f
   * See if the ServerName is an IP address...
45f372
   */
2d7496
@@ -777,11 +797,23 @@
2d7496
   if (MaxActiveJobs > (MaxFDs / 3))
2d7496
     MaxActiveJobs = MaxFDs / 3;
2d7496
 
2d7496
-  if (Classification && !strcasecmp(Classification, "none"))
2d7496
+  if (Classification && strcasecmp(Classification, "none") == 0)
21b0f2
     cupsdClearString(&Classification);
45f372
 
21b0f2
   if (Classification)
21b0f2
+  {
21b0f2
     cupsdLogMessage(CUPSD_LOG_INFO, "Security set to \"%s\"", Classification);
45f372
+#ifdef WITH_LSPP
ddd55f
+    if (AuditLog != -1)
ddd55f
+    {
ddd55f
+      audit_message = NULL;
2d7496
+      cupsdSetStringf(&audit_message, "[Config] Classification=%s", Classification);
ddd55f
+      audit_log_user_message(AuditLog, AUDIT_LABEL_LEVEL_CHANGE, audit_message,
ddd55f
+                             ServerName, NULL, NULL, 1);
ddd55f
+      free(audit_message);
ddd55f
+    }
45f372
+#endif /* WITH_LSPP */
21b0f2
+  }
45f372
 
21b0f2
  /*
21b0f2
   * Update the MaxClientsPerHost value, as needed...
2d7496
@@ -3295,6 +3327,18 @@
21b0f2
   return (0);
21b0f2
 }
45f372
 
45f372
+#ifdef WITH_LSPP
21b0f2
+int is_lspp_config()
21b0f2
+{
21b0f2
+  if (Classification != NULL)
21b0f2
+    return ((strcasecmp(Classification, MLS_CONFIG) == 0) 
21b0f2
+            || (strcasecmp(Classification, TE_CONFIG) == 0)
21b0f2
+            || (strcasecmp(Classification, SELINUX_CONFIG) == 0));
21b0f2
+  else
21b0f2
+    return 0;
21b0f2
+}
45f372
+#endif /* WITH_LSPP */
21b0f2
+
21b0f2
 
21b0f2
 /*
2d7496
  * End of "$Id: conf.c 5905 2006-08-29 20:48:59Z mike $".
2d7496
--- cups-1.2.4-orig/scheduler/conf.h	2006-09-28 11:38:08.000000000 -0400
2d7496
+++ cups-1.2.4/scheduler/conf.h	2006-09-28 16:31:29.000000000 -0400
2d7496
@@ -191,6 +191,10 @@
21b0f2
 					/* Server key file */
21b0f2
 #  endif /* HAVE_LIBSSL || HAVE_GNUTLS */
21b0f2
 #endif /* HAVE_SSL */
21b0f2
+#ifdef WITH_LSPP
21b0f2
+VAR int			AuditLog		VALUE(-1);
21b0f2
+					/* File descriptor for audit */
21b0f2
+#endif /* WITH_LSPP */
21b0f2
 
21b0f2
 #ifdef HAVE_LAUNCHD
21b0f2
 VAR int			LaunchdTimeout		VALUE(DEFAULT_TIMEOUT);
2d7496
@@ -213,6 +217,9 @@
21b0f2
 ;
21b0f2
 extern int	cupsdLogPage(cupsd_job_t *job, const char *page);
45f372
 
21b0f2
+#ifdef WITH_LSPP
21b0f2
+extern int	is_lspp_config(void);
21b0f2
+#endif /* WITH_LSPP */
45f372
 
21b0f2
 /*
21b0f2
  * End of "$Id: conf.h 5696 2006-06-26 18:34:20Z mike $".
2d7496
--- cups-1.2.4-orig/scheduler/ipp.c	2006-09-28 11:38:08.000000000 -0400
276351
+++ cups-1.2.4/scheduler/ipp.c	2006-10-16 15:30:02.000000000 -0400
45f372
@@ -96,6 +96,9 @@
45f372
  *   validate_user()             - Validate the user for the request.
45f372
  */
45f372
 
45f372
+/* Copyright (C) 2005 Trusted Computer Solutions, Inc. */
45f372
+/* (c) Copyright 2005-2006 Hewlett-Packard Development Company, L.P. */
45f372
+
45f372
 /*
45f372
  * Include necessary headers...
45f372
  */
45f372
@@ -106,6 +109,14 @@
45f372
 #  include <paper.h>
45f372
 #endif /* HAVE_LIBPAPER */
45f372
 
45f372
+#ifdef WITH_LSPP
45f372
+#include <libaudit.h>
45f372
+#include <selinux selinux.h="">
45f372
+#include <selinux context.h="">
45f372
+#include <selinux avc.h="">
45f372
+#include <selinux flask.h="">
45f372
+#include <selinux av_permissions.h="">
45f372
+#endif /* WITH_LSPP */
45f372
 
45f372
 /*
45f372
  * PPD default choice structure...
d4dd75
@@ -1173,6 +1184,20 @@
45f372
   int		kbytes;			/* Size of print file */
45f372
   int		i;			/* Looping var */
45f372
   int		lowerpagerange;		/* Page range bound */
45f372
+#ifdef WITH_LSPP
45f372
+  char		*audit_message;		/* Audit message string */
45f372
+  char		*printerfile;		/* device file pointed to by the printer */
ddd55f
+  char		*userheader = NULL;	/* User supplied job-sheets[0] */
ddd55f
+  char		*userfooter = NULL;	/* User supplied job-sheets[1] */
ddd55f
+  int		override = 0;		/* Was a banner overrode on a job */
2d7496
+  security_id_t	clisid;			/* SELinux SID for the client */
2d7496
+  security_id_t	psid;			/* SELinux SID for the printer */
2d7496
+  context_t	printercon;		/* Printer's context string */
2d7496
+  security_context_t	devcon;		/* Printer's SELinux context */
2d7496
+  struct avc_entry_ref	avcref;		/* Pointer to the access vector cache */
2d7496
+  security_class_t	tclass;		/* Object class for the SELinux check */
2d7496
+  access_vector_t	avr;		/* Access method being requested */
45f372
+#endif /* WITH_LSPP */
45f372
 
45f372
 
45f372
   cupsdLogMessage(CUPSD_LOG_DEBUG2, "add_job(%p[%d], %s)", con,
d4dd75
@@ -1349,6 +1374,101 @@
45f372
     return (NULL);
45f372
   }
45f372
 
45f372
+#ifdef WITH_LSPP
45f372
+  if (is_lspp_config())
45f372
+  {
143ac5
+    if (!con->scon || strncmp(con->scon, UNKNOWN_SL, strlen(UNKNOWN_SL)) == 0)
45f372
+    {
45f372
+      cupsdLogMessage(CUPSD_LOG_ERROR, "add_job: missing classification for connection \'%s\'!", dest);
45f372
+      send_ipp_status(con, IPP_INTERNAL_ERROR, _("Missing required secuirty attributes."));
45f372
+      return (NULL);
45f372
+    }
45f372
+    else
45f372
+    {
45f372
+     /*
45f372
+      * duplicate the security context and auid of the connection into the job structure
45f372
+      */
143ac5
+      job->scon = strdup(con->scon);
143ac5
+      job->auid = con->auid;
45f372
+
45f372
+     /* 
45f372
+      * add the security context to the request so that on a restart the security
45f372
+      * attributes will be able to be restored
45f372
+      */
45f372
+      ippAddString(con->request, IPP_TAG_JOB, IPP_TAG_NAME, "security-context", 
45f372
+                   NULL, job->scon);
45f372
+    }
45f372
+
45f372
+   /*
45f372
+    * Perform an access check so that if the user gets feedback at enqueue time
45f372
+    */
45f372
+
ddd55f
+    printerfile = strstr(printer->device_uri, "/dev/");
2d7496
+    if (printerfile == NULL && (strncmp(printer->device_uri, "file:/", 6) == 0))
2d7496
+      printerfile = strdup(printer->device_uri + strlen("file:/"));
2d7496
+
ddd55f
+    if (printerfile != NULL)
45f372
+    {
45f372
+      cupsdLogMessage(CUPSD_LOG_DEBUG, "add_job: Attempting an access check on printer device %s",
45f372
+                      printerfile);
45f372
+
2d7496
+      tclass = SECCLASS_FILE;
276351
+      avr = CHR_FILE__WRITE;
2d7496
+      avc_init("cupsd_enqueue_", NULL, NULL, NULL, NULL);
2d7496
+      avc_entry_ref_init(&avcref);
2d7496
+      if (avc_context_to_sid(con->scon, &clisid) != 0)
45f372
+      {
2d7496
+        send_ipp_status(con, IPP_NOT_AUTHORIZED, _("Unable to get the SELinux sid of the client"));
45f372
+        return (NULL);
45f372
+      }
2d7496
+      if (getfilecon(printerfile, &devcon) == -1)
2d7496
+      {
2d7496
+        send_ipp_status(con, IPP_NOT_AUTHORIZED, _("Unable to get the SELinux context of the printer"));
2d7496
+        return (NULL);
2d7496
+      }
2d7496
+      printercon = context_new(devcon);
2d7496
+      cupsdLogMessage(CUPSD_LOG_DEBUG, "add_job: printer context %s client context %s",
2d7496
+                      context_str(printercon), con->scon);
2d7496
+      context_free(printercon);
45f372
+
2d7496
+      if (avc_context_to_sid(devcon, &psid) != 0)
45f372
+      {
2d7496
+        send_ipp_status(con, IPP_NOT_AUTHORIZED, _("Unable to get the SELinux sid of the printer"));
2d7496
+        freecon(devcon);
2d7496
+        return (NULL);
2d7496
+      }
2d7496
+      freecon(devcon);
d4dd75
+      if (avc_has_perm(clisid, psid, tclass, avr, &avcref, NULL) != 0)
2d7496
+      {
2d7496
+       /*
2d7496
+        * The access check failed, so cancel the job and send an audit message
2d7496
+        */
2d7496
+        if (AuditLog != -1)
45f372
+        {
2d7496
+          audit_message = NULL;
2d7496
+          cupsdSetStringf(&audit_message, "job=%d auid=%u acct=%s obj=%s refused"
2d7496
+                          " unable to access printer=%s", job->id, con->auid,
2d7496
+                          con->username, con->scon, printer->name);
2d7496
+          audit_log_user_message(AuditLog, AUDIT_USER_LABELED_EXPORT, audit_message,
2d7496
+                                 ServerName, NULL, NULL, 0);
2d7496
+          free(audit_message);
45f372
+        }
2d7496
+
2d7496
+        send_ipp_status(con, IPP_NOT_AUTHORIZED, _("SELinux prohibits access to the printer"));
2d7496
+        return (NULL);
45f372
+      }
45f372
+    }
45f372
+  }
143ac5
+  else
143ac5
+  {
143ac5
+   /*
143ac5
+    * Fill in the security context of the job as unlabeled
143ac5
+    */
276351
+    cupsdLogMessage(CUPSD_LOG_DEBUG, "add_job: setting context of job to %s", UNKNOWN_SL);
143ac5
+    cupsdSetString(&job->scon, UNKNOWN_SL);
143ac5
+  }
45f372
+#endif /* WITH_LSPP */
45f372
+
45f372
   job->dtype   = dtype;
45f372
   job->attrs   = con->request;
45f372
   con->request = NULL;
d4dd75
@@ -1544,6 +1664,29 @@
ddd55f
       attr->values[0].string.text = _cupsStrAlloc(printer->job_sheets[0]);
ddd55f
       attr->values[1].string.text = _cupsStrAlloc(printer->job_sheets[1]);
ddd55f
     }
45f372
+#ifdef WITH_LSPP
ddd55f
+    else
ddd55f
+    {
ddd55f
+     /*
ddd55f
+      * The option was present, so capture the user supplied strings
ddd55f
+      */
ddd55f
+      userheader = strdup(attr->values[0].string.text);
ddd55f
+
ddd55f
+      if (attr->num_values > 1)
ddd55f
+        userfooter = strdup(attr->values[1].string.text);
ddd55f
+  
c202f8
+      if (Classification != NULL && (strcmp(userheader, Classification) == 0)
95944e
+          && userfooter &&(strcmp(userfooter, Classification) == 0))
ddd55f
+      {
45f372
+       /*
ddd55f
+        * Since both values are Classification, the user is not trying to Override
45f372
+        */
ddd55f
+        free(userheader);
95944e
+        if (userfooter) free(userfooter);
ddd55f
+        userheader = userfooter = NULL;
ddd55f
+      }
ddd55f
+    }
ddd55f
+#endif /* WITH_LSPP */
ddd55f
 
ddd55f
     job->job_sheets = attr;
ddd55f
 
d4dd75
@@ -1574,6 +1717,9 @@
ddd55f
 	                		    "job-sheets=\"%s,none\", "
ddd55f
 					    "job-originating-user-name=\"%s\"",
ddd55f
 	        	 job->id, Classification, job->username);
ddd55f
+#ifdef WITH_LSPP
ddd55f
+          override = 1;
ddd55f
+#endif /* WITH_LSPP */
ddd55f
 	}
ddd55f
 	else if (attr->num_values == 2 &&
ddd55f
 	         strcmp(attr->values[0].string.text,
d4dd75
@@ -1592,6 +1738,9 @@
ddd55f
 					    "job-originating-user-name=\"%s\"",
ddd55f
 	        	 job->id, attr->values[0].string.text,
ddd55f
 			 attr->values[1].string.text, job->username);
ddd55f
+#ifdef WITH_LSPP
ddd55f
+          override = 1;
ddd55f
+#endif /* WITH_LSPP */
ddd55f
 	}
ddd55f
 	else if (strcmp(attr->values[0].string.text, Classification) &&
ddd55f
 	         strcmp(attr->values[0].string.text, "none") &&
d4dd75
@@ -1612,6 +1761,9 @@
ddd55f
 			    "job-originating-user-name=\"%s\"",
ddd55f
 	        	    job->id, attr->values[0].string.text,
ddd55f
 			    attr->values[1].string.text, job->username);
ddd55f
+#ifdef WITH_LSPP
ddd55f
+          override = 1;
ddd55f
+#endif /* WITH_LSPP */
ddd55f
         }
ddd55f
       }
ddd55f
       else if (strcmp(attr->values[0].string.text, Classification) &&
d4dd75
@@ -1652,7 +1804,50 @@
ddd55f
 	                  "job-sheets=\"%s\", "
ddd55f
 			  "job-originating-user-name=\"%s\"",
ddd55f
 	        	 job->id, Classification, job->username);
ddd55f
+#ifdef WITH_LSPP
ddd55f
+        override = 1;
ddd55f
+#endif /* WITH_LSPP */
d4dd75
+      }
ddd55f
+#ifdef WITH_LSPP
ddd55f
+      if (is_lspp_config() && AuditLog != -1)
ddd55f
+      {
45f372
+        audit_message = NULL;
ddd55f
+
ddd55f
+        if (userheader || userfooter)
ddd55f
+        {
ddd55f
+          if (!override)
ddd55f
+          {
ddd55f
+           /*
ddd55f
+            * The user overrode the banner, so audit it
ddd55f
+            */
2d7496
+            cupsdSetStringf(&audit_message, "job=%d user supplied job-sheets=%s,%s"
2d7496
+                            " using banners=%s,%s", job->id, userheader,
ddd55f
+                            userfooter, attr->values[0].string.text,
ddd55f
+                            (attr->num_values > 1) ? attr->values[1].string.text : "(null)");
ddd55f
+            audit_log_user_message(AuditLog, AUDIT_LABEL_OVERRIDE, audit_message,
ddd55f
+                                   ServerName, NULL, NULL, 1);
ddd55f
+          }
ddd55f
+          else
ddd55f
+          {
ddd55f
+           /*
ddd55f
+            * The user tried to override the banner, audit the failure
ddd55f
+            */
2d7496
+            cupsdSetStringf(&audit_message, "job=%d user supplied job-sheets=%s,%s"
2d7496
+                            " ignored banners=%s,%s", job->id, userheader,
ddd55f
+                            userfooter, attr->values[0].string.text,
ddd55f
+                            (attr->num_values > 1) ? attr->values[1].string.text : "(null)");
ddd55f
+            audit_log_user_message(AuditLog, AUDIT_LABEL_OVERRIDE, audit_message,
ddd55f
+                                   ServerName, NULL, NULL, 0);
d4dd75
       }
ddd55f
+          free(audit_message);
6e297c
+      }
6e297c
+    }
6e297c
+
ddd55f
+      if (userheader)
ddd55f
+        free(userheader);
ddd55f
+      if (userfooter)
ddd55f
+        free(userfooter);
45f372
+#endif /* WITH_LSPP */
6e297c
     }
6e297c
 
ddd55f
    /*
d4dd75
@@ -3504,6 +3699,15 @@
45f372
   char		attrname[255],		/* Name of attribute */
45f372
 		*s;			/* Pointer into name */
45f372
   ipp_attribute_t *attr;		/* Attribute */
45f372
+#ifdef WITH_LSPP
d4dd75
+  const char	*mls_label;		/* SL of print job */
d4dd75
+  char		*jobrange;		/* SELinux sensitivity range */
d4dd75
+  char		*jobclearance;		/* SELinux low end clearance */
2d7496
+  context_t	jobcon;			/* SELinux context of the job */
2d7496
+  context_t	tmpcon;			/* Temp context to set the level */
2d7496
+  security_context_t	spoolcon;	/* Context of the file in the spool */
45f372
+#endif /* WITH_LSPP */
45f372
+
45f372
 
45f372
 
45f372
   cupsdLogMessage(CUPSD_LOG_DEBUG2, "copy_banner(%p[%d], %p[%d], %s)",
d4dd75
@@ -3537,6 +3741,77 @@
2d7496
 
2d7496
   fchmod(cupsFileNumber(out), 0640);
2d7496
   fchown(cupsFileNumber(out), RunUser, Group);
2d7496
+#ifdef WITH_LSPP
143ac5
+  if (strncmp(con->scon, UNKNOWN_SL, strlen(UNKNOWN_SL)) != 0)
2d7496
+  {
143ac5
+    if (getfilecon(filename, &spoolcon) == -1)
143ac5
+    {
143ac5
+      cupsdLogMessage(CUPSD_LOG_ERROR,
143ac5
+                      "copy_banner: Unable to get the context of the banner file %s - %s",
143ac5
+                      filename, strerror(errno));
143ac5
+      job->num_files --;
143ac5
+      return (0);
143ac5
+    }
143ac5
+    tmpcon = context_new(spoolcon);
143ac5
+    jobcon = context_new(con->scon);
143ac5
+    freecon(spoolcon);
6e297c
+    if (!tmpcon || !jobcon)
6e297c
+    {
6e297c
+      if (tmpcon)
6e297c
+        context_free(tmpcon);
6e297c
+      if (jobcon)
6e297c
+        context_free(jobcon);
6e297c
+      cupsdLogMessage(CUPSD_LOG_ERROR,
6e297c
+                      "copy_banner: Unable to get the SELinux contexts");
6e297c
+      job->num_files --;
6e297c
+      return (0);
6e297c
+    }
d4dd75
+    jobrange = strdup(context_range_get(jobcon));
d4dd75
+    if ((jobclearance = strtok(jobrange, "-")) != NULL)
143ac5
+    {
d4dd75
+      if (context_range_set(tmpcon, jobclearance) == -1)
d4dd75
+      {
d4dd75
+        cupsdLogMessage(CUPSD_LOG_ERROR,
d4dd75
+                        "copy_banner: Unable to set the level of the context for file %s - %s",
d4dd75
+                        filename, strerror(errno));
d4dd75
+        free(jobrange);
d4dd75
+        context_free(jobcon);
d4dd75
+        context_free(tmpcon);
d4dd75
+        job->num_files --;
d4dd75
+        return (0);
d4dd75
+      }
d4dd75
+    }
d4dd75
+    else
d4dd75
+    {
d4dd75
+      if (context_range_set(tmpcon, (context_range_get(jobcon))) == -1)
d4dd75
+      {
d4dd75
+        cupsdLogMessage(CUPSD_LOG_ERROR,
d4dd75
+                        "copy_banner: Unable to set the level of the context for file %s - %s",
d4dd75
+                        filename, strerror(errno));
d4dd75
+        free(jobrange);
d4dd75
+        context_free(jobcon);
d4dd75
+        context_free(tmpcon);
d4dd75
+        job->num_files --;
d4dd75
+        return (0);
d4dd75
+      }
143ac5
+    }
d4dd75
+    free(jobrange);
143ac5
+    if (setfilecon(filename, context_str(tmpcon)) == -1)
143ac5
+    {
143ac5
+      cupsdLogMessage(CUPSD_LOG_ERROR,
143ac5
+                      "copy_banner: Unable to set the context of the banner file %s - %s",
143ac5
+                      filename, strerror(errno));
143ac5
+      context_free(jobcon);
143ac5
+      context_free(tmpcon);
143ac5
+      job->num_files --;
143ac5
+      return (0);
143ac5
+    }
143ac5
+    cupsdLogMessage(CUPSD_LOG_DEBUG2, "copy_banner: %s set to %s",
143ac5
+                    filename, context_str(tmpcon));
2d7496
+    context_free(jobcon);
2d7496
+    context_free(tmpcon);
2d7496
+  }
2d7496
+#endif /* WITH_LSPP */
2d7496
 
2d7496
  /*
2d7496
   * Try the localized banner file under the subdirectory...
d4dd75
@@ -3631,6 +3906,24 @@
45f372
       else
45f372
         s = attrname;
45f372
 
45f372
+#ifdef WITH_LSPP
45f372
+      if (strcmp(s, "mls-label") == 0)
45f372
+      {
143ac5
+        if (con->scon != NULL && strncmp(con->scon, UNKNOWN_SL, strlen(UNKNOWN_SL)) != 0)
45f372
+        {
2d7496
+          jobcon = context_new(con->scon);
45f372
+          if (strcasecmp(name, MLS_CONFIG) == 0)
2d7496
+            mls_label = context_range_get(jobcon);
45f372
+          else if (strcasecmp(name, TE_CONFIG) == 0)
2d7496
+            mls_label = context_type_get(jobcon);
45f372
+          else // default to using the whole context string
2d7496
+            mls_label = context_str(jobcon);
45f372
+          cupsFilePuts(out, mls_label);
2d7496
+          context_free(jobcon);
45f372
+        }
45f372
+        continue;
45f372
+      }
45f372
+#endif /* WITH_LSPP */
45f372
       if (!strcmp(s, "printer-name"))
45f372
       {
45f372
         cupsFilePuts(out, job->dest);
d4dd75
@@ -5352,6 +5645,17 @@
45f372
   cupsd_printer_t *printer;		/* Printer */
45f372
   cups_array_t	*list;			/* Which job list... */
45f372
   cups_array_t	*ra;			/* Requested attributes array */
45f372
+#ifdef WITH_LSPP
45f372
+  int			selinuxcheck;	/* perform the SELinux access check? */
2d7496
+  char			filename[1024]; /* Filename of the spool file */
45f372
+  security_id_t		clisid;		/* SELinux SID of the client */
45f372
+  security_id_t		jobsid;		/* SELinux SID of the job */
2d7496
+  security_id_t		filesid;	/* SELinux SID of the spool file */
45f372
+  struct avc_entry_ref	avcref;		/* AVC entry cache pointer */
45f372
+  security_class_t	tclass;		/* SELinux security class */
45f372
+  access_vector_t	avr;		/* SELinux access being queried */
2d7496
+  security_context_t	spoolfilecon;	/* SELinux context of the spool file */
45f372
+#endif /* WITH_LSPP */
45f372
 
45f372
 
45f372
   cupsdLogMessage(CUPSD_LOG_DEBUG2, "get_jobs(%p[%d], %s)", con, con->http.fd,
d4dd75
@@ -5469,6 +5773,45 @@
45f372
 
45f372
   ra = create_requested_array(con->request);
45f372
 
45f372
+#ifdef WITH_LSPP
45f372
+ /*
45f372
+  * Determine outside the loop if we are concerned about SELinux
45f372
+  */
45f372
+  selinuxcheck = is_lspp_config();
45f372
+  if (selinuxcheck)
45f372
+  {
45f372
+    selinuxcheck = security_getenforce();
45f372
+    if (selinuxcheck == -1)
45f372
+    {
45f372
+      cupsdLogMessage(CUPSD_LOG_ERROR, "get_jobs: unable to determine SELinux enforcement");
45f372
+      send_ipp_status(con, IPP_INTERNAL_ERROR, _("Internal SELinux error (getenforce)."));
45f372
+      return;
45f372
+    }
143ac5
+    if (strncmp(con->scon, UNKNOWN_SL, strlen(UNKNOWN_SL)) == 0)
143ac5
+      selinuxcheck = 0;
143ac5
+    else
45f372
+    {
143ac5
+      if (avc_init("cups", NULL, NULL, NULL, NULL) < 0)
143ac5
+      {
143ac5
+        cupsdLogMessage(CUPSD_LOG_ERROR, "get_jobs: unable avc_init");
143ac5
+        send_ipp_status(con, IPP_INTERNAL_ERROR, _("Internal SELinux error (avc_init)."));
143ac5
+        return;
143ac5
+      } 
143ac5
+      if (avc_context_to_sid(con->scon, &clisid) != 0)
143ac5
+      {
143ac5
+        cupsdLogMessage(CUPSD_LOG_ERROR, "get_jobs: unable to convert %s to SELinux sid", con->scon);
143ac5
+        send_ipp_status(con, IPP_INTERNAL_ERROR, _("Internal SELinux error (avc_context_to_sid)."));
143ac5
+        return;
143ac5
+      }
143ac5
+      cupsdLogMessage(CUPSD_LOG_DEBUG, "get_jobs: client context %s", con->scon);
45f372
+
143ac5
+      avr = FILE__READ;
143ac5
+      tclass = SECCLASS_FILE;
143ac5
+    }
45f372
+  }
45f372
+#endif /* WITH_LSPP */
45f372
+
45f372
+
45f372
  /*
45f372
   * OK, build a list of jobs for this printer...
45f372
   */
d4dd75
@@ -5506,6 +5849,42 @@
45f372
     if (count > 0)
45f372
       ippAddSeparator(con->response);
45f372
 
45f372
+#ifdef WITH_LSPP
143ac5
+    if (selinuxcheck && (strncmp(job->scon, UNKNOWN_SL, strlen(UNKNOWN_SL)) != 0))
45f372
+    {
45f372
+      cupsdLogMessage(CUPSD_LOG_DEBUG, "get_jobs: job context %s", job->scon);
45f372
+
45f372
+      avc_context_to_sid(job->scon, &jobsid);
45f372
+      avc_entry_ref_init(&avcref);
45f372
+      
d4dd75
+      if (avc_has_perm(clisid, jobsid, tclass, avr, &avcref, NULL) != 0)
2d7496
+      {
2d7496
+        cupsdLogMessage(CUPSD_LOG_INFO, "get_jobs: SELinux denied access based on the client context");
2d7496
+        snprintf(filename, sizeof(filename), "%s/c%05d", RequestRoot, job->id);
2d7496
+        if (getfilecon(filename, &spoolfilecon) == -1)
2d7496
+        {
2d7496
+          cupsdLogMessage(CUPSD_LOG_ERROR, "get_jobs: Unable to get spoolfile context");
2d7496
+          continue;
2d7496
+        }
2d7496
+        if (avc_context_to_sid(spoolfilecon, &filesid) != 0)
2d7496
+        {
2d7496
+          cupsdLogMessage(CUPSD_LOG_ERROR, "get_jobs: Unable to determine the SELinux sid for the spool file");
2d7496
+          freecon(spoolfilecon);
2d7496
+          continue;
2d7496
+        }
2d7496
+        freecon(spoolfilecon);
d4dd75
+        if (avc_has_perm(clisid, filesid, tclass, avr, &avcref, NULL) != 0)
2d7496
+        {
2d7496
+          cupsdLogMessage(CUPSD_LOG_INFO, "get_jobs: SELinux denied access to the spool file");
2d7496
+          continue;
2d7496
+        }
2d7496
+        cupsdLogMessage(CUPSD_LOG_INFO, "get_jobs: SELinux allowed access to the spool file");
2d7496
+      }
2d7496
+      else
2d7496
+        cupsdLogMessage(CUPSD_LOG_INFO, "get_jobs: SELinux allowed access based on the client");
45f372
+    }
45f372
+#endif /* WITH_LSPP */
45f372
+
45f372
     count ++;
45f372
 
45f372
     cupsdLogMessage(CUPSD_LOG_DEBUG2, "get_jobs: count = %d", count);
d4dd75
@@ -7944,12 +8323,22 @@
45f372
     * See if we need to add the ending sheet...
45f372
     */
45f372
 
45f372
+#ifdef WITH_LSPP
45f372
+    if (printer &&
45f372
+        ( is_lspp_config() ||
45f372
+        !(printer->type & (CUPS_PRINTER_REMOTE | CUPS_PRINTER_IMPLICIT)) ) &&
45f372
+        (attr = ippFindAttribute(job->attrs, "job-sheets",
45f372
+	                         IPP_TAG_ZERO)) != NULL &&
45f372
+        attr->num_values > 1)
45f372
+    {
45f372
+#else /* !WITH_LSPP */
45f372
     if (printer &&
45f372
         !(printer->type & (CUPS_PRINTER_REMOTE | CUPS_PRINTER_IMPLICIT)) &&
45f372
         (attr = ippFindAttribute(job->attrs, "job-sheets",
45f372
 	                         IPP_TAG_ZERO)) != NULL &&
45f372
         attr->num_values > 1)
45f372
     {
45f372
+#endif /* WITH_LSPP */
45f372
      /*
45f372
       * Yes...
45f372
       */
d4dd75
@@ -9201,6 +9590,16 @@
2d7496
 	      int            userlen)	/* I - Length of username */
2d7496
 {
2d7496
   cupsd_printer_t	*printer;	/* Printer for job */
2d7496
+#ifdef WITH_LSPP
2d7496
+  char			filename[1024];	/* Job filename */
2d7496
+  struct avc_entry_ref  avcref;         /* Pointer to the access vector cache */
2d7496
+  security_class_t      tclass;         /* Object class for the SELinux check */
2d7496
+  access_vector_t       avr;            /* Access method being requested */
2d7496
+  security_id_t		jobsid;		/* SELinux sid for the job */
2d7496
+  security_id_t		consid;		/* SELinux sid for the client */
2d7496
+  security_id_t		filesid;	/* SELinux sid for the spool file */
2d7496
+  security_context_t	spoolfilecon;	/* SELinux context of the spool file */
2d7496
+#endif /* WITH_LSPP */
2d7496
 
2d7496
 
2d7496
   cupsdLogMessage(CUPSD_LOG_DEBUG2,
d4dd75
@@ -9222,6 +9621,59 @@
2d7496
 
2d7496
   strlcpy(username, get_username(con), userlen);
2d7496
 
2d7496
+#ifdef WITH_LSPP
2d7496
+  if (is_lspp_config())
2d7496
+  {
2d7496
+    if (!con->scon || !job->scon)
2d7496
+      return 0;
2d7496
+
2d7496
+    tclass = SECCLASS_FILE;
2d7496
+    avr = FILE__READ;
2d7496
+    avc_init("cupsd_validate_user_", NULL, NULL, NULL, NULL);
2d7496
+    avc_entry_ref_init(&avcref);
2d7496
+    if (avc_context_to_sid(job->scon, &jobsid) != 0)
2d7496
+    {
2d7496
+      cupsdLogMessage(CUPSD_LOG_ERROR, "validate_user: Unable to determine the SELinux sid for the job");
2d7496
+      return 0;
2d7496
+    }
2d7496
+    if (avc_context_to_sid(con->scon, &consid) != 0)
2d7496
+    {
2d7496
+      cupsdLogMessage(CUPSD_LOG_ERROR, "validate_user: Unable to determine the SELinux sid for the client");
2d7496
+      return 0;
2d7496
+    }
2d7496
+
d4dd75
+    if (avc_has_perm(consid, jobsid, tclass, avr, &avcref, NULL) != 0)
2d7496
+    {
2d7496
+      cupsdLogMessage(CUPSD_LOG_INFO, "validate_user: SELinux denied access for the user");
2d7496
+     /*
2d7496
+      * The access check failed, check access on the file
2d7496
+      */
2d7496
+      snprintf(filename, sizeof(filename), "%s/c%05d", RequestRoot, job->id);
2d7496
+      if (getfilecon(filename, &spoolfilecon) == -1)
2d7496
+      {
2d7496
+        cupsdLogMessage(CUPSD_LOG_ERROR, "validate_user: Unable to get spoolfile context");
2d7496
+        return 0;
2d7496
+      }
2d7496
+      if (avc_context_to_sid(spoolfilecon, &filesid) != 0)
2d7496
+      {
2d7496
+        cupsdLogMessage(CUPSD_LOG_ERROR, "validate_user: Unable to determine the SELinux sid for the spool file");
2d7496
+        freecon(spoolfilecon);
2d7496
+        return 0;
2d7496
+      }
2d7496
+      freecon(spoolfilecon);
d4dd75
+      if (avc_has_perm(consid, filesid, tclass, avr, &avcref, NULL) != 0)
2d7496
+      {
2d7496
+        cupsdLogMessage(CUPSD_LOG_INFO, "validate_user: SELinux denied access on the spool file");
2d7496
+        return 0;
2d7496
+      }
2d7496
+      else
2d7496
+        cupsdLogMessage(CUPSD_LOG_INFO, "validate_user: SELinux allowed access on the spool file");
2d7496
+    }
2d7496
+    else
2d7496
+      cupsdLogMessage(CUPSD_LOG_INFO, "validate_user: SELinux allowed access based on the client context");
2d7496
+  }
2d7496
+#endif /* WITH_LSPP */
2d7496
+
2d7496
  /*
2d7496
   * Check the username against the owner...
2d7496
   */
2d7496
--- cups-1.2.4-orig/scheduler/job.c	2006-09-28 11:38:08.000000000 -0400
276351
+++ cups-1.2.4/scheduler/job.c	2006-10-16 15:30:02.000000000 -0400
21b0f2
@@ -68,6 +68,9 @@
21b0f2
  *   unload_job()               - Unload a job from memory.
45f372
  */
45f372
 
21b0f2
+/* Copyright (C) 2005 Trusted Computer Solutions, Inc. */
21b0f2
+/* (c) Copyright 2005-2006 Hewlett-Packard Development Company, L.P. */
21b0f2
+
45f372
 /*
21b0f2
  * Include necessary headers...
21b0f2
  */
2d7496
@@ -77,6 +80,14 @@
21b0f2
 #include <cups backend.h="">
21b0f2
 #include <cups dir.h="">
45f372
 
45f372
+#ifdef WITH_LSPP
2d7496
+#include <libaudit.h>
21b0f2
+#include <selinux selinux.h="">
21b0f2
+#include <selinux context.h="">
2d7496
+#include <selinux avc.h="">
2d7496
+#include <selinux flask.h="">
2d7496
+#include <selinux av_permissions.h="">
45f372
+#endif /* WITH_LSPP */
45f372
 
45f372
 /*
21b0f2
  * Local globals...
2d7496
@@ -1032,6 +1043,23 @@
21b0f2
     cupsdSetString(&job->dest, dest);
45f372
   }
45f372
 
45f372
+#ifdef WITH_LSPP
21b0f2
+  if ((attr = ippFindAttribute(job->attrs, "security-context", IPP_TAG_NAME)) != NULL)
21b0f2
+    cupsdSetString(&job->scon, attr->values[0].string.text);
21b0f2
+  else if (is_lspp_config())
21b0f2
+  {
21b0f2
+   /*
21b0f2
+    * There was no security context so delete the job
21b0f2
+    */
21b0f2
+    cupsdLogMessage(CUPSD_LOG_ERROR, "LoadAllJobs: Missing or bad security-context attribute in control file \"%s\"!",
21b0f2
+                    jobfile);
21b0f2
+    ippDelete(job->attrs);
21b0f2
+    job->attrs = NULL;
21b0f2
+    unlink(jobfile);
21b0f2
+    return;
21b0f2
+  }
45f372
+#endif /* WITH_LSPP */
45f372
+
21b0f2
   job->sheets     = ippFindAttribute(job->attrs, "job-media-sheets-completed",
21b0f2
                                      IPP_TAG_INTEGER);
21b0f2
   job->job_sheets = ippFindAttribute(job->attrs, "job-sheets", IPP_TAG_NAME);
d4dd75
@@ -1341,6 +1369,13 @@
2d7496
 {
2d7496
   char		filename[1024];		/* Job control filename */
2d7496
   cups_file_t	*fp;			/* Job file */
2d7496
+#ifdef WITH_LSPP
2d7496
+  security_context_t	spoolcon;	/* context of the job control file */
2d7496
+  context_t		jobcon;		/* contex_t container for job->scon */
d4dd75
+  context_t		tmpcon;		/* Temp context to swap the level */
d4dd75
+  char		*jobclearance;		/* SELinux low end clearance */
d4dd75
+  char		*jobrange;		/* SELinux sensitivity range */
2d7496
+#endif /* WITH_LSPP */
2d7496
 
2d7496
 
2d7496
   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdSaveJob(job=%p(%d)): job->attrs=%p",
d4dd75
@@ -1359,6 +1394,72 @@
2d7496
   fchmod(cupsFileNumber(fp), 0600);
2d7496
   fchown(cupsFileNumber(fp), RunUser, Group);
2d7496
 
2d7496
+#ifdef WITH_LSPP
143ac5
+  if (strncmp(job->scon, UNKNOWN_SL, strlen(UNKNOWN_SL)) != 0)
2d7496
+  {
143ac5
+    if (getfilecon(filename, &spoolcon) == -1)
143ac5
+    {
143ac5
+      cupsdLogMessage(CUPSD_LOG_ERROR,
143ac5
+                      "Unable to get context of job control file \"%s\" - %s.",
143ac5
+                      filename, strerror(errno));
143ac5
+      return;
143ac5
+    }
143ac5
+    jobcon = context_new(job->scon);
143ac5
+    tmpcon = context_new(spoolcon);
143ac5
+    freecon(spoolcon);
6e297c
+    if (!jobcon || !tmpcon)
6e297c
+    {
6e297c
+      if (jobcon)
6e297c
+        context_free(jobcon);
6e297c
+      if (tmpcon)
6e297c
+        context_free(tmpcon);
6e297c
+      cupsdLogMessage(CUPSD_LOG_ERROR, "Unable to get SELinux contexts");
6e297c
+      return;
6e297c
+    }
d4dd75
+    jobrange = strdup(context_range_get(jobcon));
d4dd75
+    if ((jobclearance = strtok(jobrange, "-")) != NULL)
143ac5
+    {
d4dd75
+      if (context_range_set(tmpcon, jobclearance) == -1)
d4dd75
+      {
d4dd75
+        cupsdLogMessage(CUPSD_LOG_ERROR,
d4dd75
+                        "Unable to set the range for job control file \"%s\" - %s.",
d4dd75
+                        filename, strerror(errno));
d4dd75
+        free(jobrange);
d4dd75
+        context_free(tmpcon);
d4dd75
+        context_free(jobcon);
d4dd75
+        return;
d4dd75
+      }
d4dd75
+    }
d4dd75
+    else
d4dd75
+    {
d4dd75
+      if (context_range_set(tmpcon, (context_range_get(jobcon))) == -1)
d4dd75
+      {
d4dd75
+        cupsdLogMessage(CUPSD_LOG_ERROR,
d4dd75
+                        "Unable to set the range for job control file \"%s\" - %s.",
d4dd75
+                        filename, strerror(errno));
d4dd75
+        free(jobrange);
d4dd75
+        context_free(tmpcon);
d4dd75
+        context_free(jobcon);
d4dd75
+        return;
d4dd75
+      }
143ac5
+    }
d4dd75
+    free(jobrange);
143ac5
+    if (setfilecon(filename, context_str(tmpcon)) == -1)
143ac5
+    {
143ac5
+      cupsdLogMessage(CUPSD_LOG_ERROR,
143ac5
+                      "Unable to set context of job control file \"%s\" - %s.",
143ac5
+                      filename, strerror(errno));
143ac5
+      context_free(tmpcon);
143ac5
+      context_free(jobcon);
143ac5
+      return;
143ac5
+    }
143ac5
+    cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdSaveJob(job=%p): new spool file context=%s",
143ac5
+                    job, context_str(tmpcon));
2d7496
+    context_free(tmpcon);
2d7496
+    context_free(jobcon);
2d7496
+  }
2d7496
+#endif /* WITH_LSPP */
2d7496
+
2d7496
   job->attrs->state = IPP_IDLE;
2d7496
 
2d7496
   if (ippWriteIO(fp, (ipp_iocb_t)cupsFileWrite, 1, NULL,
d4dd75
@@ -2487,6 +2588,20 @@
2d7496
 					/* RIP_MAX_CACHE env variable */
21b0f2
   static char		*options = NULL;/* Full list of options */
21b0f2
   static int		optlength = 0;	/* Length of option buffer */
45f372
+#ifdef WITH_LSPP
21b0f2
+  const char		*mls_label = NULL;	/* SL to put in classification env var */
ddd55f
+  char			*label_template = NULL;	/* SL to put in classification env var */
21b0f2
+  char			*audit_message = NULL;	/* Audit message string */
21b0f2
+  char			*printerfile = NULL;	/* Device file pointed to by the printer */
2d7496
+  context_t		jobcon;		/* SELinux context of the job */
2d7496
+  security_id_t		clisid;		/* SELinux SID for the client */
2d7496
+  security_id_t		psid;		/* SELinux SID for the printer */
2d7496
+  context_t		printercon;	/* Printer's context string */
2d7496
+  security_context_t	devcon;		/* Printer's SELinux context */
2d7496
+  struct avc_entry_ref	avcref;		/* Pointer to the access vector cache */
2d7496
+  security_class_t	tclass;		/* Object class for the SELinux check */
2d7496
+  access_vector_t	avr;		/* Access method being requested */
45f372
+#endif /* WITH_LSPP */
45f372
 
45f372
 
21b0f2
   cupsdLogMessage(CUPSD_LOG_DEBUG2, "start_job: id = %d, file = %d/%d",
d4dd75
@@ -2740,6 +2855,77 @@
45f372
 
21b0f2
   cupsdLogMessage(CUPSD_LOG_DEBUG, "banner_page = %d", banner_page);
45f372
 
45f372
+#ifdef WITH_LSPP
21b0f2
+  if (is_lspp_config())
21b0f2
+  {
21b0f2
+   /*
21b0f2
+    * Perform an access check before printing, but only if the printer starts with /dev/
21b0f2
+    */
ddd55f
+    printerfile = strstr(printer->device_uri, "/dev/");
2d7496
+    if (printerfile == NULL && (strncmp(printer->device_uri, "file:/", 6) == 0))
2d7496
+      printerfile = strdup(printer->device_uri + strlen("file:/"));
45f372
+
ddd55f
+    if (printerfile != NULL)
21b0f2
+    {
2d7496
+      cupsdLogMessage(CUPSD_LOG_DEBUG,
2d7496
+                      "StartJob: Attempting to check access on printer device %s", printerfile);
2d7496
+      tclass = SECCLASS_FILE;
276351
+      avr = CHR_FILE__WRITE;
2d7496
+      avc_init("cupsd_dequeue_", NULL, NULL, NULL, NULL);
2d7496
+      avc_entry_ref_init(&avcref);
2d7496
+      if (avc_context_to_sid(job->scon, &clisid) != 0)
21b0f2
+      {
2d7496
+        cupsdLogMessage(CUPSD_LOG_ERROR,
2d7496
+                        "StartJob: Unable to determine the SELinux sid for the job");
6c4093
+        cupsdCancelJob(job, 0, IPP_JOB_ABORTED);
2d7496
+        return ;