diff --git a/.cvsignore b/.cvsignore index d16041a..1231b87 100644 --- a/.cvsignore +++ b/.cvsignore @@ -32,3 +32,4 @@ cups-1.3.4-source.tar.bz2 cups-1.3.5-source.tar.bz2 cups-1.3.6-source.tar.bz2 cups-1.3.7-source.tar.bz2 +cups-1.3.8-source.tar.bz2 diff --git a/cups-CVE-2008-1373.patch b/cups-CVE-2008-1373.patch deleted file mode 100644 index e712bae..0000000 --- a/cups-CVE-2008-1373.patch +++ /dev/null @@ -1,22 +0,0 @@ -diff -up cups-1.3.6/filter/image-gif.c.CVE-2008-1373 cups-1.3.6/filter/image-gif.c ---- cups-1.3.6/filter/image-gif.c.CVE-2008-1373 2008-01-14 22:12:58.000000000 +0000 -+++ cups-1.3.6/filter/image-gif.c 2008-04-01 16:43:22.000000000 +0100 -@@ -38,6 +38,8 @@ - #define GIF_INTERLACE 0x40 - #define GIF_COLORMAP 0x80 - -+#define MAX_LWZ_BITS 12 -+ - typedef cups_ib_t gif_cmap_t[256][4]; - typedef short gif_table_t[4096]; - -@@ -465,6 +467,9 @@ gif_read_image(FILE *fp, /* I - - if (!pixels) - return (-1); - -+ if (code_size > MAX_LWZ_BITS) -+ return (-1); -+ - if (gif_read_lzw(fp, 1, code_size) < 0) - { - free(pixels); diff --git a/cups-CVE-2008-1722.patch b/cups-CVE-2008-1722.patch deleted file mode 100644 index 8db11a0..0000000 --- a/cups-CVE-2008-1722.patch +++ /dev/null @@ -1,71 +0,0 @@ -diff -up cups-1.3.7/filter/image-png.c.CVE-2008-1722 cups-1.3.7/filter/image-png.c ---- cups-1.3.7/filter/image-png.c.CVE-2008-1722 2007-07-11 22:46:42.000000000 +0100 -+++ cups-1.3.7/filter/image-png.c 2008-05-09 11:27:45.000000000 +0100 -@@ -3,7 +3,7 @@ - * - * PNG image routines for the Common UNIX Printing System (CUPS). - * -- * Copyright 2007 by Apple Inc. -+ * Copyright 2007-2008 by Apple Inc. - * Copyright 1993-2007 by Easy Software Products. - * - * These coded instructions, statements, and computer programs are the -@@ -170,16 +170,56 @@ _cupsImageReadPNG( - * Interlaced images must be loaded all at once... - */ - -+ size_t bufsize; /* Size of buffer */ -+ -+ - if (color_type == PNG_COLOR_TYPE_GRAY || - color_type == PNG_COLOR_TYPE_GRAY_ALPHA) -- in = malloc(img->xsize * img->ysize); -+ { -+ bufsize = img->xsize * img->ysize; -+ -+ if ((bufsize / img->ysize) != img->xsize) -+ { -+ fprintf(stderr, "DEBUG: PNG image dimensions (%ux%u) too large!\n", -+ (unsigned)img->xsize, (unsigned)img->ysize); -+ fclose(fp); -+ return (1); -+ } -+ } - else -- in = malloc(img->xsize * img->ysize * 3); -+ { -+ bufsize = img->xsize * img->ysize * 3; -+ -+ if ((bufsize / (img->ysize * 3)) != img->xsize) -+ { -+ fprintf(stderr, "DEBUG: PNG image dimensions (%ux%u) too large!\n", -+ (unsigned)img->xsize, (unsigned)img->ysize); -+ fclose(fp); -+ return (1); -+ } -+ } -+ -+ in = malloc(bufsize); - } - - bpp = cupsImageGetDepth(img); - out = malloc(img->xsize * bpp); - -+ if (!in || !out) -+ { -+ fputs("DEBUG: Unable to allocate memory for PNG image!\n", stderr); -+ -+ if (in) -+ free(in); -+ -+ if (out) -+ free(out); -+ -+ fclose(fp); -+ -+ return (1); -+ } -+ - /* - * Read the image, interlacing as needed... - */ diff --git a/cups-getnameddest.patch b/cups-getnameddest.patch index 571ddb4..3563473 100644 --- a/cups-getnameddest.patch +++ b/cups-getnameddest.patch @@ -1,6 +1,76 @@ -diff -up cups-1.3.7/cups/dest.c.getnameddest cups-1.3.7/cups/dest.c ---- cups-1.3.7/cups/dest.c.getnameddest 2007-07-11 22:46:42.000000000 +0100 -+++ cups-1.3.7/cups/dest.c 2008-06-17 11:00:50.000000000 +0100 +diff -up cups-1.3.8/berkeley/lpr.c.getnameddest cups-1.3.8/berkeley/lpr.c +--- cups-1.3.8/berkeley/lpr.c.getnameddest 2008-07-28 16:28:24.000000000 +0100 ++++ cups-1.3.8/berkeley/lpr.c 2008-07-28 16:28:24.000000000 +0100 +@@ -92,9 +92,7 @@ main(int argc, /* I - Number of comm + int num_copies; /* Number of copies per file */ + int num_files; /* Number of files to print */ + const char *files[1000]; /* Files to print */ +- int num_dests; /* Number of destinations */ +- cups_dest_t *dests, /* Destinations */ +- *dest; /* Selected destination */ ++ cups_dest_t *dest; /* Selected destination */ + int num_options; /* Number of options */ + cups_option_t *options; /* Options */ + int deletefile; /* Delete file after print? */ +@@ -112,8 +110,7 @@ main(int argc, /* I - Number of comm + + deletefile = 0; + printer = NULL; +- num_dests = 0; +- dests = NULL; ++ dest = NULL; + num_options = 0; + options = NULL; + num_files = 0; +@@ -282,10 +279,7 @@ main(int argc, /* I - Number of comm + if ((instance = strrchr(printer, '/')) != NULL) + *instance++ = '\0'; + +- if (num_dests == 0) +- num_dests = cupsGetDests(&dests); +- +- if ((dest = cupsGetDest(printer, instance, num_dests, dests)) != NULL) ++ if ((dest = cupsGetNamedDest(NULL, printer, instance)) != NULL) + { + for (j = 0; j < dest->num_options; j ++) + if (cupsGetOption(dest->options[j].name, num_options, +@@ -385,10 +379,7 @@ main(int argc, /* I - Number of comm + + if (printer == NULL) + { +- if (num_dests == 0) +- num_dests = cupsGetDests(&dests); +- +- if ((dest = cupsGetDest(NULL, NULL, num_dests, dests)) != NULL) ++ if ((dest = cupsGetNamedDest(NULL, NULL, NULL)) != NULL) + { + printer = dest->name; + +@@ -417,7 +408,7 @@ main(int argc, /* I - Number of comm + else + val = "LPDEST"; + +- if (printer && !cupsGetDest(printer, NULL, num_dests, dests)) ++ if (printer && !cupsGetNamedDest(NULL, printer, NULL)) + _cupsLangPrintf(stderr, + _("%s: Error - %s environment variable names " + "non-existent destination \"%s\"!\n"), +diff -up cups-1.3.8/cups/cups.h.getnameddest cups-1.3.8/cups/cups.h +--- cups-1.3.8/cups/cups.h.getnameddest 2008-07-11 23:48:49.000000000 +0100 ++++ cups-1.3.8/cups/cups.h 2008-07-28 16:28:24.000000000 +0100 +@@ -248,6 +248,9 @@ extern void cupsSetDefaultDest(const ch + int num_dests, + cups_dest_t *dests); + ++/**** New in CUPS 1.4 ****/ ++extern cups_dest_t *cupsGetNamedDest(http_t *http, const char *name, ++ const char *instance); + + # ifdef __cplusplus + } +diff -up cups-1.3.8/cups/dest.c.getnameddest cups-1.3.8/cups/dest.c +--- cups-1.3.8/cups/dest.c.getnameddest 2008-07-11 23:48:49.000000000 +0100 ++++ cups-1.3.8/cups/dest.c 2008-07-28 16:28:24.000000000 +0100 @@ -25,6 +25,7 @@ * server. * cupsGetDests2() - Get the list of destinations from the @@ -611,22 +681,20 @@ diff -up cups-1.3.7/cups/dest.c.getnameddest cups-1.3.7/cups/dest.c { dest->num_options = num_options; dest->options = options; -diff -up cups-1.3.7/cups/cups.h.getnameddest cups-1.3.7/cups/cups.h ---- cups-1.3.7/cups/cups.h.getnameddest 2008-02-20 00:32:58.000000000 +0000 -+++ cups-1.3.7/cups/cups.h 2008-06-17 11:05:32.000000000 +0100 -@@ -248,6 +248,9 @@ extern void cupsSetDefaultDest(const ch - int num_dests, - cups_dest_t *dests); - -+/**** New in CUPS 1.4 ****/ -+extern cups_dest_t *cupsGetNamedDest(http_t *http, const char *name, -+ const char *instance); - - # ifdef __cplusplus - } -diff -up cups-1.3.7/cups/Makefile.getnameddest cups-1.3.7/cups/Makefile ---- cups-1.3.7/cups/Makefile.getnameddest 2008-02-20 20:18:33.000000000 +0000 -+++ cups-1.3.7/cups/Makefile 2008-06-17 11:00:50.000000000 +0100 +diff -up cups-1.3.8/cups/libcups.exp.getnameddest cups-1.3.8/cups/libcups.exp +--- cups-1.3.8/cups/libcups.exp.getnameddest 2008-04-09 04:39:40.000000000 +0100 ++++ cups-1.3.8/cups/libcups.exp 2008-07-28 16:28:24.000000000 +0100 +@@ -114,6 +114,7 @@ _cupsGetFd + _cupsGetFile + _cupsGetJobs + _cupsGetJobs2 ++_cupsGetNamedDest + _cupsGetOption + _cupsGetPassword + _cupsGetPPD +diff -up cups-1.3.8/cups/Makefile.getnameddest cups-1.3.8/cups/Makefile +--- cups-1.3.8/cups/Makefile.getnameddest 2008-02-20 20:18:33.000000000 +0000 ++++ cups-1.3.8/cups/Makefile 2008-07-28 16:28:24.000000000 +0100 @@ -263,7 +263,7 @@ libcups.so.2 libcups.sl.2: $(LIBOBJS) # libcups.2.dylib # @@ -636,9 +704,9 @@ diff -up cups-1.3.7/cups/Makefile.getnameddest cups-1.3.7/cups/Makefile echo Linking $@... $(DSO) $(ARCHFLAGS) $(DSOFLAGS) -o $@ \ -install_name $(libdir)/$@ \ -diff -up cups-1.3.7/cups/testcups.c.getnameddest cups-1.3.7/cups/testcups.c ---- cups-1.3.7/cups/testcups.c.getnameddest 2008-01-14 22:12:58.000000000 +0000 -+++ cups-1.3.7/cups/testcups.c 2008-06-17 11:00:50.000000000 +0100 +diff -up cups-1.3.8/cups/testcups.c.getnameddest cups-1.3.8/cups/testcups.c +--- cups-1.3.8/cups/testcups.c.getnameddest 2008-07-11 23:48:49.000000000 +0100 ++++ cups-1.3.8/cups/testcups.c 2008-07-28 16:37:24.000000000 +0100 @@ -16,7 +16,8 @@ * * Contents: @@ -757,7 +825,7 @@ diff -up cups-1.3.7/cups/testcups.c.getnameddest cups-1.3.7/cups/testcups.c /* * cupsGetDest(printer) -@@ -80,20 +162,34 @@ main(int argc, /* I - Number of comm +@@ -79,20 +161,33 @@ main(int argc, /* I - Number of comm puts("PASS"); /* @@ -767,14 +835,15 @@ diff -up cups-1.3.7/cups/testcups.c.getnameddest cups-1.3.7/cups/testcups.c - fputs("cupsGetDest(NULL): ", stdout); + printf("cupsGetNamedDest(NULL, \"%s\", \"%s\"): ", dest->name, -+ dest->instance ? dest->instance : "(null)"); ++ dest->instance ? dest->instance : "(null)"); fflush(stdout); - if ((dest = cupsGetDest(NULL, NULL, num_dests, dests)) == NULL) + if ((named_dest = cupsGetNamedDest(NULL, dest->name, -+ dest->instance)) == NULL || ++ dest->instance)) == NULL || + !dests_equal(dest, named_dest)) { +- puts("FAIL"); + if (named_dest) + { + puts("FAIL (different values)"); @@ -783,9 +852,7 @@ diff -up cups-1.3.7/cups/testcups.c.getnameddest cups-1.3.7/cups/testcups.c + else + puts("FAIL (no destination)"); + -+ - status = 1; -- puts("FAIL"); + return (1); } else puts("PASS"); @@ -796,7 +863,7 @@ diff -up cups-1.3.7/cups/testcups.c.getnameddest cups-1.3.7/cups/testcups.c /* * cupsPrintFile() */ -@@ -171,5 +267,83 @@ main(int argc, /* I - Number of comm +@@ -169,5 +264,83 @@ main(int argc, /* I - Number of comm /* @@ -878,80 +945,11 @@ diff -up cups-1.3.7/cups/testcups.c.getnameddest cups-1.3.7/cups/testcups.c + + +/* - * End of "$Id: cups-getnameddest.patch,v 1.1 2008/06/17 11:17:09 twaugh Exp $". + * End of "$Id: cups-getnameddest.patch,v 1.2 2008/08/03 13:48:28 twaugh Exp $". */ -diff -up cups-1.3.7/cups/libcups.exp.getnameddest cups-1.3.7/cups/libcups.exp ---- cups-1.3.7/cups/libcups.exp.getnameddest 2008-01-22 22:02:46.000000000 +0000 -+++ cups-1.3.7/cups/libcups.exp 2008-06-17 11:00:50.000000000 +0100 -@@ -113,6 +113,7 @@ _cupsGetFd - _cupsGetFile - _cupsGetJobs - _cupsGetJobs2 -+_cupsGetNamedDest - _cupsGetOption - _cupsGetPassword - _cupsGetPPD -diff -up cups-1.3.7/CHANGES.txt.getnameddest cups-1.3.7/CHANGES.txt -diff -up cups-1.3.7/berkeley/lpr.c.getnameddest cups-1.3.7/berkeley/lpr.c ---- cups-1.3.7/berkeley/lpr.c.getnameddest 2008-06-17 11:00:11.000000000 +0100 -+++ cups-1.3.7/berkeley/lpr.c 2008-06-17 11:00:50.000000000 +0100 -@@ -92,9 +92,7 @@ main(int argc, /* I - Number of comm - int num_copies; /* Number of copies per file */ - int num_files; /* Number of files to print */ - const char *files[1000]; /* Files to print */ -- int num_dests; /* Number of destinations */ -- cups_dest_t *dests, /* Destinations */ -- *dest; /* Selected destination */ -+ cups_dest_t *dest; /* Selected destination */ - int num_options; /* Number of options */ - cups_option_t *options; /* Options */ - int deletefile; /* Delete file after print? */ -@@ -112,8 +110,7 @@ main(int argc, /* I - Number of comm - - deletefile = 0; - printer = NULL; -- num_dests = 0; -- dests = NULL; -+ dest = NULL; - num_options = 0; - options = NULL; - num_files = 0; -@@ -282,10 +279,7 @@ main(int argc, /* I - Number of comm - if ((instance = strrchr(printer, '/')) != NULL) - *instance++ = '\0'; - -- if (num_dests == 0) -- num_dests = cupsGetDests(&dests); -- -- if ((dest = cupsGetDest(printer, instance, num_dests, dests)) != NULL) -+ if ((dest = cupsGetNamedDest(NULL, printer, instance)) != NULL) - { - for (j = 0; j < dest->num_options; j ++) - if (cupsGetOption(dest->options[j].name, num_options, -@@ -385,10 +379,7 @@ main(int argc, /* I - Number of comm - - if (printer == NULL) - { -- if (num_dests == 0) -- num_dests = cupsGetDests(&dests); -- -- if ((dest = cupsGetDest(NULL, NULL, num_dests, dests)) != NULL) -+ if ((dest = cupsGetNamedDest(NULL, NULL, NULL)) != NULL) - { - printer = dest->name; - -@@ -417,7 +408,7 @@ main(int argc, /* I - Number of comm - else - val = "LPDEST"; - -- if (printer && !cupsGetDest(printer, NULL, num_dests, dests)) -+ if (printer && !cupsGetNamedDest(NULL, printer, NULL)) - _cupsLangPrintf(stderr, - _("%s: Error - %s environment variable names " - "non-existent destination \"%s\"!\n"), -diff -up cups-1.3.7/systemv/lp.c.getnameddest cups-1.3.7/systemv/lp.c ---- cups-1.3.7/systemv/lp.c.getnameddest 2007-07-11 22:46:42.000000000 +0100 -+++ cups-1.3.7/systemv/lp.c 2008-06-17 11:00:50.000000000 +0100 +diff -up cups-1.3.8/systemv/lp.c.getnameddest cups-1.3.8/systemv/lp.c +--- cups-1.3.8/systemv/lp.c.getnameddest 2008-07-11 23:48:49.000000000 +0100 ++++ cups-1.3.8/systemv/lp.c 2008-07-28 16:28:24.000000000 +0100 @@ -73,9 +73,7 @@ main(int argc, /* I - Number of comm int num_copies; /* Number of copies per file */ int num_files; /* Number of files to print */ diff --git a/cups-lspp.patch b/cups-lspp.patch index 36a1b3b..87ef0be 100644 --- a/cups-lspp.patch +++ b/cups-lspp.patch @@ -1,5 +1,549 @@ ---- cups-1.3.7/cups/cups.h.lspp 2008-02-20 00:32:58.000000000 +0000 -+++ cups-1.3.7/cups/cups.h 2008-05-30 16:59:10.000000000 +0100 +diff -up cups-1.3.8/config.h.in.lspp cups-1.3.8/config.h.in +--- cups-1.3.8/config.h.in.lspp 2008-01-07 18:26:57.000000000 +0000 ++++ cups-1.3.8/config.h.in 2008-07-28 16:37:51.000000000 +0100 +@@ -530,6 +530,13 @@ + #undef HAVE_REMOVEFILE + + ++/* ++ * Are we trying to meet LSPP requirements? ++ */ ++ ++#undef WITH_LSPP ++ ++ + #endif /* !_CUPS_CONFIG_H_ */ + + /* +diff -up /dev/null cups-1.3.8/config-scripts/cups-lspp.m4 +--- /dev/null 2008-07-28 15:45:57.127000670 +0100 ++++ cups-1.3.8/config-scripts/cups-lspp.m4 2008-07-28 16:37:51.000000000 +0100 +@@ -0,0 +1,36 @@ ++dnl ++dnl LSPP code for the Common UNIX Printing System (CUPS). ++dnl ++dnl Copyright 2005-2006 by Hewlett-Packard Development Company, L.P. ++dnl ++dnl This program is free software; you can redistribute it and/or modify ++dnl it under the terms of the GNU General Public License as published by ++dnl the Free Software Foundation; version 2. ++dnl ++dnl This program is distributed in the hope that it will be useful, but ++dnl WITHOUT ANY WARRANTY; without even the implied warranty of ++dnl MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU ++dnl General Public License for more details. ++dnl ++dnl You should have received a copy of the GNU General Public License ++dnl along with this program; if not, write to the Free Software Foundation, ++dnl Inc., 51 Franklin Street, Fifth Floor Boston, MA 02110-1301 USA ++dnl ++ ++dnl Are we trying to meet LSPP requirements ++AC_ARG_ENABLE(lspp, [ --enable-lspp turn on auditing and label support, default=no]) ++ ++if test x"$enable_lspp" != xno; then ++ case "$uname" in ++ Linux) ++ AC_CHECK_LIB(audit,audit_log_user_message, [LIBAUDIT="-laudit" AC_SUBST(LIBAUDIT)]) ++ AC_CHECK_HEADER(libaudit.h) ++ AC_CHECK_LIB(selinux,getpeercon, [LIBSELINUX="-lselinux" AC_SUBST(LIBSELINUX)]) ++ AC_CHECK_HEADER(selinux/selinux.h) ++ AC_DEFINE(WITH_LSPP) ++ ;; ++ *) ++ # All others ++ ;; ++ esac ++fi +diff -up cups-1.3.8/configure.in.lspp cups-1.3.8/configure.in +--- cups-1.3.8/configure.in.lspp 2007-07-25 00:47:12.000000000 +0100 ++++ cups-1.3.8/configure.in 2008-07-28 16:37:51.000000000 +0100 +@@ -42,6 +42,8 @@ sinclude(config-scripts/cups-pap.m4) + sinclude(config-scripts/cups-pdf.m4) + sinclude(config-scripts/cups-scripting.m4) + ++sinclude(config-scripts/cups-lspp.m4) ++ + INSTALL_LANGUAGES="" + UNINSTALL_LANGUAGES="" + LANGFILES="" +diff -up cups-1.3.8/configure.lspp cups-1.3.8/configure +--- cups-1.3.8/configure.lspp 2008-07-28 16:37:51.000000000 +0100 ++++ cups-1.3.8/configure 2008-07-28 16:37:51.000000000 +0100 +@@ -806,6 +806,8 @@ PHP + PHPCONFIG + PHPDIR + PYTHON ++LIBAUDIT ++LIBSELINUX + INSTALL_LANGUAGES + UNINSTALL_LANGUAGES + LIBOBJS +@@ -1429,6 +1431,7 @@ Optional Features: + enable UseNetworkDefault by default, default=auto + --enable-raw-printing enable raw printing by default, default=auto + --enable-pdftops build pdftops filter, default=auto ++ --enable-lspp turn on auditing and label support, default=no + + Optional Packages: + --with-PACKAGE[=ARG] use PACKAGE [ARG=yes] +@@ -9680,10 +9683,10 @@ case "$uname" in + ;; + Linux* | GNU*) + # Linux and GNU Hurd +- MAN1EXT=1.gz +- MAN5EXT=5.gz +- MAN7EXT=7.gz +- MAN8EXT=8.gz ++ MAN1EXT=1 ++ MAN5EXT=5 ++ MAN7EXT=7 ++ MAN8EXT=8 + MAN8DIR=8 + ;; + *) +@@ -18452,6 +18455,412 @@ fi + + + ++ ++# Check whether --enable-lspp was given. ++if test "${enable_lspp+set}" = set; then ++ enableval=$enable_lspp; ++fi ++ ++ ++if test x"$enable_lspp" != xno; then ++ case "$uname" in ++ Linux) ++ { echo "$as_me:$LINENO: checking for audit_log_user_message in -laudit" >&5 ++echo $ECHO_N "checking for audit_log_user_message in -laudit... $ECHO_C" >&6; } ++if test "${ac_cv_lib_audit_audit_log_user_message+set}" = set; then ++ echo $ECHO_N "(cached) $ECHO_C" >&6 ++else ++ ac_check_lib_save_LIBS=$LIBS ++LIBS="-laudit $LIBS" ++cat >conftest.$ac_ext <<_ACEOF ++/* confdefs.h. */ ++_ACEOF ++cat confdefs.h >>conftest.$ac_ext ++cat >>conftest.$ac_ext <<_ACEOF ++/* end confdefs.h. */ ++ ++/* Override any GCC internal prototype to avoid an error. ++ Use char because int might match the return type of a GCC ++ builtin and then its argument prototype would still apply. */ ++#ifdef __cplusplus ++extern "C" ++#endif ++char audit_log_user_message (); ++int ++main () ++{ ++return audit_log_user_message (); ++ ; ++ return 0; ++} ++_ACEOF ++rm -f conftest.$ac_objext conftest$ac_exeext ++if { (ac_try="$ac_link" ++case "(($ac_try" in ++ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; ++ *) ac_try_echo=$ac_try;; ++esac ++eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5 ++ (eval "$ac_link") 2>conftest.er1 ++ ac_status=$? ++ grep -v '^ *+' conftest.er1 >conftest.err ++ rm -f conftest.er1 ++ cat conftest.err >&5 ++ echo "$as_me:$LINENO: \$? = $ac_status" >&5 ++ (exit $ac_status); } && { ++ test -z "$ac_c_werror_flag" || ++ test ! -s conftest.err ++ } && test -s conftest$ac_exeext && ++ $as_test_x conftest$ac_exeext; then ++ ac_cv_lib_audit_audit_log_user_message=yes ++else ++ echo "$as_me: failed program was:" >&5 ++sed 's/^/| /' conftest.$ac_ext >&5 ++ ++ ac_cv_lib_audit_audit_log_user_message=no ++fi ++ ++rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \ ++ conftest$ac_exeext conftest.$ac_ext ++LIBS=$ac_check_lib_save_LIBS ++fi ++{ echo "$as_me:$LINENO: result: $ac_cv_lib_audit_audit_log_user_message" >&5 ++echo "${ECHO_T}$ac_cv_lib_audit_audit_log_user_message" >&6; } ++if test $ac_cv_lib_audit_audit_log_user_message = yes; then ++ LIBAUDIT="-laudit" ++fi ++ ++ if test "${ac_cv_header_libaudit_h+set}" = set; then ++ { echo "$as_me:$LINENO: checking for libaudit.h" >&5 ++echo $ECHO_N "checking for libaudit.h... $ECHO_C" >&6; } ++if test "${ac_cv_header_libaudit_h+set}" = set; then ++ echo $ECHO_N "(cached) $ECHO_C" >&6 ++fi ++{ echo "$as_me:$LINENO: result: $ac_cv_header_libaudit_h" >&5 ++echo "${ECHO_T}$ac_cv_header_libaudit_h" >&6; } ++else ++ # Is the header compilable? ++{ echo "$as_me:$LINENO: checking libaudit.h usability" >&5 ++echo $ECHO_N "checking libaudit.h usability... $ECHO_C" >&6; } ++cat >conftest.$ac_ext <<_ACEOF ++/* confdefs.h. */ ++_ACEOF ++cat confdefs.h >>conftest.$ac_ext ++cat >>conftest.$ac_ext <<_ACEOF ++/* end confdefs.h. */ ++$ac_includes_default ++#include ++_ACEOF ++rm -f conftest.$ac_objext ++if { (ac_try="$ac_compile" ++case "(($ac_try" in ++ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; ++ *) ac_try_echo=$ac_try;; ++esac ++eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5 ++ (eval "$ac_compile") 2>conftest.er1 ++ ac_status=$? ++ grep -v '^ *+' conftest.er1 >conftest.err ++ rm -f conftest.er1 ++ cat conftest.err >&5 ++ echo "$as_me:$LINENO: \$? = $ac_status" >&5 ++ (exit $ac_status); } && { ++ test -z "$ac_c_werror_flag" || ++ test ! -s conftest.err ++ } && test -s conftest.$ac_objext; then ++ ac_header_compiler=yes ++else ++ echo "$as_me: failed program was:" >&5 ++sed 's/^/| /' conftest.$ac_ext >&5 ++ ++ ac_header_compiler=no ++fi ++ ++rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext ++{ echo "$as_me:$LINENO: result: $ac_header_compiler" >&5 ++echo "${ECHO_T}$ac_header_compiler" >&6; } ++ ++# Is the header present? ++{ echo "$as_me:$LINENO: checking libaudit.h presence" >&5 ++echo $ECHO_N "checking libaudit.h presence... $ECHO_C" >&6; } ++cat >conftest.$ac_ext <<_ACEOF ++/* confdefs.h. */ ++_ACEOF ++cat confdefs.h >>conftest.$ac_ext ++cat >>conftest.$ac_ext <<_ACEOF ++/* end confdefs.h. */ ++#include ++_ACEOF ++if { (ac_try="$ac_cpp conftest.$ac_ext" ++case "(($ac_try" in ++ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; ++ *) ac_try_echo=$ac_try;; ++esac ++eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5 ++ (eval "$ac_cpp conftest.$ac_ext") 2>conftest.er1 ++ ac_status=$? ++ grep -v '^ *+' conftest.er1 >conftest.err ++ rm -f conftest.er1 ++ cat conftest.err >&5 ++ echo "$as_me:$LINENO: \$? = $ac_status" >&5 ++ (exit $ac_status); } >/dev/null && { ++ test -z "$ac_c_preproc_warn_flag$ac_c_werror_flag" || ++ test ! -s conftest.err ++ }; then ++ ac_header_preproc=yes ++else ++ echo "$as_me: failed program was:" >&5 ++sed 's/^/| /' conftest.$ac_ext >&5 ++ ++ ac_header_preproc=no ++fi ++ ++rm -f conftest.err conftest.$ac_ext ++{ echo "$as_me:$LINENO: result: $ac_header_preproc" >&5 ++echo "${ECHO_T}$ac_header_preproc" >&6; } ++ ++# So? What about this header? ++case $ac_header_compiler:$ac_header_preproc:$ac_c_preproc_warn_flag in ++ yes:no: ) ++ { echo "$as_me:$LINENO: WARNING: libaudit.h: accepted by the compiler, rejected by the preprocessor!" >&5 ++echo "$as_me: WARNING: libaudit.h: accepted by the compiler, rejected by the preprocessor!" >&2;} ++ { echo "$as_me:$LINENO: WARNING: libaudit.h: proceeding with the compiler's result" >&5 ++echo "$as_me: WARNING: libaudit.h: proceeding with the compiler's result" >&2;} ++ ac_header_preproc=yes ++ ;; ++ no:yes:* ) ++ { echo "$as_me:$LINENO: WARNING: libaudit.h: present but cannot be compiled" >&5 ++echo "$as_me: WARNING: libaudit.h: present but cannot be compiled" >&2;} ++ { echo "$as_me:$LINENO: WARNING: libaudit.h: check for missing prerequisite headers?" >&5 ++echo "$as_me: WARNING: libaudit.h: check for missing prerequisite headers?" >&2;} ++ { echo "$as_me:$LINENO: WARNING: libaudit.h: see the Autoconf documentation" >&5 ++echo "$as_me: WARNING: libaudit.h: see the Autoconf documentation" >&2;} ++ { echo "$as_me:$LINENO: WARNING: libaudit.h: section \"Present But Cannot Be Compiled\"" >&5 ++echo "$as_me: WARNING: libaudit.h: section \"Present But Cannot Be Compiled\"" >&2;} ++ { echo "$as_me:$LINENO: WARNING: libaudit.h: proceeding with the preprocessor's result" >&5 ++echo "$as_me: WARNING: libaudit.h: proceeding with the preprocessor's result" >&2;} ++ { echo "$as_me:$LINENO: WARNING: libaudit.h: in the future, the compiler will take precedence" >&5 ++echo "$as_me: WARNING: libaudit.h: in the future, the compiler will take precedence" >&2;} ++ ++ ;; ++esac ++{ echo "$as_me:$LINENO: checking for libaudit.h" >&5 ++echo $ECHO_N "checking for libaudit.h... $ECHO_C" >&6; } ++if test "${ac_cv_header_libaudit_h+set}" = set; then ++ echo $ECHO_N "(cached) $ECHO_C" >&6 ++else ++ ac_cv_header_libaudit_h=$ac_header_preproc ++fi ++{ echo "$as_me:$LINENO: result: $ac_cv_header_libaudit_h" >&5 ++echo "${ECHO_T}$ac_cv_header_libaudit_h" >&6; } ++ ++fi ++ ++ ++ { echo "$as_me:$LINENO: checking for getpeercon in -lselinux" >&5 ++echo $ECHO_N "checking for getpeercon in -lselinux... $ECHO_C" >&6; } ++if test "${ac_cv_lib_selinux_getpeercon+set}" = set; then ++ echo $ECHO_N "(cached) $ECHO_C" >&6 ++else ++ ac_check_lib_save_LIBS=$LIBS ++LIBS="-lselinux $LIBS" ++cat >conftest.$ac_ext <<_ACEOF ++/* confdefs.h. */ ++_ACEOF ++cat confdefs.h >>conftest.$ac_ext ++cat >>conftest.$ac_ext <<_ACEOF ++/* end confdefs.h. */ ++ ++/* Override any GCC internal prototype to avoid an error. ++ Use char because int might match the return type of a GCC ++ builtin and then its argument prototype would still apply. */ ++#ifdef __cplusplus ++extern "C" ++#endif ++char getpeercon (); ++int ++main () ++{ ++return getpeercon (); ++ ; ++ return 0; ++} ++_ACEOF ++rm -f conftest.$ac_objext conftest$ac_exeext ++if { (ac_try="$ac_link" ++case "(($ac_try" in ++ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; ++ *) ac_try_echo=$ac_try;; ++esac ++eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5 ++ (eval "$ac_link") 2>conftest.er1 ++ ac_status=$? ++ grep -v '^ *+' conftest.er1 >conftest.err ++ rm -f conftest.er1 ++ cat conftest.err >&5 ++ echo "$as_me:$LINENO: \$? = $ac_status" >&5 ++ (exit $ac_status); } && { ++ test -z "$ac_c_werror_flag" || ++ test ! -s conftest.err ++ } && test -s conftest$ac_exeext && ++ $as_test_x conftest$ac_exeext; then ++ ac_cv_lib_selinux_getpeercon=yes ++else ++ echo "$as_me: failed program was:" >&5 ++sed 's/^/| /' conftest.$ac_ext >&5 ++ ++ ac_cv_lib_selinux_getpeercon=no ++fi ++ ++rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \ ++ conftest$ac_exeext conftest.$ac_ext ++LIBS=$ac_check_lib_save_LIBS ++fi ++{ echo "$as_me:$LINENO: result: $ac_cv_lib_selinux_getpeercon" >&5 ++echo "${ECHO_T}$ac_cv_lib_selinux_getpeercon" >&6; } ++if test $ac_cv_lib_selinux_getpeercon = yes; then ++ LIBSELINUX="-lselinux" ++fi ++ ++ if test "${ac_cv_header_selinux_selinux_h+set}" = set; then ++ { echo "$as_me:$LINENO: checking for selinux/selinux.h" >&5 ++echo $ECHO_N "checking for selinux/selinux.h... $ECHO_C" >&6; } ++if test "${ac_cv_header_selinux_selinux_h+set}" = set; then ++ echo $ECHO_N "(cached) $ECHO_C" >&6 ++fi ++{ echo "$as_me:$LINENO: result: $ac_cv_header_selinux_selinux_h" >&5 ++echo "${ECHO_T}$ac_cv_header_selinux_selinux_h" >&6; } ++else ++ # Is the header compilable? ++{ echo "$as_me:$LINENO: checking selinux/selinux.h usability" >&5 ++echo $ECHO_N "checking selinux/selinux.h usability... $ECHO_C" >&6; } ++cat >conftest.$ac_ext <<_ACEOF ++/* confdefs.h. */ ++_ACEOF ++cat confdefs.h >>conftest.$ac_ext ++cat >>conftest.$ac_ext <<_ACEOF ++/* end confdefs.h. */ ++$ac_includes_default ++#include ++_ACEOF ++rm -f conftest.$ac_objext ++if { (ac_try="$ac_compile" ++case "(($ac_try" in ++ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; ++ *) ac_try_echo=$ac_try;; ++esac ++eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5 ++ (eval "$ac_compile") 2>conftest.er1 ++ ac_status=$? ++ grep -v '^ *+' conftest.er1 >conftest.err ++ rm -f conftest.er1 ++ cat conftest.err >&5 ++ echo "$as_me:$LINENO: \$? = $ac_status" >&5 ++ (exit $ac_status); } && { ++ test -z "$ac_c_werror_flag" || ++ test ! -s conftest.err ++ } && test -s conftest.$ac_objext; then ++ ac_header_compiler=yes ++else ++ echo "$as_me: failed program was:" >&5 ++sed 's/^/| /' conftest.$ac_ext >&5 ++ ++ ac_header_compiler=no ++fi ++ ++rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext ++{ echo "$as_me:$LINENO: result: $ac_header_compiler" >&5 ++echo "${ECHO_T}$ac_header_compiler" >&6; } ++ ++# Is the header present? ++{ echo "$as_me:$LINENO: checking selinux/selinux.h presence" >&5 ++echo $ECHO_N "checking selinux/selinux.h presence... $ECHO_C" >&6; } ++cat >conftest.$ac_ext <<_ACEOF ++/* confdefs.h. */ ++_ACEOF ++cat confdefs.h >>conftest.$ac_ext ++cat >>conftest.$ac_ext <<_ACEOF ++/* end confdefs.h. */ ++#include ++_ACEOF ++if { (ac_try="$ac_cpp conftest.$ac_ext" ++case "(($ac_try" in ++ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; ++ *) ac_try_echo=$ac_try;; ++esac ++eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5 ++ (eval "$ac_cpp conftest.$ac_ext") 2>conftest.er1 ++ ac_status=$? ++ grep -v '^ *+' conftest.er1 >conftest.err ++ rm -f conftest.er1 ++ cat conftest.err >&5 ++ echo "$as_me:$LINENO: \$? = $ac_status" >&5 ++ (exit $ac_status); } >/dev/null && { ++ test -z "$ac_c_preproc_warn_flag$ac_c_werror_flag" || ++ test ! -s conftest.err ++ }; then ++ ac_header_preproc=yes ++else ++ echo "$as_me: failed program was:" >&5 ++sed 's/^/| /' conftest.$ac_ext >&5 ++ ++ ac_header_preproc=no ++fi ++ ++rm -f conftest.err conftest.$ac_ext ++{ echo "$as_me:$LINENO: result: $ac_header_preproc" >&5 ++echo "${ECHO_T}$ac_header_preproc" >&6; } ++ ++# So? What about this header? ++case $ac_header_compiler:$ac_header_preproc:$ac_c_preproc_warn_flag in ++ yes:no: ) ++ { echo "$as_me:$LINENO: WARNING: selinux/selinux.h: accepted by the compiler, rejected by the preprocessor!" >&5 ++echo "$as_me: WARNING: selinux/selinux.h: accepted by the compiler, rejected by the preprocessor!" >&2;} ++ { echo "$as_me:$LINENO: WARNING: selinux/selinux.h: proceeding with the compiler's result" >&5 ++echo "$as_me: WARNING: selinux/selinux.h: proceeding with the compiler's result" >&2;} ++ ac_header_preproc=yes ++ ;; ++ no:yes:* ) ++ { echo "$as_me:$LINENO: WARNING: selinux/selinux.h: present but cannot be compiled" >&5 ++echo "$as_me: WARNING: selinux/selinux.h: present but cannot be compiled" >&2;} ++ { echo "$as_me:$LINENO: WARNING: selinux/selinux.h: check for missing prerequisite headers?" >&5 ++echo "$as_me: WARNING: selinux/selinux.h: check for missing prerequisite headers?" >&2;} ++ { echo "$as_me:$LINENO: WARNING: selinux/selinux.h: see the Autoconf documentation" >&5 ++echo "$as_me: WARNING: selinux/selinux.h: see the Autoconf documentation" >&2;} ++ { echo "$as_me:$LINENO: WARNING: selinux/selinux.h: section \"Present But Cannot Be Compiled\"" >&5 ++echo "$as_me: WARNING: selinux/selinux.h: section \"Present But Cannot Be Compiled\"" >&2;} ++ { echo "$as_me:$LINENO: WARNING: selinux/selinux.h: proceeding with the preprocessor's result" >&5 ++echo "$as_me: WARNING: selinux/selinux.h: proceeding with the preprocessor's result" >&2;} ++ { echo "$as_me:$LINENO: WARNING: selinux/selinux.h: in the future, the compiler will take precedence" >&5 ++echo "$as_me: WARNING: selinux/selinux.h: in the future, the compiler will take precedence" >&2;} ++ ++ ;; ++esac ++{ echo "$as_me:$LINENO: checking for selinux/selinux.h" >&5 ++echo $ECHO_N "checking for selinux/selinux.h... $ECHO_C" >&6; } ++if test "${ac_cv_header_selinux_selinux_h+set}" = set; then ++ echo $ECHO_N "(cached) $ECHO_C" >&6 ++else ++ ac_cv_header_selinux_selinux_h=$ac_header_preproc ++fi ++{ echo "$as_me:$LINENO: result: $ac_cv_header_selinux_selinux_h" >&5 ++echo "${ECHO_T}$ac_cv_header_selinux_selinux_h" >&6; } ++ ++fi ++ ++ ++ cat >>confdefs.h <<\_ACEOF ++#define WITH_LSPP 1 ++_ACEOF ++ ++ ;; ++ *) ++ # All others ++ ;; ++ esac ++fi ++ ++ + INSTALL_LANGUAGES="" + UNINSTALL_LANGUAGES="" + LANGFILES="" +@@ -19345,8 +19754,8 @@ PHP!$PHP$ac_delim + PHPCONFIG!$PHPCONFIG$ac_delim + PHPDIR!$PHPDIR$ac_delim + PYTHON!$PYTHON$ac_delim +-INSTALL_LANGUAGES!$INSTALL_LANGUAGES$ac_delim +-UNINSTALL_LANGUAGES!$UNINSTALL_LANGUAGES$ac_delim ++LIBAUDIT!$LIBAUDIT$ac_delim ++LIBSELINUX!$LIBSELINUX$ac_delim + _ACEOF + + if test `sed -n "s/.*$ac_delim\$/X/p" conf$$subs.sed | grep -c X` = 97; then +@@ -19388,11 +19797,13 @@ _ACEOF + ac_delim='%!_!# ' + for ac_last_try in false false false false false :; do + cat >conf$$subs.sed <<_ACEOF ++INSTALL_LANGUAGES!$INSTALL_LANGUAGES$ac_delim ++UNINSTALL_LANGUAGES!$UNINSTALL_LANGUAGES$ac_delim + LIBOBJS!$LIBOBJS$ac_delim + LTLIBOBJS!$LTLIBOBJS$ac_delim + _ACEOF + +- if test `sed -n "s/.*$ac_delim\$/X/p" conf$$subs.sed | grep -c X` = 2; then ++ if test `sed -n "s/.*$ac_delim\$/X/p" conf$$subs.sed | grep -c X` = 4; then + break + elif $ac_last_try; then + { { echo "$as_me:$LINENO: error: could not make $CONFIG_STATUS" >&5 +diff -up cups-1.3.8/cups/cups.h.lspp cups-1.3.8/cups/cups.h +--- cups-1.3.8/cups/cups.h.lspp 2008-07-28 16:37:51.000000000 +0100 ++++ cups-1.3.8/cups/cups.h 2008-07-28 16:37:51.000000000 +0100 @@ -15,6 +15,9 @@ * This file is subject to the Apple OS-Developed Software exception. */ @@ -23,1789 +567,554 @@ /* * Types and structures... */ ---- cups-1.3.7/scheduler/job.c.lspp 2008-05-30 16:59:10.000000000 +0100 -+++ cups-1.3.7/scheduler/job.c 2008-05-30 17:01:23.000000000 +0100 -@@ -60,6 +60,9 @@ - * update_job_attrs() - Update the job-printer-* attributes. - */ +diff -up cups-1.3.8/data/Makefile.lspp cups-1.3.8/data/Makefile +--- cups-1.3.8/data/Makefile.lspp 2007-10-10 23:00:43.000000000 +0100 ++++ cups-1.3.8/data/Makefile 2008-07-28 16:37:51.000000000 +0100 +@@ -25,7 +25,10 @@ BANNERS = \ + secret \ + standard \ + topsecret \ +- unclassified ++ unclassified \ ++ selinux \ ++ mls \ ++ te -+/* Copyright (C) 2005 Trusted Computer Solutions, Inc. */ -+/* (c) Copyright 2005-2006 Hewlett-Packard Development Company, L.P. */ + CHARMAPS = \ + euc-cn.txt \ +diff -up /dev/null cups-1.3.8/data/mls +--- /dev/null 2008-07-28 15:45:57.127000670 +0100 ++++ cups-1.3.8/data/mls 2008-07-28 16:37:51.000000000 +0100 +@@ -0,0 +1,261 @@ ++%!PS-Adobe-3.0 ++%%BoundingBox: 0 0 612 792 ++%%Pages: 1 ++%%LanguageLevel: 1 ++%%DocumentData: Clean7Bit ++%%DocumentSuppliedResources: procset bannerprint/1.0 ++%%DocumentNeededResources: font Helvetica Helvetica-Bold Times-Roman ++%%Creator: Michael Sweet, Easy Software Products ++%%CreationDate: May 10, 2000 ++%%Title: Test Page ++%%EndComments ++%%BeginProlog ++%%BeginResource procset bannerprint 1.1 0 ++% ++% PostScript banner page for the Common UNIX Printing System ("CUPS"). ++% ++% Copyright 1993-2005 by Easy Software Products ++% ++% These coded instructions, statements, and computer programs are the ++% property of Easy Software Products and are protected by Federal ++% copyright law. Distribution and use rights are outlined in the file ++% "LICENSE.txt" which should have been included with this file. If this ++% file is missing or damaged please contact Easy Software Products ++% at: ++% ++% Attn: CUPS Licensing Information ++% Easy Software Products ++% 44141 Airport View Drive, Suite 204 ++% Hollywood, Maryland 20636 USA ++% ++% Voice: (301) 373-9600 ++% EMail: cups-info@cups.org ++% WWW: http://www.cups.org ++% ++/CENTER { % Draw centered text ++ % (name) CENTER - ++ dup stringwidth pop % Get the width of the string ++ 0.5 mul neg 0 rmoveto % Shift left 1/2 of the distance ++ show % Show the string ++} bind def ++/RIGHT { % Draw right-justified text ++ % (name) RIGHT - ++ dup stringwidth pop % Get the width of the string ++ neg 0 rmoveto % Shift left the entire distance ++ show % Show the string ++} bind def ++/NUMBER { % Draw a number ++ % power n NUMBER - ++ 1 index 1 eq { % power == 1? ++ round cvi exch pop % Convert "n" to integer ++ } { ++ 1 index mul round exch div % Truncate extra decimal places ++ } ifelse ++ 100 string cvs show % Convert to a string and show it... ++} bind def ++/CUPSLOGO { % Draw the CUPS logo ++ % height CUPSLOGO ++ % Start with a big C... ++ /Helvetica findfont 1 index scalefont setfont ++ 0 setgray ++ 0 0 moveto ++ (C) show + - /* - * Include necessary headers... - */ -@@ -69,6 +72,14 @@ - #include - #include - -+#ifdef WITH_LSPP -+#include -+#include -+#include -+#include -+#include -+#include -+#endif /* WITH_LSPP */ - - /* - * Local globals... -@@ -1100,6 +1111,23 @@ cupsdLoadJob(cupsd_job_t *job) /* I - J - return; - } - -+#ifdef WITH_LSPP -+ if ((attr = ippFindAttribute(job->attrs, "security-context", IPP_TAG_NAME)) != NULL) -+ cupsdSetString(&job->scon, attr->values[0].string.text); -+ else if (is_lspp_config()) -+ { -+ /* -+ * There was no security context so delete the job -+ */ -+ cupsdLogMessage(CUPSD_LOG_ERROR, "LoadAllJobs: Missing or bad security-context attribute in control file \"%s\"!", -+ jobfile); -+ ippDelete(job->attrs); -+ job->attrs = NULL; -+ unlink(jobfile); -+ return; -+ } -+#endif /* WITH_LSPP */ ++ % Then "UNIX Printing System" much smaller... ++ /Helvetica-Bold findfont 1 index 9 div scalefont setfont ++ 0.25 mul ++ dup dup 2.0 mul moveto ++ (UNIX) show ++ dup dup 1.6 mul moveto ++ (Printing) show ++ dup 1.2 mul moveto ++ (System) show ++} bind def ++/ESPLOGO { % Draw the ESP logo ++ % height ESPLOGO ++ % Compute the size of the logo... ++ 0 0 ++ 2 index 1.5 mul 3 index + - job->sheets = ippFindAttribute(job->attrs, "job-media-sheets-completed", - IPP_TAG_INTEGER); - job->job_sheets = ippFindAttribute(job->attrs, "job-sheets", IPP_TAG_NAME); -@@ -1453,6 +1481,13 @@ cupsdSaveJob(cupsd_job_t *job) /* I - J - { - char filename[1024]; /* Job control filename */ - cups_file_t *fp; /* Job file */ -+#ifdef WITH_LSPP -+ security_context_t spoolcon; /* context of the job control file */ -+ context_t jobcon; /* contex_t container for job->scon */ -+ context_t tmpcon; /* Temp context to swap the level */ -+ char *jobclearance; /* SELinux low end clearance */ -+ char *jobrange; /* SELinux sensitivity range */ -+#endif /* WITH_LSPP */ - - - cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdSaveJob(job=%p(%d)): job->attrs=%p", -@@ -1471,6 +1506,76 @@ cupsdSaveJob(cupsd_job_t *job) /* I - J - fchmod(cupsFileNumber(fp), 0600); - fchown(cupsFileNumber(fp), RunUser, Group); - -+#ifdef WITH_LSPP -+ if (job->scon && strncmp(job->scon, UNKNOWN_SL, strlen(UNKNOWN_SL)) != 0) -+ { -+ if (getfilecon(filename, &spoolcon) == -1) -+ { -+ cupsdLogMessage(CUPSD_LOG_ERROR, -+ "Unable to get context of job control file \"%s\" - %s.", -+ filename, strerror(errno)); -+ return; -+ } -+ jobcon = context_new(job->scon); -+ tmpcon = context_new(spoolcon); -+ freecon(spoolcon); -+ if (!jobcon || !tmpcon) -+ { -+ if (jobcon) -+ context_free(jobcon); -+ if (tmpcon) -+ context_free(tmpcon); -+ cupsdLogMessage(CUPSD_LOG_ERROR, "Unable to get SELinux contexts"); -+ return; -+ } -+ jobrange = context_range_get(jobcon); -+ if (jobrange) -+ { -+ jobrange = strdup(jobrange); -+ if ((jobclearance = strtok(jobrange, "-")) != NULL) -+ { -+ if (context_range_set(tmpcon, jobclearance) == -1) -+ { -+ cupsdLogMessage(CUPSD_LOG_ERROR, -+ "Unable to set the range for job control file \"%s\" - %s.", -+ filename, strerror(errno)); -+ free(jobrange); -+ context_free(tmpcon); -+ context_free(jobcon); -+ return; -+ } -+ } -+ else -+ { -+ if (context_range_set(tmpcon, (context_range_get(jobcon))) == -1) -+ { -+ cupsdLogMessage(CUPSD_LOG_ERROR, -+ "Unable to set the range for job control file \"%s\" - %s.", -+ filename, strerror(errno)); -+ free(jobrange); -+ context_free(tmpcon); -+ context_free(jobcon); -+ return; -+ } -+ } -+ free(jobrange); -+ } -+ if (setfilecon(filename, context_str(tmpcon)) == -1) -+ { -+ cupsdLogMessage(CUPSD_LOG_ERROR, -+ "Unable to set context of job control file \"%s\" - %s.", -+ filename, strerror(errno)); -+ context_free(tmpcon); -+ context_free(jobcon); -+ return; -+ } -+ cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdSaveJob(job=%p): new spool file context=%s", -+ job, context_str(tmpcon)); -+ context_free(tmpcon); -+ context_free(jobcon); -+ } -+#endif /* WITH_LSPP */ ++ % Do the "metallic" fill from 10% black to 40% black... ++ 1 -0.001 0 { ++ dup % loopval ++ -0.15 mul % loopval * -0.15 ++ 0.9 add % 0.9 - loopval * 0.15 ++ setgray % set gray shade + - job->attrs->state = IPP_IDLE; - - if (ippWriteIO(fp, (ipp_iocb_t)cupsFileWrite, 1, NULL, -@@ -2484,6 +2589,21 @@ start_job(cupsd_job_t *job, /* I - - /* RIP_MAX_CACHE env variable */ - static char *options = NULL;/* Full list of options */ - static int optlength = 0; /* Length of option buffer */ -+#ifdef WITH_LSPP -+ const char *mls_label = NULL; /* SL to put in classification env var */ -+ char *label_template = NULL; /* SL to put in classification env var */ -+ char *audit_message = NULL; /* Audit message string */ -+ char *printerfile = NULL; /* Device file pointed to by the printer */ -+ context_t jobcon; /* SELinux context of the job */ -+ security_id_t clisid; /* SELinux SID for the client */ -+ security_id_t psid; /* SELinux SID for the printer */ -+ context_t printercon; /* Printer's context string */ -+ struct stat printerstat; /* Printer's stat buffer */ -+ security_context_t devcon; /* Printer's SELinux context */ -+ struct avc_entry_ref avcref; /* Pointer to the access vector cache */ -+ security_class_t tclass; /* Object class for the SELinux check */ -+ access_vector_t avr; /* Access method being requested */ -+#endif /* WITH_LSPP */ - - - cupsdLogMessage(CUPSD_LOG_DEBUG2, "[Job %d] start_job: file = %d/%d", -@@ -2739,6 +2859,106 @@ start_job(cupsd_job_t *job, /* I - - fcntl(job->side_pipes[1], F_GETFL) | O_NONBLOCK); - } - -+#ifdef WITH_LSPP -+ if (is_lspp_config()) -+ { -+ /* -+ * Perform an access check before printing, but only if the printer starts with /dev/ -+ */ -+ printerfile = strstr(printer->device_uri, "/dev/"); -+ if (printerfile == NULL && (strncmp(printer->device_uri, "file:/", 6) == 0)) -+ printerfile = strdup(printer->device_uri + strlen("file:/")); ++ 0 % x ++ 1 index neg % loopval ++ 1 add % 1 - loopval ++ 3 index % height ++ mul % height * (1 - loopval) ++ moveto % starting point + -+ if (printerfile != NULL) -+ { -+ cupsdLogMessage(CUPSD_LOG_DEBUG, -+ "StartJob: Attempting to check access on printer device %s", printerfile); -+ if (lstat(printerfile, &printerstat) < 0) -+ { -+ if (errno != ENOENT) -+ { -+ cupsdLogMessage(CUPSD_LOG_ERROR, "StartJob: Unable to stat the printer"); -+ cupsdCancelJob(job, 0, IPP_JOB_ABORTED); -+ return ; -+ } -+ /* -+ * The printer does not exist, so for now assume it's a FileDevice -+ */ -+ tclass = SECCLASS_FILE; -+ avr = FILE__WRITE; -+ } -+ else if (S_ISCHR(printerstat.st_mode)) -+ { -+ tclass = SECCLASS_CHR_FILE; -+ avr = CHR_FILE__WRITE; -+ } -+ else if (S_ISREG(printerstat.st_mode)) -+ { -+ tclass = SECCLASS_FILE; -+ avr = FILE__WRITE; -+ } -+ else -+ { -+ cupsdLogMessage(CUPSD_LOG_ERROR, -+ "StartJob: Printer is not a character device or regular file"); -+ cupsdCancelJob(job, 0, IPP_JOB_ABORTED); -+ return ; -+ } -+ avc_init("cupsd_dequeue_", NULL, NULL, NULL, NULL); -+ avc_entry_ref_init(&avcref); -+ if (avc_context_to_sid(job->scon, &clisid) != 0) -+ { -+ cupsdLogMessage(CUPSD_LOG_ERROR, -+ "StartJob: Unable to determine the SELinux sid for the job"); -+ cupsdCancelJob(job, 0, IPP_JOB_ABORTED); -+ return ; -+ } -+ if (getfilecon(printerfile, &devcon) == -1) -+ { -+ cupsdLogMessage(CUPSD_LOG_ERROR, "StartJob: Unable to get the SELinux context of %s", -+ printerfile); -+ cupsdCancelJob(job, 0, IPP_JOB_ABORTED); -+ return ; -+ } -+ printercon = context_new(devcon); -+ cupsdLogMessage(CUPSD_LOG_DEBUG, "StartJob: printer context %s client context %s", -+ context_str(printercon), job->scon); -+ context_free(printercon); ++ dup % loopval ++ 3 index % width ++ mul % loopval * width ++ 2 index % height ++ lineto % Next point + -+ if (avc_context_to_sid(devcon, &psid) != 0) -+ { -+ cupsdLogMessage(CUPSD_LOG_ERROR, -+ "StartJob: Unable to determine the SELinux sid for the printer"); -+ freecon(devcon); -+ cupsdCancelJob(job, 0, IPP_JOB_ABORTED); -+ return ; -+ } -+ freecon(devcon); ++ 0 % x ++ 2 index % height ++ lineto % Next point + -+ if (avc_has_perm(clisid, psid, tclass, avr, &avcref, NULL) != 0) -+ { -+ /* -+ * The access check failed, so cancel the job and send an audit message -+ */ -+ if (AuditLog != -1) -+ { -+ audit_message = NULL; -+ cupsdSetStringf(&audit_message, "job=%d auid=%u acct=%s obj=%s canceled" -+ " unable to access printer=%s", job->id, -+ job->auid, (job->username)?job->username:"?", job->scon, printer->name); -+ audit_log_user_message(AuditLog, AUDIT_USER_LABELED_EXPORT, audit_message, -+ ServerName, NULL, NULL, 0); -+ cupsdClearString(&audit_message); -+ } ++ closepath ++ fill + -+ cupsdCancelJob(job, 0, IPP_JOB_ABORTED); ++ dup % loopval ++ 0.15 mul % loopval * 0.15 ++ 0.6 add % 0.6 + loopval * 0.15 ++ setgray + -+ return ; -+ } -+ } -+ } -+#endif /* WITH_LSPP */ ++ dup % loopval ++ neg 1 add % 1 - loopval ++ 3 index % width ++ mul % (1 - loopval) * width ++ 0 % y ++ moveto % Starting point + - /* - * Determine if we are printing a banner page or not... - */ -@@ -2883,6 +3103,18 @@ start_job(cupsd_job_t *job, /* I - - banner_page) - continue; - -+#ifdef WITH_LSPP -+ /* -+ * In LSPP mode refuse to honor the page-label -+ */ -+ if (is_lspp_config() && -+ !strcmp(attr->name, "page-label")) -+ { -+ cupsdLogMessage(CUPSD_LOG_DEBUG, "Ignoring page-label option due to LSPP mode"); -+ continue; -+ } -+#endif /* WITH_LSPP */ ++ 2 index % width ++ exch % loopval ++ 2 index % height ++ mul % loopval * height ++ lineto % Next point + - /* - * Otherwise add them to the list... - */ -@@ -3125,6 +3357,67 @@ start_job(cupsd_job_t *job, /* I - - } - } - -+#ifdef WITH_LSPP -+ if (is_lspp_config()) -+ { -+ if (!job->scon || strncmp(job->scon, UNKNOWN_SL, strlen(UNKNOWN_SL)) == 0) -+ { -+ if (AuditLog != -1) -+ { -+ audit_message = NULL; -+ cupsdSetStringf(&audit_message, "job=%d auid=%u acct=%s printer=%s title=%s", -+ job->id, job->auid, job->username, printer->name, title); -+ audit_log_user_message(AuditLog, AUDIT_USER_UNLABELED_EXPORT, audit_message, -+ ServerName, NULL, NULL, 1); -+ cupsdClearString(&audit_message); -+ } -+ } -+ else -+ { -+ jobcon = context_new(job->scon); ++ 1 index % width ++ 0 % y ++ lineto % Next point + -+ if ((attr = ippFindAttribute(job->attrs, "job-sheets", IPP_TAG_NAME)) == NULL) -+ label_template = strdup(Classification); -+ else if (attr->num_values > 1 && -+ strcmp(attr->values[1].string.text, "none") != 0) -+ label_template = strdup(attr->values[1].string.text); -+ else -+ label_template = strdup(attr->values[0].string.text); ++ closepath ++ fill ++ } for + -+ if (strcasecmp(label_template, MLS_CONFIG) == 0) -+ mls_label = context_range_get(jobcon); -+ else if (strcasecmp(label_template, TE_CONFIG) == 0) -+ mls_label = context_type_get(jobcon); -+ else if (strcasecmp(label_template, SELINUX_CONFIG) == 0) -+ mls_label = context_str(jobcon); -+ else -+ mls_label = label_template; ++ 0 setgray rectstroke + -+ if (mls_label && (PerPageLabels || banner_page)) -+ { -+ snprintf(classification, sizeof(classification), "CLASSIFICATION=LSPP:%s", mls_label); -+ envp[envc ++] = classification; -+ } ++ /Helvetica-BoldOblique findfont 1 index 3 div scalefont setfont ++ dup 40 div + -+ if ((AuditLog != -1) && !banner_page) -+ { -+ audit_message = NULL; -+ cupsdSetStringf(&audit_message, "job=%d auid=%u acct=%s printer=%s title=%s" -+ " obj=%s label=%s", job->id, job->auid, job->username, -+ printer->name, title, job->scon, mls_label?mls_label:"none"); -+ audit_log_user_message(AuditLog, AUDIT_USER_LABELED_EXPORT, audit_message, -+ ServerName, NULL, NULL, 1); -+ cupsdClearString(&audit_message); -+ } -+ context_free(jobcon); -+ free(label_template); -+ } -+ } -+ else -+ /* -+ * Fall through to the non-LSPP behavior -+ */ -+#endif /* WITH_LSPP */ - if (Classification && !banner_page) - { - if ((attr = ippFindAttribute(job->attrs, "job-sheets", ---- cups-1.3.7/scheduler/printers.c.lspp 2008-05-30 16:59:10.000000000 +0100 -+++ cups-1.3.7/scheduler/printers.c 2008-05-30 16:59:10.000000000 +0100 -@@ -51,6 +51,8 @@ - * printing desktop tools. - */ - -+/* (c) Copyright 2005-2006 Hewlett-Packard Development Company, L.P. */ ++ dup 4 mul 1 index 25 mul moveto (E) show ++ dup 10 mul 1 index 15 mul moveto (S) show ++ dup 16 mul 1 index 5 mul moveto (P) show + - /* - * Include necessary headers... - */ -@@ -74,6 +76,10 @@ static void write_irix_config(cupsd_prin - static void write_irix_state(cupsd_printer_t *p); - #endif /* __sgi */ - -+#ifdef WITH_LSPP -+# include -+# include -+#endif /* WITH_LSPP */ - - /* - * 'cupsdAddPrinter()' - Add a printer to the system. -@@ -1817,6 +1823,13 @@ cupsdSetPrinterAttrs(cupsd_printer_t *p) - { /* No authentication */ - "none" - }; -+#ifdef WITH_LSPP -+ char *audit_message; /* Audit message string */ -+ char *printerfile; /* Path to a local printer dev */ -+ char *rangestr; /* Printer's range if its available */ -+ security_context_t devcon; /* Printer SELinux context */ -+ context_t printercon; /* context_t for the printer */ -+#endif /* WITH_LSPP */ - - - DEBUG_printf(("cupsdSetPrinterAttrs: entering name = %s, type = %x\n", p->name, -@@ -1960,6 +1973,44 @@ cupsdSetPrinterAttrs(cupsd_printer_t *p) - attr->values[1].string.text = _cupsStrAlloc(Classification ? - Classification : p->job_sheets[1]); - } -+#ifdef WITH_LSPP -+ if (AuditLog != -1) -+ { -+ char uri[HTTP_MAX_URI]; -+ audit_message = NULL; -+ rangestr = NULL; -+ printercon = 0; -+ printerfile = strstr(p->device_uri, "/dev/"); -+ if (printerfile == NULL && (strncmp(p->device_uri, "file:/", 6) == 0)) -+ printerfile = strdup(p->device_uri + strlen("file:/")); ++ /Helvetica-BoldOblique findfont 2 index 5 div scalefont setfont ++ dup 14 mul 1 index 29 mul moveto (asy) show ++ dup 20 mul 1 index 19 mul moveto (oftware) show ++ dup 26 mul 1 index 9 mul moveto (roducts) show + -+ if (printerfile != NULL) -+ { -+ if (getfilecon(printerfile, &devcon) == -1) -+ cupsdLogMessage(CUPSD_LOG_ERROR, "cupsdSetPrinterAttrs: Unable to get printer context"); -+ else -+ { -+ printercon = context_new(devcon); -+ freecon(devcon); -+ } -+ } ++ pop ++} bind def ++%%EndResource ++%%EndProlog ++%%Page: 1 1 ++gsave + -+ if (printercon && context_range_get(printercon)) -+ rangestr = strdup(context_range_get(printercon)); -+ else -+ rangestr = strdup("unknown"); ++ % Determine the imageable area and device resolution... ++ initclip newpath clippath pathbbox % Get bounding rectangle ++ 72 div /pageTop exch def % Get top margin in inches ++ 72 div /pageRight exch def % Get right margin in inches ++ 72 div /pageBottom exch def % Get bottom margin in inches ++ 72 div /pageLeft exch def % Get left margin in inches + -+ cupsdSanitizeURI(p->device_uri, uri, sizeof(uri)); -+ cupsdSetStringf(&audit_message, "printer=%s uri=%s banners=%s,%s range=%s", -+ p->name, uri, p->job_sheets[0], p->job_sheets[1], rangestr); -+ audit_log_user_message(AuditLog, AUDIT_LABEL_LEVEL_CHANGE, audit_message, -+ ServerName, NULL, NULL, 1); -+ if (printercon) -+ context_free(printercon); -+ free(rangestr); -+ cupsdClearString(&audit_message); -+ } -+#endif /* WITH_LSPP */ - } - - p->raw = 0; ---- cups-1.3.7/scheduler/conf.c.lspp 2008-05-30 16:59:10.000000000 +0100 -+++ cups-1.3.7/scheduler/conf.c 2008-05-30 16:59:10.000000000 +0100 -@@ -26,6 +26,7 @@ - * read_configuration() - Read a configuration file. - * read_location() - Read a definition. - * read_policy() - Read a definition. -+ * is_lspp_config() - Is the system configured for LSPP - */ - - /* -@@ -47,6 +48,9 @@ - # define INADDR_NONE 0xffffffff - #endif /* !INADDR_NONE */ - -+#ifdef WITH_LSPP -+# include -+#endif /* WITH_LSPP */ - - /* - * Configuration variable structure... -@@ -160,6 +164,10 @@ static const cupsd_var_t variables[] = - # if defined(HAVE_LIBSSL) || defined(HAVE_GNUTLS) - { "ServerKey", &ServerKey, CUPSD_VARTYPE_PATHNAME }, - # endif /* HAVE_LIBSSL || HAVE_GNUTLS */ -+#ifdef WITH_LSPP -+ { "AuditLog", &AuditLog, CUPSD_VARTYPE_INTEGER }, -+ { "PerPageLabels", &PerPageLabels, CUPSD_VARTYPE_BOOLEAN }, -+#endif /* WITH_LSPP */ - #endif /* HAVE_SSL */ - { "ServerName", &ServerName, CUPSD_VARTYPE_STRING }, - { "ServerRoot", &ServerRoot, CUPSD_VARTYPE_PATHNAME }, -@@ -350,6 +358,9 @@ cupsdReadConfiguration(void) - *old_requestroot; /* Old RequestRoot */ - const char *tmpdir; /* TMPDIR environment variable */ - struct stat tmpinfo; /* Temporary directory info */ -+#ifdef WITH_LSPP -+ char *audit_message; /* Audit message string */ -+#endif /* WITH_LSPP */ - - - /* -@@ -611,6 +622,25 @@ cupsdReadConfiguration(void) - - RunUser = getuid(); - -+#ifdef WITH_LSPP -+ if (AuditLog != -1) -+ { -+ /* -+ * ClassifyOverride is set during read_configuration, if its ON, report it now -+ */ -+ if (ClassifyOverride) -+ audit_log_user_message(AuditLog, AUDIT_USYS_CONFIG, -+ "[Config] ClassifyOverride=enabled Users can override print banners", -+ ServerName, NULL, NULL, 1); -+ /* -+ * PerPageLabel is set during read_configuration, if its OFF, report it now -+ */ -+ if (!PerPageLabels) -+ audit_log_user_message(AuditLog, AUDIT_USYS_CONFIG, -+ "[Config] PerPageLabels=disabled", ServerName, NULL, NULL, 1); -+ } -+#endif /* WITH_LSPP */ ++ /pageWidth pageRight pageLeft sub def % pageWidth = pageRight - pageLeft ++ /pageHeight pageTop pageBottom sub def% pageHeight = pageTop - pageBottom + - /* - * See if the ServerName is an IP address... - */ -@@ -885,11 +915,23 @@ cupsdReadConfiguration(void) - if (MaxActiveJobs > (MaxFDs / 3)) - MaxActiveJobs = MaxFDs / 3; - -- if (Classification && !strcasecmp(Classification, "none")) -+ if (Classification && strcasecmp(Classification, "none") == 0) - cupsdClearString(&Classification); - - if (Classification) -+ { - cupsdLogMessage(CUPSD_LOG_INFO, "Security set to \"%s\"", Classification); -+#ifdef WITH_LSPP -+ if (AuditLog != -1) -+ { -+ audit_message = NULL; -+ cupsdSetStringf(&audit_message, "[Config] Classification=%s", Classification); -+ audit_log_user_message(AuditLog, AUDIT_LABEL_LEVEL_CHANGE, audit_message, -+ ServerName, NULL, NULL, 1); -+ cupsdClearString(&audit_message); -+ } -+#endif /* WITH_LSPP */ -+ } - - /* - * Update the MaxClientsPerHost value, as needed... -@@ -3379,6 +3421,18 @@ read_policy(cups_file_t *fp, /* I - Con - return (0); - } - -+#ifdef WITH_LSPP -+int is_lspp_config() -+{ -+ if (Classification != NULL) -+ return ((strcasecmp(Classification, MLS_CONFIG) == 0) -+ || (strcasecmp(Classification, TE_CONFIG) == 0) -+ || (strcasecmp(Classification, SELINUX_CONFIG) == 0)); -+ else -+ return 0; -+} -+#endif /* WITH_LSPP */ ++ /boxWidth % width of text box ++ pageWidth pageHeight lt ++ { pageWidth 54 mul } ++ { pageHeight 42 mul } ++ ifelse def + - - /* - * End of "$Id: conf.c 7382 2008-03-20 04:06:01Z mike $". ---- cups-1.3.7/scheduler/job.h.lspp 2008-01-16 22:20:33.000000000 +0000 -+++ cups-1.3.7/scheduler/job.h 2008-05-30 16:59:31.000000000 +0100 -@@ -13,6 +13,13 @@ - * file is missing or damaged, see the license at "http://www.cups.org/". - */ - -+/* Copyright (C) 2005 Trusted Computer Solutions, Inc. */ -+/* (c) Copyright 2005-2006 Hewlett-Packard Development Company, L.P. */ ++ newpath % Clear bounding path + -+#ifdef WITH_LSPP -+#include -+#endif /* WITH_LSPP */ ++ % Create fonts... ++ /bigFont /Helvetica-Bold findfont % bigFont = Helvetica-Bold ++ pageHeight 3 mul scalefont def % size = pageHeight * 3 (nominally 33) + - /* - * Job request structure... - */ -@@ -60,6 +67,10 @@ typedef struct cupsd_job_s - krb5_ccache ccache; /* Kerberos credential cache */ - char *ccname; /* KRB5CCNAME environment variable */ - #endif /* HAVE_GSSAPI */ -+#ifdef WITH_LSPP -+ security_context_t scon; /* Security context of job */ -+ uid_t auid; /* Audit loginuid for this job */ -+#endif /* WITH_LSPP */ - } cupsd_job_t; - - ---- cups-1.3.7/scheduler/main.c.lspp 2008-05-30 16:59:10.000000000 +0100 -+++ cups-1.3.7/scheduler/main.c 2008-05-30 16:59:10.000000000 +0100 -@@ -35,6 +35,8 @@ - * usage() - Show scheduler usage. - */ - -+/* (c) Copyright 2005-2006 Hewlett-Packard Development Company, L.P. */ ++ /mediumFont /Helvetica findfont % mediumFont = Helvetica ++ pageHeight 1.5 mul scalefont def % size = pageHeight * 1.5 (nominally 16.5) + - /* - * Include necessary headers... - */ -@@ -73,6 +75,9 @@ - # include - #endif /* __APPLE__ && HAVE_DLFCN_H */ - -+#ifdef WITH_LSPP -+# include -+#endif /* WITH_LSPP */ - - /* - * Local functions... -@@ -154,6 +159,9 @@ main(int argc, /* I - Number of comm - int launchd_idle_exit; - /* Idle exit on select timeout? */ - #endif /* HAVE_LAUNCHD */ -+#if WITH_LSPP -+ auditfail_t failmode; /* Action for audit_open failure */ -+#endif /* WITH_LSPP */ - - - #ifdef HAVE_GETEUID -@@ -413,6 +421,25 @@ main(int argc, /* I - Number of comm - #endif /* DEBUG */ - } - -+#ifdef WITH_LSPP -+ if ((AuditLog = audit_open()) < 0 ) -+ { -+ if (get_auditfail_action(&failmode) == 0) -+ { -+ if (failmode == FAIL_LOG) -+ { -+ cupsdLogMessage(CUPSD_LOG_ERROR, "Unable to connect to audit subsystem."); -+ AuditLog = -1; -+ } -+ else if (failmode == FAIL_TERMINATE) -+ { -+ fprintf(stderr, "cupsd: unable to start auditing, terminating"); -+ return -1; -+ } -+ } -+ } -+#endif /* WITH_LSPP */ ++ % Offset page to account for lower-left margin... ++ pageLeft 72 mul ++ pageBottom 72 mul ++ translate + - /* - * Set the timezone info... - */ -@@ -1160,6 +1187,11 @@ main(int argc, /* I - Number of comm - - cupsdStopSelect(); - -+#ifdef WITH_LSPP -+ if (AuditLog != -1) -+ audit_close(AuditLog); -+#endif /* WITH_LSPP */ ++ % Job information box... ++ pageWidth 36 mul 9 add % x = pageWidth * 1/2 * 72 + 9 ++ boxWidth 0.5 mul sub % x-= 1/2 box width ++ pageHeight 30 mul 9 sub % y = pageHeight * 1/2 * 72 - 9 ++ boxWidth % w = box width ++ pageHeight 14 mul % h = pageHeight * 1/2 * 72 ++ 0.5 setgray rectfill % Draw a shadow + - return (!stop_scheduler); - } - ---- cups-1.3.7/scheduler/ipp.c 2008-05-30 17:01:08.000000000 +0100 -+++ cups-1.3.7/scheduler/ipp.c 2008-07-01 12:30:59.000000000 +0100 -@@ -36,6 +36,7 @@ - * cancel_all_jobs() - Cancel all print jobs. - * cancel_job() - Cancel a print job. - * cancel_subscription() - Cancel a subscription. -+ * check_context() - Check the SELinux context for a user and job - * check_quotas() - Check quotas for a printer and user. - * copy_attribute() - Copy a single attribute. - * copy_attrs() - Copy attributes from one request to another. -@@ -93,6 +94,9 @@ - * validate_user() - Validate the user for the request. - */ - -+/* Copyright (C) 2005 Trusted Computer Solutions, Inc. */ -+/* (c) Copyright 2005-2006 Hewlett-Packard Development Company, L.P. */ ++ pageWidth 36 mul % x = pageWidth * 1/2 * 72 ++ boxWidth 0.5 mul sub % x-= 1/2 box width ++ pageHeight 30 mul % y = pageHeight * 1/4 * 72 ++ boxWidth % w = box width ++ pageHeight 14 mul % h = pageHeight * 1/2 * 72 + - /* - * Include necessary headers... - */ -@@ -116,6 +120,14 @@ - # endif /* HAVE_MEMBERSHIPPRIV_H */ - #endif /* __APPLE__ */ - -+#ifdef WITH_LSPP -+#include -+#include -+#include -+#include -+#include -+#include -+#endif /* WITH_LSPP */ - - /* - * Local functions... -@@ -140,6 +152,9 @@ - static void cancel_all_jobs(cupsd_client_t *con, ipp_attribute_t *uri); - static void cancel_job(cupsd_client_t *con, ipp_attribute_t *uri); - static void cancel_subscription(cupsd_client_t *con, int id); -+#ifdef WITH_LSPP -+static int check_context(cupsd_client_t *con, cupsd_job_t *job); -+#endif /* WITH_LSPP */ - static int check_quotas(cupsd_client_t *con, cupsd_printer_t *p); - static ipp_attribute_t *copy_attribute(ipp_t *to, ipp_attribute_t *attr, - int quickcopy); -@@ -1267,6 +1282,21 @@ - int kbytes; /* Size of print file */ - int i; /* Looping var */ - int lowerpagerange; /* Page range bound */ -+#ifdef WITH_LSPP -+ char *audit_message; /* Audit message string */ -+ char *printerfile; /* device file pointed to by the printer */ -+ char *userheader = NULL; /* User supplied job-sheets[0] */ -+ char *userfooter = NULL; /* User supplied job-sheets[1] */ -+ int override = 0; /* Was a banner overrode on a job */ -+ security_id_t clisid; /* SELinux SID for the client */ -+ security_id_t psid; /* SELinux SID for the printer */ -+ context_t printercon; /* Printer's context string */ -+ struct stat printerstat; /* Printer's stat buffer */ -+ security_context_t devcon; /* Printer's SELinux context */ -+ struct avc_entry_ref avcref; /* Pointer to the access vector cache */ -+ security_class_t tclass; /* Object class for the SELinux check */ -+ access_vector_t avr; /* Access method being requested */ -+#endif /* WITH_LSPP */ - - - cupsdLogMessage(CUPSD_LOG_DEBUG2, "add_job(%p[%d], %p(%s), %p(%s/%s))", -@@ -1454,6 +1484,104 @@ - ippAddString(con->request, IPP_TAG_JOB, IPP_TAG_NAME, "job-name", NULL, - title = "Untitled"); - -+#ifdef WITH_LSPP -+ if (is_lspp_config()) -+ { -+ if (!con->scon || strncmp(con->scon, UNKNOWN_SL, strlen(UNKNOWN_SL)) == 0) -+ { -+ cupsdLogMessage(CUPSD_LOG_ERROR, "add_job: missing classification for connection \'%s\'!", printer->name); -+ send_ipp_status(con, IPP_INTERNAL_ERROR, _("Missing required security attributes.")); -+ return (NULL); -+ } ++ 4 copy 1 setgray rectfill % Clear the box to white ++ 0 setgray rectstroke % Draw a black box around it... + -+ /* -+ * Perform an access check so that if the user gets feedback at enqueue time -+ */ ++ % Job information text... ++ mediumFont setfont % Medium sized font + -+ printerfile = strstr(printer->device_uri, "/dev/"); -+ if (printerfile == NULL && (strncmp(printer->device_uri, "file:/", 6) == 0)) -+ printerfile = strdup(printer->device_uri + strlen("file:/")); ++ pageWidth 36 mul % x = pageWidth * 1/2 * 72 ++ pageHeight 36 mul % y = pageHeight * 1/2 * 72 ++ pageHeight 5 mul add % y += 2 lines ++ 2 copy % Copy X & Y ++ moveto ++ (Job ID: ) RIGHT ++ moveto ++ ({printer-name}-{job-id}) show + -+ if (printerfile != NULL) -+ { -+ cupsdLogMessage(CUPSD_LOG_DEBUG, "add_job: Attempting an access check on printer device %s", -+ printerfile); ++ pageWidth 36 mul % x = pageWidth * 1/2 * 72 ++ pageHeight 36 mul % y = pageHeight * 1/2 * 72 ++ pageHeight 2 mul add % y += 1 line ++ 2 copy % Copy X & Y ++ moveto ++ (Title: ) RIGHT ++ moveto ++ ({job-name}) show + -+ if (lstat(printerfile, &printerstat) < 0) -+ { -+ if (errno != ENOENT) -+ { -+ send_ipp_status(con, IPP_NOT_AUTHORIZED, _("Unable to stat the printer")); -+ return (NULL); -+ } -+ /* -+ * The printer does not exist, so for now assume it's a FileDevice -+ */ -+ tclass = SECCLASS_FILE; -+ avr = FILE__WRITE; -+ } -+ else if (S_ISCHR(printerstat.st_mode)) -+ { -+ tclass = SECCLASS_CHR_FILE; -+ avr = CHR_FILE__WRITE; -+ } -+ else if (S_ISREG(printerstat.st_mode)) -+ { -+ tclass = SECCLASS_FILE; -+ avr = FILE__WRITE; -+ } -+ else -+ { -+ send_ipp_status(con, IPP_NOT_AUTHORIZED, _("Printer is not a character device or regular file")); -+ return (NULL); -+ } -+ avc_init("cupsd_enqueue_", NULL, NULL, NULL, NULL); -+ avc_entry_ref_init(&avcref); -+ if (avc_context_to_sid(con->scon, &clisid) != 0) -+ { -+ send_ipp_status(con, IPP_NOT_AUTHORIZED, _("Unable to get the SELinux sid of the client")); -+ return (NULL); -+ } -+ if (getfilecon(printerfile, &devcon) == -1) -+ { -+ send_ipp_status(con, IPP_NOT_AUTHORIZED, _("Unable to get the SELinux context of the printer")); -+ return (NULL); -+ } -+ printercon = context_new(devcon); -+ cupsdLogMessage(CUPSD_LOG_DEBUG, "add_job: printer context %s client context %s", -+ context_str(printercon), con->scon); -+ context_free(printercon); -+ -+ if (avc_context_to_sid(devcon, &psid) != 0) -+ { -+ send_ipp_status(con, IPP_NOT_AUTHORIZED, _("Unable to get the SELinux sid of the printer")); -+ freecon(devcon); -+ return (NULL); -+ } -+ freecon(devcon); -+ if (avc_has_perm(clisid, psid, tclass, avr, &avcref, NULL) != 0) -+ { -+ /* -+ * The access check failed, so cancel the job and send an audit message -+ */ -+ if (AuditLog != -1) -+ { -+ audit_message = NULL; -+ cupsdSetStringf(&audit_message, "job=? auid=%u acct=%s obj=%s refused" -+ " unable to access printer=%s", con->auid, -+ con->username, con->scon, printer->name); -+ audit_log_user_message(AuditLog, AUDIT_USER_LABELED_EXPORT, audit_message, -+ ServerName, NULL, NULL, 0); -+ cupsdClearString(&audit_message); -+ } -+ -+ send_ipp_status(con, IPP_NOT_AUTHORIZED, _("SELinux prohibits access to the printer")); -+ return (NULL); -+ } -+ } -+ } -+#endif /* WITH_LSPP */ -+ - if ((job = cupsdAddJob(priority, printer->name)) == NULL) - { - send_ipp_status(con, IPP_INTERNAL_ERROR, -@@ -1462,6 +1590,32 @@ - return (NULL); - } - -+#ifdef WITH_LSPP -+ if (is_lspp_config()) -+ { -+ /* -+ * duplicate the security context and auid of the connection into the job structure -+ */ -+ job->scon = strdup(con->scon); -+ job->auid = con->auid; -+ -+ /* -+ * add the security context to the request so that on a restart the security -+ * attributes will be able to be restored -+ */ -+ ippAddString(con->request, IPP_TAG_JOB, IPP_TAG_NAME, "security-context", -+ NULL, job->scon); -+ } -+ else -+ { -+ /* -+ * Fill in the security context of the job as unlabeled -+ */ -+ cupsdLogMessage(CUPSD_LOG_DEBUG, "add_job: setting context of job to %s", UNKNOWN_SL); -+ cupsdSetString(&job->scon, UNKNOWN_SL); -+ } -+#endif /* WITH_LSPP */ -+ - job->dtype = printer->type & (CUPS_PRINTER_CLASS | CUPS_PRINTER_IMPLICIT | - CUPS_PRINTER_REMOTE); - job->attrs = con->request; -@@ -1668,6 +1822,29 @@ - attr->values[0].string.text = _cupsStrAlloc(printer->job_sheets[0]); - attr->values[1].string.text = _cupsStrAlloc(printer->job_sheets[1]); - } -+#ifdef WITH_LSPP -+ else -+ { -+ /* -+ * The option was present, so capture the user supplied strings -+ */ -+ userheader = strdup(attr->values[0].string.text); -+ -+ if (attr->num_values > 1) -+ userfooter = strdup(attr->values[1].string.text); -+ -+ if (Classification != NULL && (strcmp(userheader, Classification) == 0) -+ && userfooter &&(strcmp(userfooter, Classification) == 0)) -+ { -+ /* -+ * Since both values are Classification, the user is not trying to Override -+ */ -+ free(userheader); -+ if (userfooter) free(userfooter); -+ userheader = userfooter = NULL; -+ } -+ } -+#endif /* WITH_LSPP */ - - job->job_sheets = attr; - -@@ -1698,6 +1875,9 @@ - "job-sheets=\"%s,none\", " - "job-originating-user-name=\"%s\"", - job->id, Classification, job->username); -+#ifdef WITH_LSPP -+ override = 1; -+#endif /* WITH_LSPP */ - } - else if (attr->num_values == 2 && - strcmp(attr->values[0].string.text, -@@ -1716,6 +1896,9 @@ - "job-originating-user-name=\"%s\"", - job->id, attr->values[0].string.text, - attr->values[1].string.text, job->username); -+#ifdef WITH_LSPP -+ override = 1; -+#endif /* WITH_LSPP */ - } - else if (strcmp(attr->values[0].string.text, Classification) && - strcmp(attr->values[0].string.text, "none") && -@@ -1736,6 +1919,9 @@ - "job-originating-user-name=\"%s\"", - job->id, attr->values[0].string.text, - attr->values[1].string.text, job->username); -+#ifdef WITH_LSPP -+ override = 1; -+#endif /* WITH_LSPP */ - } - } - else if (strcmp(attr->values[0].string.text, Classification) && -@@ -1776,7 +1962,50 @@ - "job-sheets=\"%s\", " - "job-originating-user-name=\"%s\"", - job->id, Classification, job->username); -+#ifdef WITH_LSPP -+ override = 1; -+#endif /* WITH_LSPP */ -+ } -+#ifdef WITH_LSPP -+ if (is_lspp_config() && AuditLog != -1) -+ { -+ audit_message = NULL; -+ -+ if (userheader || userfooter) -+ { -+ if (!override) -+ { -+ /* -+ * The user overrode the banner, so audit it -+ */ -+ cupsdSetStringf(&audit_message, "job=%d user supplied job-sheets=%s,%s" -+ " using banners=%s,%s", job->id, userheader, -+ userfooter, attr->values[0].string.text, -+ (attr->num_values > 1) ? attr->values[1].string.text : "(null)"); -+ audit_log_user_message(AuditLog, AUDIT_LABEL_OVERRIDE, audit_message, -+ ServerName, NULL, NULL, 1); -+ } -+ else -+ { -+ /* -+ * The user tried to override the banner, audit the failure -+ */ -+ cupsdSetStringf(&audit_message, "job=%d user supplied job-sheets=%s,%s" -+ " ignored banners=%s,%s", job->id, userheader, -+ userfooter, attr->values[0].string.text, -+ (attr->num_values > 1) ? attr->values[1].string.text : "(null)"); -+ audit_log_user_message(AuditLog, AUDIT_LABEL_OVERRIDE, audit_message, -+ ServerName, NULL, NULL, 0); - } -+ cupsdClearString(&audit_message); -+ } -+ } -+ -+ if (userheader) -+ free(userheader); -+ if (userfooter) -+ free(userfooter); -+#endif /* WITH_LSPP */ - } - - /* -@@ -3391,6 +3620,103 @@ - } - - -+#ifdef WITH_LSPP -+/* -+ * 'check_context()' - Check SELinux security context of a user and job -+ */ -+ -+static int /* O - 1 if OK, 0 if not, -1 on error */ -+check_context(cupsd_client_t *con, /* I - Client connection */ -+ cupsd_job_t *job) /* I - Job */ -+{ -+ int enforcing; /* is SELinux in enforcing mode */ -+ char filename[1024]; /* Filename of the spool file */ -+ security_id_t clisid; /* SELinux SID of the client */ -+ security_id_t jobsid; /* SELinux SID of the job */ -+ security_id_t filesid; /* SELinux SID of the spool file */ -+ struct avc_entry_ref avcref; /* AVC entry cache pointer */ -+ security_class_t tclass; /* SELinux security class */ -+ access_vector_t avr; /* SELinux access being queried */ -+ security_context_t spoolfilecon; /* SELinux context of the spool file */ -+ -+ -+ /* -+ * Validate the input to be sure there are contexts to work with... -+ */ -+ -+ if (con->scon == NULL || job->scon == NULL -+ || strncmp(con->scon, UNKNOWN_SL, strlen(UNKNOWN_SL)) == 0 -+ || strncmp(job->scon, UNKNOWN_SL, strlen(UNKNOWN_SL)) == 0) -+ return -1; -+ -+ if ((enforcing = security_getenforce()) == -1) -+ { -+ cupsdLogMessage(CUPSD_LOG_ERROR, "Error while determining SELinux enforcement"); -+ return -1; -+ } -+ cupsdLogMessage(CUPSD_LOG_DEBUG, "check_context: client context %s job context %s", con->scon, job->scon); -+ -+ -+ /* -+ * Initialize the avc engine... -+ */ -+ -+ if (avc_init("cupsd", NULL, NULL, NULL, NULL) < 0) -+ { -+ cupsdLogMessage(CUPSD_LOG_ERROR, "check_context: unable avc_init"); -+ return -1; -+ } -+ if (avc_context_to_sid(con->scon, &clisid) != 0) -+ { -+ cupsdLogMessage(CUPSD_LOG_ERROR, "check_context: unable to convert %s to SELinux sid", con->scon); -+ return -1; -+ } -+ avc_context_to_sid(job->scon, &jobsid); -+ avc_entry_ref_init(&avcref); -+ tclass = SECCLASS_FILE; -+ avr = FILE__READ; -+ -+ /* -+ * Perform the check with the client as the subject, first with the job as the object -+ * if that fails then with the spool file as the object... -+ */ -+ -+ if (avc_has_perm_noaudit(clisid, jobsid, tclass, avr, &avcref, NULL) != 0) -+ { -+ cupsdLogMessage(CUPSD_LOG_INFO, "check_context: SELinux denied access based on the client context"); -+ -+ snprintf(filename, sizeof(filename), "%s/c%05d", RequestRoot, job->id); -+ if (getfilecon(filename, &spoolfilecon) == -1) -+ { -+ cupsdLogMessage(CUPSD_LOG_ERROR, "check_context: Unable to get spoolfile context"); -+ return -1; -+ } -+ if (avc_context_to_sid(spoolfilecon, &filesid) != 0) -+ { -+ cupsdLogMessage(CUPSD_LOG_ERROR, "check_context: Unable to determine the SELinux sid for the spool file"); -+ freecon(spoolfilecon); -+ return -1; -+ } -+ freecon(spoolfilecon); -+ if (avc_has_perm_noaudit(clisid, filesid, tclass, avr, &avcref, NULL) != 0) -+ { -+ cupsdLogMessage(CUPSD_LOG_INFO, "check_context: SELinux denied access to the spool file"); -+ return 0; -+ } -+ cupsdLogMessage(CUPSD_LOG_INFO, "check_context: SELinux allowed access to the spool file"); -+ return 1; -+ } -+ else -+ if (enforcing == 0) -+ cupsdLogMessage(CUPSD_LOG_INFO, "check_context: allowing operation due to permissive mode"); -+ else -+ cupsdLogMessage(CUPSD_LOG_INFO, "check_context: SELinux allowed access based on the client context"); -+ -+ return 1; -+} -+#endif /* WITH_LSPP */ -+ -+ - /* - * 'check_quotas()' - Check quotas for a printer and user. - */ -@@ -3912,6 +4238,15 @@ - char attrname[255], /* Name of attribute */ - *s; /* Pointer into name */ - ipp_attribute_t *attr; /* Attribute */ -+#ifdef WITH_LSPP -+ const char *mls_label; /* SL of print job */ -+ char *jobrange; /* SELinux sensitivity range */ -+ char *jobclearance; /* SELinux low end clearance */ -+ context_t jobcon; /* SELinux context of the job */ -+ context_t tmpcon; /* Temp context to set the level */ -+ security_context_t spoolcon; /* Context of the file in the spool */ -+#endif /* WITH_LSPP */ -+ - - - cupsdLogMessage(CUPSD_LOG_DEBUG2, "copy_banner(%p[%d], %p[%d], %s)", -@@ -3946,6 +4281,82 @@ - - fchmod(cupsFileNumber(out), 0640); - fchown(cupsFileNumber(out), RunUser, Group); -+#ifdef WITH_LSPP -+ if (job->scon != NULL && -+ strncmp(job->scon, UNKNOWN_SL, strlen(UNKNOWN_SL)) != 0) -+ { -+ if (getfilecon(filename, &spoolcon) == -1) -+ { -+ cupsdLogMessage(CUPSD_LOG_ERROR, -+ "copy_banner: Unable to get the context of the banner file %s - %s", -+ filename, strerror(errno)); -+ job->num_files --; -+ return (0); -+ } -+ tmpcon = context_new(spoolcon); -+ jobcon = context_new(job->scon); -+ freecon(spoolcon); -+ if (!tmpcon || !jobcon) -+ { -+ if (tmpcon) -+ context_free(tmpcon); -+ if (jobcon) -+ context_free(jobcon); -+ cupsdLogMessage(CUPSD_LOG_ERROR, -+ "copy_banner: Unable to get the SELinux contexts"); -+ job->num_files --; -+ return (0); -+ } -+ jobrange = context_range_get(jobcon); -+ if (jobrange) -+ { -+ jobrange = strdup(jobrange); -+ if ((jobclearance = strtok(jobrange, "-")) != NULL) -+ { -+ if (context_range_set(tmpcon, jobclearance) == -1) -+ { -+ cupsdLogMessage(CUPSD_LOG_ERROR, -+ "copy_banner: Unable to set the level of the context for file %s - %s", -+ filename, strerror(errno)); -+ free(jobrange); -+ context_free(jobcon); -+ context_free(tmpcon); -+ job->num_files --; -+ return (0); -+ } -+ } -+ else -+ { -+ if (context_range_set(tmpcon, (context_range_get(jobcon))) == -1) -+ { -+ cupsdLogMessage(CUPSD_LOG_ERROR, -+ "copy_banner: Unable to set the level of the context for file %s - %s", -+ filename, strerror(errno)); -+ free(jobrange); -+ context_free(jobcon); -+ context_free(tmpcon); -+ job->num_files --; -+ return (0); -+ } -+ } -+ free(jobrange); -+ } -+ if (setfilecon(filename, context_str(tmpcon)) == -1) -+ { -+ cupsdLogMessage(CUPSD_LOG_ERROR, -+ "copy_banner: Unable to set the context of the banner file %s - %s", -+ filename, strerror(errno)); -+ context_free(jobcon); -+ context_free(tmpcon); -+ job->num_files --; -+ return (0); -+ } -+ cupsdLogMessage(CUPSD_LOG_DEBUG2, "copy_banner: %s set to %s", -+ filename, context_str(tmpcon)); -+ context_free(jobcon); -+ context_free(tmpcon); -+ } -+#endif /* WITH_LSPP */ - - /* - * Try the localized banner file under the subdirectory... -@@ -4040,6 +4451,24 @@ - else - s = attrname; - -+#ifdef WITH_LSPP -+ if (strcmp(s, "mls-label") == 0) -+ { -+ if (job->scon != NULL && strncmp(job->scon, UNKNOWN_SL, strlen(UNKNOWN_SL)) != 0) -+ { -+ jobcon = context_new(job->scon); -+ if (strcasecmp(name, MLS_CONFIG) == 0) -+ mls_label = context_range_get(jobcon); -+ else if (strcasecmp(name, TE_CONFIG) == 0) -+ mls_label = context_type_get(jobcon); -+ else // default to using the whole context string -+ mls_label = context_str(jobcon); -+ cupsFilePuts(out, mls_label); -+ context_free(jobcon); -+ } -+ continue; -+ } -+#endif /* WITH_LSPP */ - if (!strcmp(s, "printer-name")) - { - cupsFilePuts(out, job->dest); -@@ -5765,6 +6194,22 @@ - return; - } - -+ -+#ifdef WITH_LSPP -+ /* -+ * Check SELinux... -+ */ -+ if (is_lspp_config() && check_context(con, job) != 1) -+ { -+ /* -+ * Unfortunately we have to lie to the user... -+ */ -+ send_ipp_status(con, IPP_NOT_FOUND, _("Job #%d does not exist!"), jobid); -+ return; -+ } -+#endif /* WITH_LSPP */ -+ -+ - /* - * Copy attributes... - */ -@@ -5970,6 +6415,11 @@ - if (count > 0) - ippAddSeparator(con->response); - -+#ifdef WITH_LSPP -+ if (is_lspp_config() && check_context(con, job) != 1) -+ continue; -+#endif /* WITH_LSPP */ -+ - count ++; - - cupsdLogMessage(CUPSD_LOG_DEBUG2, "get_jobs: count = %d", count); -@@ -10042,6 +10492,11 @@ - - strlcpy(username, get_username(con), userlen); - -+#ifdef WITH_LSPP -+ if (is_lspp_config() && check_context(con, job) != 1) -+ return 0; -+#endif /* WITH_LSPP */ -+ - /* - * Check the username against the owner... - */ ---- cups-1.3.7/scheduler/conf.h.lspp 2008-05-30 16:59:10.000000000 +0100 -+++ cups-1.3.7/scheduler/conf.h 2008-05-30 16:59:10.000000000 +0100 -@@ -193,6 +193,12 @@ VAR char *ServerKey VALUE(NULL); - /* Server key file */ - # endif /* HAVE_LIBSSL || HAVE_GNUTLS */ - #endif /* HAVE_SSL */ -+#ifdef WITH_LSPP -+VAR int AuditLog VALUE(-1), -+ /* File descriptor for audit */ -+ PerPageLabels VALUE(TRUE); -+ /* Put the label on each page */ -+#endif /* WITH_LSPP */ - - #ifdef HAVE_LAUNCHD - VAR int LaunchdTimeout VALUE(DEFAULT_TIMEOUT); -@@ -211,6 +217,9 @@ VAR char *SystemGroupAuthKey VALUE(NULL - /* System group auth key */ - #endif /* HAVE_AUTHORIZATION_H */ - -+#ifdef WITH_LSPP -+extern int is_lspp_config(void); -+#endif /* WITH_LSPP */ - - /* - * Prototypes... ---- cups-1.3.7/scheduler/client.c.lspp 2008-02-12 00:20:32.000000000 +0000 -+++ cups-1.3.7/scheduler/client.c 2008-05-30 16:59:10.000000000 +0100 -@@ -39,12 +39,14 @@ - * pipe_command() - Pipe the output of a command to the remote client. - * write_file() - Send a file via HTTP. - * write_pipe() - Flag that data is available on the CGI pipe. -+ * client_pid_to_auid() - Get the audit login uid of the client. - */ - - /* - * Include necessary headers... - */ - -+#define _GNU_SOURCE - #include - #include "cupsd.h" - -@@ -76,6 +78,12 @@ extern const char *cssmErrorString(int e - # include - #endif /* HAVE_GNUTLS */ - -+#ifdef WITH_LSPP -+#include -+#include -+#include -+#endif /* WITH_LSPP */ -+ - - /* - * Local functions... -@@ -349,6 +357,57 @@ cupsdAcceptClient(cupsd_listener_t *lis) - } - } - -+#ifdef WITH_LSPP -+ if (is_lspp_config()) -+ { -+ struct ucred cr; -+ unsigned int cl=sizeof(cr); -+ -+ if (getsockopt(con->http.fd, SOL_SOCKET, SO_PEERCRED, &cr, &cl) == 0) -+ { -+ /* -+ * client_pid_to_auid() can be racey -+ * In this case the pid is based on a socket connected to the client -+ */ -+ if ((con->auid = client_pid_to_auid(cr.pid)) == -1) -+ { -+ close(con->http.fd); -+ cupsdLogMessage(CUPSD_LOG_ERROR, "cupsdAcceptClient: " -+ "unable to determine client auid for client pid=%d", cr.pid); -+ free(con); -+ return; -+ } -+ cupsdLogMessage(CUPSD_LOG_INFO, "cupsdAcceptClient: peer's pid=%d, uid=%d, gid=%d, auid=%d", -+ cr.pid, cr.uid, cr.gid, con->auid); -+ } -+ else -+ { -+ close(con->http.fd); -+ cupsdLogMessage(CUPSD_LOG_ERROR, "cupsdAcceptClient: getsockopt() failed"); -+ free(con); -+ return; -+ } -+ -+ /* -+ * get the context of the peer connection -+ */ -+ if (getpeercon(con->http.fd, &con->scon)) -+ { -+ close(con->http.fd); -+ cupsdLogMessage(CUPSD_LOG_ERROR, "cupsdAcceptClient: getpeercon() failed"); -+ free(con); -+ return; -+ } -+ -+ cupsdLogMessage(CUPSD_LOG_INFO, "cupsdAcceptClient: client context=%s", con->scon); -+ } -+ else -+ { -+ cupsdLogMessage(CUPSD_LOG_DEBUG, "cupsdAcceptClient: skipping getpeercon()"); -+ cupsdSetString(&con->scon, UNKNOWN_SL); -+ } -+#endif /* WITH_LSPP */ -+ - #ifdef AF_INET6 - if (con->http.hostaddr->addr.sa_family == AF_INET6) - cupsdLogMessage(CUPSD_LOG_DEBUG, "cupsdAcceptClient: %d from %s:%d (IPv6)", -@@ -731,6 +790,13 @@ cupsdReadClient(cupsd_client_t *con) /* - mime_type_t *type; /* MIME type of file */ - cupsd_printer_t *p; /* Printer */ - static unsigned request_id = 0; /* Request ID for temp files */ -+#ifdef WITH_LSPP -+ security_context_t spoolcon; /* context of the job file */ -+ context_t clicon; /* contex_t container for con->scon */ -+ context_t tmpcon; /* temp context to swap the level */ -+ char *clirange; /* SELinux sensitivity range */ -+ char *cliclearance; /* SELinux low end clearance */ -+#endif /* WITH_LSPP */ - - - status = HTTP_CONTINUE; -@@ -2011,6 +2077,67 @@ cupsdReadClient(cupsd_client_t *con) /* - fchmod(con->file, 0640); - fchown(con->file, RunUser, Group); - fcntl(con->file, F_SETFD, fcntl(con->file, F_GETFD) | FD_CLOEXEC); -+#ifdef WITH_LSPP -+ if (strncmp(con->scon, UNKNOWN_SL, strlen(UNKNOWN_SL)) != 0) -+ { -+ if (getfilecon(con->filename, &spoolcon) == -1) -+ { -+ cupsdSendError(con, HTTP_SERVER_ERROR, CUPSD_AUTH_NONE); -+ return (cupsdCloseClient(con)); -+ } -+ clicon = context_new(con->scon); -+ tmpcon = context_new(spoolcon); -+ freecon(spoolcon); -+ if (!clicon || !tmpcon) -+ { -+ cupsdSendError(con, HTTP_SERVER_ERROR, CUPSD_AUTH_NONE); -+ if (clicon) -+ context_free(clicon); -+ if (tmpcon) -+ context_free(tmpcon); -+ return (cupsdCloseClient(con)); -+ } -+ clirange = context_range_get(clicon); -+ if (clirange) -+ { -+ clirange = strdup(clirange); -+ if ((cliclearance = strtok(clirange, "-")) != NULL) -+ { -+ if (context_range_set(tmpcon, cliclearance) == -1) -+ { -+ cupsdSendError(con, HTTP_SERVER_ERROR, CUPSD_AUTH_NONE); -+ free(clirange); -+ context_free(tmpcon); -+ context_free(clicon); -+ return (cupsdCloseClient(con)); -+ } -+ } -+ else -+ { -+ if (context_range_set(tmpcon, (context_range_get(clicon))) == -1) -+ { -+ cupsdSendError(con, HTTP_SERVER_ERROR, CUPSD_AUTH_NONE); -+ free(clirange); -+ context_free(tmpcon); -+ context_free(clicon); -+ return (cupsdCloseClient(con)); -+ } -+ } -+ free(clirange); -+ } -+ if (setfilecon(con->filename, context_str(tmpcon)) == -1) -+ { -+ cupsdSendError(con, HTTP_SERVER_ERROR, CUPSD_AUTH_NONE); -+ context_free(tmpcon); -+ context_free(clicon); -+ return (cupsdCloseClient(con)); -+ } -+ cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdReadClient: %s set to %s", -+ con->filename, context_str(tmpcon)); -+ context_free(tmpcon); -+ context_free(clicon); -+ } -+#endif /* WITH_LSPP */ - } - - if (con->http.state != HTTP_POST_SEND) -@@ -4253,6 +4380,50 @@ make_certificate(cupsd_client_t *con) /* - #endif /* HAVE_SSL */ - - -+#ifdef WITH_LSPP -+/* -+ * 'client_pid_to_auid()' - Using the client's pid, read /proc and determine the loginuid. -+ */ -+ -+uid_t client_pid_to_auid(pid_t clipid) -+{ -+ uid_t uid; -+ int len, in; -+ char buf[16] = {0}; -+ char fname[32] = {0}; ++ pageWidth 36 mul % x = pageWidth * 1/2 * 72 ++ pageHeight 36 mul % y = pageHeight * 1/2 * 72 ++ pageHeight -1 mul add % y -= 1 line ++ 2 copy % Copy X & Y ++ moveto ++ (Requesting User: ) RIGHT ++ moveto ++ ({job-originating-user-name}) show + ++ pageWidth 36 mul % x = pageWidth * 1/2 * 72 ++ pageHeight 36 mul % y = pageHeight * 1/2 * 72 ++ pageHeight -4 mul add % y -= 2 lines ++ 2 copy % Copy X & Y ++ moveto ++ (Billing Info: ) RIGHT ++ moveto ++ ({?job-billing}) show + -+ /* -+ * Hopefully this pid is still the one we are interested in. -+ */ -+ snprintf(fname, 32, "/proc/%d/loginuid", clipid); -+ in = open(fname, O_NOFOLLOW|O_RDONLY); ++ % Then the CUPS logo.... ++ gsave ++ pageWidth 4 mul ++ pageWidth 6 mul ++ translate ++ pageWidth 9 mul CUPSLOGO ++ grestore + -+ if (in < 0) -+ return -1; ++ % And the ESP logo.... ++ gsave ++ pageWidth 59 mul ++ pageWidth 6 mul ++ translate ++ pageWidth 6 mul ESPLOGO ++ grestore ++% Show the page... ++grestore ++showpage ++% ++% End of "$Id: mls_template,v 1.1 2005/06/27 18:44:46 colmo Exp $". ++% ++%%EOF +diff -up /dev/null cups-1.3.8/data/selinux +--- /dev/null 2008-07-28 15:45:57.127000670 +0100 ++++ cups-1.3.8/data/selinux 2008-07-28 16:37:51.000000000 +0100 +@@ -0,0 +1,261 @@ ++%!PS-Adobe-3.0 ++%%BoundingBox: 0 0 612 792 ++%%Pages: 1 ++%%LanguageLevel: 1 ++%%DocumentData: Clean7Bit ++%%DocumentSuppliedResources: procset bannerprint/1.0 ++%%DocumentNeededResources: font Helvetica Helvetica-Bold Times-Roman ++%%Creator: Michael Sweet, Easy Software Products ++%%CreationDate: May 10, 2000 ++%%Title: Test Page ++%%EndComments ++%%BeginProlog ++%%BeginResource procset bannerprint 1.1 0 ++% ++% PostScript banner page for the Common UNIX Printing System ("CUPS"). ++% ++% Copyright 1993-2005 by Easy Software Products ++% ++% These coded instructions, statements, and computer programs are the ++% property of Easy Software Products and are protected by Federal ++% copyright law. Distribution and use rights are outlined in the file ++% "LICENSE.txt" which should have been included with this file. If this ++% file is missing or damaged please contact Easy Software Products ++% at: ++% ++% Attn: CUPS Licensing Information ++% Easy Software Products ++% 44141 Airport View Drive, Suite 204 ++% Hollywood, Maryland 20636 USA ++% ++% Voice: (301) 373-9600 ++% EMail: cups-info@cups.org ++% WWW: http://www.cups.org ++% ++/CENTER { % Draw centered text ++ % (name) CENTER - ++ dup stringwidth pop % Get the width of the string ++ 0.5 mul neg 0 rmoveto % Shift left 1/2 of the distance ++ show % Show the string ++} bind def ++/RIGHT { % Draw right-justified text ++ % (name) RIGHT - ++ dup stringwidth pop % Get the width of the string ++ neg 0 rmoveto % Shift left the entire distance ++ show % Show the string ++} bind def ++/NUMBER { % Draw a number ++ % power n NUMBER - ++ 1 index 1 eq { % power == 1? ++ round cvi exch pop % Convert "n" to integer ++ } { ++ 1 index mul round exch div % Truncate extra decimal places ++ } ifelse ++ 100 string cvs show % Convert to a string and show it... ++} bind def ++/CUPSLOGO { % Draw the CUPS logo ++ % height CUPSLOGO ++ % Start with a big C... ++ /Helvetica findfont 1 index scalefont setfont ++ 0 setgray ++ 0 0 moveto ++ (C) show + -+ errno = 0; ++ % Then "UNIX Printing System" much smaller... ++ /Helvetica-Bold findfont 1 index 9 div scalefont setfont ++ 0.25 mul ++ dup dup 2.0 mul moveto ++ (UNIX) show ++ dup dup 1.6 mul moveto ++ (Printing) show ++ dup 1.2 mul moveto ++ (System) show ++} bind def ++/ESPLOGO { % Draw the ESP logo ++ % height ESPLOGO ++ % Compute the size of the logo... ++ 0 0 ++ 2 index 1.5 mul 3 index + -+ do { -+ len = read(in, buf, sizeof(buf)); -+ } while (len < 0 && errno == EINTR); ++ % Do the "metallic" fill from 10% black to 40% black... ++ 1 -0.001 0 { ++ dup % loopval ++ -0.15 mul % loopval * -0.15 ++ 0.9 add % 0.9 - loopval * 0.15 ++ setgray % set gray shade + -+ close(in); ++ 0 % x ++ 1 index neg % loopval ++ 1 add % 1 - loopval ++ 3 index % height ++ mul % height * (1 - loopval) ++ moveto % starting point + -+ if (len < 0 || len >= sizeof(buf)) -+ return -1; ++ dup % loopval ++ 3 index % width ++ mul % loopval * width ++ 2 index % height ++ lineto % Next point + -+ errno = 0; -+ buf[len] = 0; -+ uid = strtol(buf, 0, 10); ++ 0 % x ++ 2 index % height ++ lineto % Next point + -+ if (errno != 0) -+ return -1; -+ else -+ return uid; -+} -+#endif /* WITH_LSPP */ ++ closepath ++ fill + - /* - * 'pipe_command()' - Pipe the output of a command to the remote client. - */ ---- cups-1.3.7/scheduler/client.h.lspp 2007-10-22 19:52:13.000000000 +0100 -+++ cups-1.3.7/scheduler/client.h 2008-05-30 16:59:10.000000000 +0100 -@@ -17,6 +17,13 @@ - # include - #endif /* HAVE_AUTHORIZATION_H */ - -+/* Copyright (C) 2005 Trusted Computer Solutions, Inc. */ -+/* (c) Copyright 2005-2006 Hewlett-Packard Development Company, L.P. */ ++ dup % loopval ++ 0.15 mul % loopval * 0.15 ++ 0.6 add % 0.6 + loopval * 0.15 ++ setgray + -+#ifdef WITH_LSPP -+#include -+#endif /* WITH_LSPP */ ++ dup % loopval ++ neg 1 add % 1 - loopval ++ 3 index % width ++ mul % (1 - loopval) * width ++ 0 % y ++ moveto % Starting point + - /* - * HTTP client structure... - */ -@@ -62,6 +69,10 @@ struct cupsd_client_s - #ifdef HAVE_AUTHORIZATION_H - AuthorizationRef authref; /* Authorization ref */ - #endif /* HAVE_AUTHORIZATION_H */ -+#ifdef WITH_LSPP -+ security_context_t scon; /* Security context of connection */ -+ uid_t auid; /* Audit loginuid of the client */ -+#endif /* WITH_LSPP */ - }; - - #define HTTP(con) &((con)->http) -@@ -129,6 +140,9 @@ extern void cupsdStartListening(void); - extern void cupsdStopListening(void); - extern void cupsdUpdateCGI(void); - extern void cupsdWriteClient(cupsd_client_t *con); -+#ifdef WITH_LSPP -+extern uid_t client_pid_to_auid(pid_t clipid); -+#endif /* WITH_LSPP */ - - - /* ---- cups-1.3.7/config.h.in.lspp 2008-01-07 18:26:57.000000000 +0000 -+++ cups-1.3.7/config.h.in 2008-05-30 16:59:10.000000000 +0100 -@@ -530,6 +530,13 @@ - #undef HAVE_REMOVEFILE - - -+/* -+ * Are we trying to meet LSPP requirements? -+ */ ++ 2 index % width ++ exch % loopval ++ 2 index % height ++ mul % loopval * height ++ lineto % Next point + -+#undef WITH_LSPP ++ 1 index % width ++ 0 % y ++ lineto % Next point + ++ closepath ++ fill ++ } for + - #endif /* !_CUPS_CONFIG_H_ */ - - /* ---- cups-1.3.7/Makedefs.in.lspp 2008-01-22 22:37:21.000000000 +0000 -+++ cups-1.3.7/Makedefs.in 2008-05-30 16:59:10.000000000 +0100 -@@ -134,7 +134,7 @@ LIBCUPSORDER = @LIBCUPSORDER@ - LIBCUPSIMAGEORDER = @LIBCUPSIMAGEORDER@ - LINKCUPS = @LINKCUPS@ $(SSLLIBS) - LINKCUPSIMAGE = @LINKCUPSIMAGE@ --LIBS = $(LINKCUPS) $(COMMONLIBS) -+LIBS = $(LINKCUPS) $(COMMONLIBS) @LIBAUDIT@ @LIBSELINUX@ - OPTIM = @OPTIM@ - OPTIONS = - PAMLIBS = @PAMLIBS@ ---- cups-1.3.7/configure.in.lspp 2007-07-25 00:47:12.000000000 +0100 -+++ cups-1.3.7/configure.in 2008-05-30 16:59:10.000000000 +0100 -@@ -42,6 +42,8 @@ sinclude(config-scripts/cups-pap.m4) - sinclude(config-scripts/cups-pdf.m4) - sinclude(config-scripts/cups-scripting.m4) - -+sinclude(config-scripts/cups-lspp.m4) ++ 0 setgray rectstroke + - INSTALL_LANGUAGES="" - UNINSTALL_LANGUAGES="" - LANGFILES="" ---- /dev/null 2008-05-30 08:00:32.690000973 +0100 -+++ cups-1.3.7/config-scripts/cups-lspp.m4 2008-05-30 16:59:10.000000000 +0100 -@@ -0,0 +1,36 @@ -+dnl -+dnl LSPP code for the Common UNIX Printing System (CUPS). -+dnl -+dnl Copyright 2005-2006 by Hewlett-Packard Development Company, L.P. -+dnl -+dnl This program is free software; you can redistribute it and/or modify -+dnl it under the terms of the GNU General Public License as published by -+dnl the Free Software Foundation; version 2. -+dnl -+dnl This program is distributed in the hope that it will be useful, but -+dnl WITHOUT ANY WARRANTY; without even the implied warranty of -+dnl MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -+dnl General Public License for more details. -+dnl -+dnl You should have received a copy of the GNU General Public License -+dnl along with this program; if not, write to the Free Software Foundation, -+dnl Inc., 51 Franklin Street, Fifth Floor Boston, MA 02110-1301 USA -+dnl ++ /Helvetica-BoldOblique findfont 1 index 3 div scalefont setfont ++ dup 40 div + -+dnl Are we trying to meet LSPP requirements -+AC_ARG_ENABLE(lspp, [ --enable-lspp turn on auditing and label support, default=no]) ++ dup 4 mul 1 index 25 mul moveto (E) show ++ dup 10 mul 1 index 15 mul moveto (S) show ++ dup 16 mul 1 index 5 mul moveto (P) show + -+if test x"$enable_lspp" != xno; then -+ case "$uname" in -+ Linux) -+ AC_CHECK_LIB(audit,audit_log_user_message, [LIBAUDIT="-laudit" AC_SUBST(LIBAUDIT)]) -+ AC_CHECK_HEADER(libaudit.h) -+ AC_CHECK_LIB(selinux,getpeercon, [LIBSELINUX="-lselinux" AC_SUBST(LIBSELINUX)]) -+ AC_CHECK_HEADER(selinux/selinux.h) -+ AC_DEFINE(WITH_LSPP) -+ ;; -+ *) -+ # All others -+ ;; -+ esac -+fi ---- cups-1.3.7/filter/common.c.lspp 2007-07-11 22:46:42.000000000 +0100 -+++ cups-1.3.7/filter/common.c 2008-05-30 16:59:10.000000000 +0100 -@@ -30,6 +30,12 @@ - * Include necessary headers... - */ - -+#include "config.h" -+#ifdef WITH_LSPP -+#define _GNU_SOURCE -+#include -+#endif /* WITH_LSPP */ ++ /Helvetica-BoldOblique findfont 2 index 5 div scalefont setfont ++ dup 14 mul 1 index 29 mul moveto (asy) show ++ dup 20 mul 1 index 19 mul moveto (oftware) show ++ dup 26 mul 1 index 9 mul moveto (roducts) show + - #include "common.h" - #include - -@@ -312,6 +318,18 @@ WriteLabelProlog(const char *label, /* I - { - const char *classification; /* CLASSIFICATION environment variable */ - const char *ptr; /* Temporary string pointer */ -+#ifdef WITH_LSPP -+ int i, /* counter */ -+ n, /* counter */ -+ lines, /* number of lines needed */ -+ line_len, /* index into tmp_label */ -+ label_len, /* length of the label in characters */ -+ label_index, /* index into the label */ -+ longest, /* length of the longest line */ -+ longest_line, /* index to the longest line */ -+ max_width; /* maximum width in characters */ -+ char **wrapped_label; /* label with line breaks */ -+#endif /* WITH_LSPP */ - - - /* -@@ -334,6 +352,124 @@ WriteLabelProlog(const char *label, /* I - return; - } - -+#ifdef WITH_LSPP -+ if (strncmp(classification, "LSPP:", 5) == 0 && label == NULL) -+ { -+ /* -+ * Based on the 12pt fixed width font below determine the max_width -+ */ -+ max_width = width / 8; -+ longest_line = 0; -+ longest = 0; -+ classification += 5; // Skip the "LSPP:" -+ label_len = strlen(classification); ++ pop ++} bind def ++%%EndResource ++%%EndProlog ++%%Page: 1 1 ++gsave + -+ if (label_len > max_width) -+ { -+ lines = 1 + (int)(label_len / max_width); -+ line_len = (int)(label_len / lines); -+ wrapped_label = malloc(sizeof(wrapped_label) * lines); -+ label_index = i = n = 0; -+ while (classification[label_index]) -+ { -+ if ((label_index + line_len) > label_len) -+ break; -+ switch (classification[label_index + line_len + i]) -+ { -+ case ':': -+ case ',': -+ case '-': -+ i++; -+ wrapped_label[n++] = strndup(&classification[label_index], (line_len + i)); -+ label_index += line_len + i; -+ i = 0; -+ break; -+ default: -+ i++; -+ break; -+ } -+ if ((i + line_len) == max_width) -+ { -+ wrapped_label[n++] = strndup(&(classification[label_index]), (line_len + i)); -+ label_index = label_index + line_len + i; -+ i = 0; -+ } -+ } -+ wrapped_label[n] = strndup(&classification[label_index], label_len - label_index); -+ } -+ else -+ { -+ lines = 1; -+ wrapped_label = malloc(sizeof(wrapped_label)); -+ wrapped_label[0] = (char*)classification; -+ } ++ % Determine the imageable area and device resolution... ++ initclip newpath clippath pathbbox % Get bounding rectangle ++ 72 div /pageTop exch def % Get top margin in inches ++ 72 div /pageRight exch def % Get right margin in inches ++ 72 div /pageBottom exch def % Get bottom margin in inches ++ 72 div /pageLeft exch def % Get left margin in inches + -+ for (n = 0; n < lines; n++ ) -+ { -+ printf("userdict/ESPp%c(", ('a' + n)); -+ for (ptr = wrapped_label[n], i = 0; *ptr; ptr ++, i++) -+ if (*ptr < 32 || *ptr > 126) -+ printf("\\%03o", *ptr); -+ else -+ { -+ if (*ptr == '(' || *ptr == ')' || *ptr == '\\') -+ putchar('\\'); ++ /pageWidth pageRight pageLeft sub def % pageWidth = pageRight - pageLeft ++ /pageHeight pageTop pageBottom sub def% pageHeight = pageTop - pageBottom + -+ printf("%c", *ptr); -+ } -+ if (i > longest) -+ { -+ longest = i; -+ longest_line = n; -+ } -+ printf(")put\n"); -+ } ++ /boxWidth % width of text box ++ pageWidth pageHeight lt ++ { pageWidth 54 mul } ++ { pageHeight 42 mul } ++ ifelse def + -+ /* -+ * For LSPP use a fixed width font so that line wrapping can be calculated -+ */ ++ newpath % Clear bounding path + -+ puts("userdict/ESPlf /Nimbus-Mono findfont 12 scalefont put"); ++ % Create fonts... ++ /bigFont /Helvetica-Bold findfont % bigFont = Helvetica-Bold ++ pageHeight 3 mul scalefont def % size = pageHeight * 3 (nominally 33) + -+ /* -+ * Finally, the procedure to write the labels on the page... -+ */ ++ /mediumFont /Helvetica findfont % mediumFont = Helvetica ++ pageHeight 1.5 mul scalefont def % size = pageHeight * 1.5 (nominally 16.5) ++ ++ % Offset page to account for lower-left margin... ++ pageLeft 72 mul ++ pageBottom 72 mul ++ translate ++ ++ % Job information box... ++ pageWidth 36 mul 9 add % x = pageWidth * 1/2 * 72 + 9 ++ boxWidth 0.5 mul sub % x-= 1/2 box width ++ pageHeight 30 mul 9 sub % y = pageHeight * 1/2 * 72 - 9 ++ boxWidth % w = box width ++ pageHeight 14 mul % h = pageHeight * 1/2 * 72 ++ 0.5 setgray rectfill % Draw a shadow ++ ++ pageWidth 36 mul % x = pageWidth * 1/2 * 72 ++ boxWidth 0.5 mul sub % x-= 1/2 box width ++ pageHeight 30 mul % y = pageHeight * 1/4 * 72 ++ boxWidth % w = box width ++ pageHeight 14 mul % h = pageHeight * 1/2 * 72 ++ ++ 4 copy 1 setgray rectfill % Clear the box to white ++ 0 setgray rectstroke % Draw a black box around it... ++ ++ % Job information text... ++ mediumFont setfont % Medium sized font ++ ++ pageWidth 36 mul % x = pageWidth * 1/2 * 72 ++ pageHeight 36 mul % y = pageHeight * 1/2 * 72 ++ pageHeight 5 mul add % y += 2 lines ++ 2 copy % Copy X & Y ++ moveto ++ (Job ID: ) RIGHT ++ moveto ++ ({printer-name}-{job-id}) show ++ ++ pageWidth 36 mul % x = pageWidth * 1/2 * 72 ++ pageHeight 36 mul % y = pageHeight * 1/2 * 72 ++ pageHeight 2 mul add % y += 1 line ++ 2 copy % Copy X & Y ++ moveto ++ (Title: ) RIGHT ++ moveto ++ ({job-name}) show + -+ printf("userdict/ESPwl{\n" -+ " ESPlf setfont\n"); -+ printf(" ESPp%c stringwidth pop dup 12 add exch -0.5 mul %.0f add\n ", -+ 'a' + longest_line, width * 0.5f); -+ for (n = 1; n < lines; n++) -+ printf(" dup"); -+ printf("\n 1 setgray\n"); -+ printf(" dup 6 sub %.0f %d index %.0f ESPrf\n", -+ (bottom - 2.0), (2 + lines), 6.0 + (16.0 * lines)); -+ printf(" dup 6 sub %.0f %d index %.0f ESPrf\n", -+ (top - 6.0 - (16.0 * lines)), (2 + lines), 4.0 + (16.0 * lines)); -+ printf(" 0 setgray\n"); -+ printf(" dup 6 sub %.0f %d index %.0f ESPrs\n", -+ (bottom - 2.0), (2 + lines), 6.0 + (16.0 * lines)); -+ printf(" dup 6 sub %.0f %d index %.0f ESPrs\n", -+ (top - 6.0 - (16.0 * lines)), (2 + lines), 4.0 + (16.0 * lines)); -+ for (n = 0; n < lines; n ++) -+ { -+ printf(" dup %.0f moveto ESPp%c show\n", -+ bottom + 6.0 + ((lines - (n+1)) * 16.0), 'a' + n); -+ printf(" %.0f moveto ESPp%c show\n", top + 2.0 - ((n + 1) * 16.0), 'a' + n); -+ } -+ printf(" pop\n" -+ "}bind put\n"); ++ pageWidth 36 mul % x = pageWidth * 1/2 * 72 ++ pageHeight 36 mul % y = pageHeight * 1/2 * 72 ++ pageHeight -1 mul add % y -= 1 line ++ 2 copy % Copy X & Y ++ moveto ++ (Requesting User: ) RIGHT ++ moveto ++ ({job-originating-user-name}) show + -+ /* -+ * Do some clean up at the end of the LSPP special case -+ */ -+ free(wrapped_label); ++ pageWidth 36 mul % x = pageWidth * 1/2 * 72 ++ pageHeight 36 mul % y = pageHeight * 1/2 * 72 ++ pageHeight -4 mul add % y -= 2 lines ++ 2 copy % Copy X & Y ++ moveto ++ (Billing Info: ) RIGHT ++ moveto ++ ({?job-billing}) show + -+ } -+ else -+ { -+#endif /* !WITH_LSPP */ -+ - /* - * Set the classification + page label string... - */ -@@ -414,7 +550,10 @@ WriteLabelProlog(const char *label, /* I - printf(" %.0f moveto ESPpl show\n", top - 14.0); - puts("pop"); - puts("}bind put"); -+ } -+#ifdef WITH_LSPP - } -+#endif /* WITH_LSPP */ - - - /* ---- cups-1.3.7/data/Makefile.lspp 2007-10-10 23:00:43.000000000 +0100 -+++ cups-1.3.7/data/Makefile 2008-05-30 16:59:10.000000000 +0100 -@@ -25,7 +25,10 @@ BANNERS = \ - secret \ - standard \ - topsecret \ -- unclassified -+ unclassified \ -+ selinux \ -+ mls \ -+ te - - CHARMAPS = \ - euc-cn.txt \ ---- /dev/null 2008-05-30 08:00:32.690000973 +0100 -+++ cups-1.3.7/data/te 2008-05-30 16:59:10.000000000 +0100 ++ % Then the CUPS logo.... ++ gsave ++ pageWidth 4 mul ++ pageWidth 6 mul ++ translate ++ pageWidth 9 mul CUPSLOGO ++ grestore ++ ++ % And the ESP logo.... ++ gsave ++ pageWidth 59 mul ++ pageWidth 6 mul ++ translate ++ pageWidth 6 mul ESPLOGO ++ grestore ++% Show the page... ++grestore ++showpage ++% ++% End of "$Id: mls_template,v 1.1 2005/06/27 18:44:46 colmo Exp $". ++% ++%%EOF +diff -up /dev/null cups-1.3.8/data/te +--- /dev/null 2008-07-28 15:45:57.127000670 +0100 ++++ cups-1.3.8/data/te 2008-07-28 16:37:51.000000000 +0100 @@ -0,0 +1,261 @@ +%!PS-Adobe-3.0 +%%BoundingBox: 0 0 612 792 @@ -1967,632 +1276,1818 @@ + 72 div /pageBottom exch def % Get bottom margin in inches + 72 div /pageLeft exch def % Get left margin in inches + -+ /pageWidth pageRight pageLeft sub def % pageWidth = pageRight - pageLeft -+ /pageHeight pageTop pageBottom sub def% pageHeight = pageTop - pageBottom ++ /pageWidth pageRight pageLeft sub def % pageWidth = pageRight - pageLeft ++ /pageHeight pageTop pageBottom sub def% pageHeight = pageTop - pageBottom ++ ++ /boxWidth % width of text box ++ pageWidth pageHeight lt ++ { pageWidth 54 mul } ++ { pageHeight 42 mul } ++ ifelse def ++ ++ newpath % Clear bounding path ++ ++ % Create fonts... ++ /bigFont /Helvetica-Bold findfont % bigFont = Helvetica-Bold ++ pageHeight 3 mul scalefont def % size = pageHeight * 3 (nominally 33) ++ ++ /mediumFont /Helvetica findfont % mediumFont = Helvetica ++ pageHeight 1.5 mul scalefont def % size = pageHeight * 1.5 (nominally 16.5) ++ ++ % Offset page to account for lower-left margin... ++ pageLeft 72 mul ++ pageBottom 72 mul ++ translate ++ ++ % Job information box... ++ pageWidth 36 mul 9 add % x = pageWidth * 1/2 * 72 + 9 ++ boxWidth 0.5 mul sub % x-= 1/2 box width ++ pageHeight 30 mul 9 sub % y = pageHeight * 1/2 * 72 - 9 ++ boxWidth % w = box width ++ pageHeight 14 mul % h = pageHeight * 1/2 * 72 ++ 0.5 setgray rectfill % Draw a shadow ++ ++ pageWidth 36 mul % x = pageWidth * 1/2 * 72 ++ boxWidth 0.5 mul sub % x-= 1/2 box width ++ pageHeight 30 mul % y = pageHeight * 1/4 * 72 ++ boxWidth % w = box width ++ pageHeight 14 mul % h = pageHeight * 1/2 * 72 ++ ++ 4 copy 1 setgray rectfill % Clear the box to white ++ 0 setgray rectstroke % Draw a black box around it... ++ ++ % Job information text... ++ mediumFont setfont % Medium sized font ++ ++ pageWidth 36 mul % x = pageWidth * 1/2 * 72 ++ pageHeight 36 mul % y = pageHeight * 1/2 * 72 ++ pageHeight 5 mul add % y += 2 lines ++ 2 copy % Copy X & Y ++ moveto ++ (Job ID: ) RIGHT ++ moveto ++ ({printer-name}-{job-id}) show ++ ++ pageWidth 36 mul % x = pageWidth * 1/2 * 72 ++ pageHeight 36 mul % y = pageHeight * 1/2 * 72 ++ pageHeight 2 mul add % y += 1 line ++ 2 copy % Copy X & Y ++ moveto ++ (Title: ) RIGHT ++ moveto ++ ({job-name}) show ++ ++ pageWidth 36 mul % x = pageWidth * 1/2 * 72 ++ pageHeight 36 mul % y = pageHeight * 1/2 * 72 ++ pageHeight -1 mul add % y -= 1 line ++ 2 copy % Copy X & Y ++ moveto ++ (Requesting User: ) RIGHT ++ moveto ++ ({job-originating-user-name}) show ++ ++ pageWidth 36 mul % x = pageWidth * 1/2 * 72 ++ pageHeight 36 mul % y = pageHeight * 1/2 * 72 ++ pageHeight -4 mul add % y -= 2 lines ++ 2 copy % Copy X & Y ++ moveto ++ (Billing Info: ) RIGHT ++ moveto ++ ({?job-billing}) show ++ ++ % Then the CUPS logo.... ++ gsave ++ pageWidth 4 mul ++ pageWidth 6 mul ++ translate ++ pageWidth 9 mul CUPSLOGO ++ grestore ++ ++ % And the ESP logo.... ++ gsave ++ pageWidth 59 mul ++ pageWidth 6 mul ++ translate ++ pageWidth 6 mul ESPLOGO ++ grestore ++% Show the page... ++grestore ++showpage ++% ++% End of "$Id: mls_template,v 1.1 2005/06/27 18:44:46 colmo Exp $". ++% ++%%EOF +diff -up cups-1.3.8/filter/common.c.lspp cups-1.3.8/filter/common.c +--- cups-1.3.8/filter/common.c.lspp 2008-07-11 23:48:49.000000000 +0100 ++++ cups-1.3.8/filter/common.c 2008-07-28 16:37:51.000000000 +0100 +@@ -30,6 +30,12 @@ + * Include necessary headers... + */ + ++#include "config.h" ++#ifdef WITH_LSPP ++#define _GNU_SOURCE ++#include ++#endif /* WITH_LSPP */ ++ + #include "common.h" + #include + +@@ -312,6 +318,18 @@ WriteLabelProlog(const char *label, /* I + { + const char *classification; /* CLASSIFICATION environment variable */ + const char *ptr; /* Temporary string pointer */ ++#ifdef WITH_LSPP ++ int i, /* counter */ ++ n, /* counter */ ++ lines, /* number of lines needed */ ++ line_len, /* index into tmp_label */ ++ label_len, /* length of the label in characters */ ++ label_index, /* index into the label */ ++ longest, /* length of the longest line */ ++ longest_line, /* index to the longest line */ ++ max_width; /* maximum width in characters */ ++ char **wrapped_label; /* label with line breaks */ ++#endif /* WITH_LSPP */ + + + /* +@@ -334,6 +352,124 @@ WriteLabelProlog(const char *label, /* I + return; + } + ++#ifdef WITH_LSPP ++ if (strncmp(classification, "LSPP:", 5) == 0 && label == NULL) ++ { ++ /* ++ * Based on the 12pt fixed width font below determine the max_width ++ */ ++ max_width = width / 8; ++ longest_line = 0; ++ longest = 0; ++ classification += 5; // Skip the "LSPP:" ++ label_len = strlen(classification); ++ ++ if (label_len > max_width) ++ { ++ lines = 1 + (int)(label_len / max_width); ++ line_len = (int)(label_len / lines); ++ wrapped_label = malloc(sizeof(wrapped_label) * lines); ++ label_index = i = n = 0; ++ while (classification[label_index]) ++ { ++ if ((label_index + line_len) > label_len) ++ break; ++ switch (classification[label_index + line_len + i]) ++ { ++ case ':': ++ case ',': ++ case '-': ++ i++; ++ wrapped_label[n++] = strndup(&classification[label_index], (line_len + i)); ++ label_index += line_len + i; ++ i = 0; ++ break; ++ default: ++ i++; ++ break; ++ } ++ if ((i + line_len) == max_width) ++ { ++ wrapped_label[n++] = strndup(&(classification[label_index]), (line_len + i)); ++ label_index = label_index + line_len + i; ++ i = 0; ++ } ++ } ++ wrapped_label[n] = strndup(&classification[label_index], label_len - label_index); ++ } ++ else ++ { ++ lines = 1; ++ wrapped_label = malloc(sizeof(wrapped_label)); ++ wrapped_label[0] = (char*)classification; ++ } ++ ++ for (n = 0; n < lines; n++ ) ++ { ++ printf("userdict/ESPp%c(", ('a' + n)); ++ for (ptr = wrapped_label[n], i = 0; *ptr; ptr ++, i++) ++ if (*ptr < 32 || *ptr > 126) ++ printf("\\%03o", *ptr); ++ else ++ { ++ if (*ptr == '(' || *ptr == ')' || *ptr == '\\') ++ putchar('\\'); + -+ /boxWidth % width of text box -+ pageWidth pageHeight lt -+ { pageWidth 54 mul } -+ { pageHeight 42 mul } -+ ifelse def ++ printf("%c", *ptr); ++ } ++ if (i > longest) ++ { ++ longest = i; ++ longest_line = n; ++ } ++ printf(")put\n"); ++ } + -+ newpath % Clear bounding path ++ /* ++ * For LSPP use a fixed width font so that line wrapping can be calculated ++ */ + -+ % Create fonts... -+ /bigFont /Helvetica-Bold findfont % bigFont = Helvetica-Bold -+ pageHeight 3 mul scalefont def % size = pageHeight * 3 (nominally 33) ++ puts("userdict/ESPlf /Nimbus-Mono findfont 12 scalefont put"); + -+ /mediumFont /Helvetica findfont % mediumFont = Helvetica -+ pageHeight 1.5 mul scalefont def % size = pageHeight * 1.5 (nominally 16.5) ++ /* ++ * Finally, the procedure to write the labels on the page... ++ */ + -+ % Offset page to account for lower-left margin... -+ pageLeft 72 mul -+ pageBottom 72 mul -+ translate ++ printf("userdict/ESPwl{\n" ++ " ESPlf setfont\n"); ++ printf(" ESPp%c stringwidth pop dup 12 add exch -0.5 mul %.0f add\n ", ++ 'a' + longest_line, width * 0.5f); ++ for (n = 1; n < lines; n++) ++ printf(" dup"); ++ printf("\n 1 setgray\n"); ++ printf(" dup 6 sub %.0f %d index %.0f ESPrf\n", ++ (bottom - 2.0), (2 + lines), 6.0 + (16.0 * lines)); ++ printf(" dup 6 sub %.0f %d index %.0f ESPrf\n", ++ (top - 6.0 - (16.0 * lines)), (2 + lines), 4.0 + (16.0 * lines)); ++ printf(" 0 setgray\n"); ++ printf(" dup 6 sub %.0f %d index %.0f ESPrs\n", ++ (bottom - 2.0), (2 + lines), 6.0 + (16.0 * lines)); ++ printf(" dup 6 sub %.0f %d index %.0f ESPrs\n", ++ (top - 6.0 - (16.0 * lines)), (2 + lines), 4.0 + (16.0 * lines)); ++ for (n = 0; n < lines; n ++) ++ { ++ printf(" dup %.0f moveto ESPp%c show\n", ++ bottom + 6.0 + ((lines - (n+1)) * 16.0), 'a' + n); ++ printf(" %.0f moveto ESPp%c show\n", top + 2.0 - ((n + 1) * 16.0), 'a' + n); ++ } ++ printf(" pop\n" ++ "}bind put\n"); + -+ % Job information box... -+ pageWidth 36 mul 9 add % x = pageWidth * 1/2 * 72 + 9 -+ boxWidth 0.5 mul sub % x-= 1/2 box width -+ pageHeight 30 mul 9 sub % y = pageHeight * 1/2 * 72 - 9 -+ boxWidth % w = box width -+ pageHeight 14 mul % h = pageHeight * 1/2 * 72 -+ 0.5 setgray rectfill % Draw a shadow ++ /* ++ * Do some clean up at the end of the LSPP special case ++ */ ++ free(wrapped_label); + -+ pageWidth 36 mul % x = pageWidth * 1/2 * 72 -+ boxWidth 0.5 mul sub % x-= 1/2 box width -+ pageHeight 30 mul % y = pageHeight * 1/4 * 72 -+ boxWidth % w = box width -+ pageHeight 14 mul % h = pageHeight * 1/2 * 72 ++ } ++ else ++ { ++#endif /* !WITH_LSPP */ ++ + /* + * Set the classification + page label string... + */ +@@ -414,7 +550,10 @@ WriteLabelProlog(const char *label, /* I + printf(" %.0f moveto ESPpl show\n", top - 14.0); + puts("pop"); + puts("}bind put"); ++ } ++#ifdef WITH_LSPP + } ++#endif /* WITH_LSPP */ + + + /* +diff -up cups-1.3.8/Makedefs.in.lspp cups-1.3.8/Makedefs.in +--- cups-1.3.8/Makedefs.in.lspp 2008-01-22 22:37:21.000000000 +0000 ++++ cups-1.3.8/Makedefs.in 2008-07-28 16:37:51.000000000 +0100 +@@ -134,7 +134,7 @@ LIBCUPSORDER = @LIBCUPSORDER@ + LIBCUPSIMAGEORDER = @LIBCUPSIMAGEORDER@ + LINKCUPS = @LINKCUPS@ $(SSLLIBS) + LINKCUPSIMAGE = @LINKCUPSIMAGE@ +-LIBS = $(LINKCUPS) $(COMMONLIBS) ++LIBS = $(LINKCUPS) $(COMMONLIBS) @LIBAUDIT@ @LIBSELINUX@ + OPTIM = @OPTIM@ + OPTIONS = + PAMLIBS = @PAMLIBS@ +diff -up cups-1.3.8/scheduler/client.c.lspp cups-1.3.8/scheduler/client.c +--- cups-1.3.8/scheduler/client.c.lspp 2008-07-11 23:48:49.000000000 +0100 ++++ cups-1.3.8/scheduler/client.c 2008-07-28 16:37:51.000000000 +0100 +@@ -39,12 +39,14 @@ + * pipe_command() - Pipe the output of a command to the remote client. + * write_file() - Send a file via HTTP. + * write_pipe() - Flag that data is available on the CGI pipe. ++ * client_pid_to_auid() - Get the audit login uid of the client. + */ + + /* + * Include necessary headers... + */ + ++#define _GNU_SOURCE + #include + #include "cupsd.h" + +@@ -76,6 +78,12 @@ extern const char *cssmErrorString(int e + # include + #endif /* HAVE_GNUTLS */ + ++#ifdef WITH_LSPP ++#include ++#include ++#include ++#endif /* WITH_LSPP */ + -+ 4 copy 1 setgray rectfill % Clear the box to white -+ 0 setgray rectstroke % Draw a black box around it... + + /* + * Local functions... +@@ -349,6 +357,57 @@ cupsdAcceptClient(cupsd_listener_t *lis) + } + } + ++#ifdef WITH_LSPP ++ if (is_lspp_config()) ++ { ++ struct ucred cr; ++ unsigned int cl=sizeof(cr); + -+ % Job information text... -+ mediumFont setfont % Medium sized font ++ if (getsockopt(con->http.fd, SOL_SOCKET, SO_PEERCRED, &cr, &cl) == 0) ++ { ++ /* ++ * client_pid_to_auid() can be racey ++ * In this case the pid is based on a socket connected to the client ++ */ ++ if ((con->auid = client_pid_to_auid(cr.pid)) == -1) ++ { ++ close(con->http.fd); ++ cupsdLogMessage(CUPSD_LOG_ERROR, "cupsdAcceptClient: " ++ "unable to determine client auid for client pid=%d", cr.pid); ++ free(con); ++ return; ++ } ++ cupsdLogMessage(CUPSD_LOG_INFO, "cupsdAcceptClient: peer's pid=%d, uid=%d, gid=%d, auid=%d", ++ cr.pid, cr.uid, cr.gid, con->auid); ++ } ++ else ++ { ++ close(con->http.fd); ++ cupsdLogMessage(CUPSD_LOG_ERROR, "cupsdAcceptClient: getsockopt() failed"); ++ free(con); ++ return; ++ } + -+ pageWidth 36 mul % x = pageWidth * 1/2 * 72 -+ pageHeight 36 mul % y = pageHeight * 1/2 * 72 -+ pageHeight 5 mul add % y += 2 lines -+ 2 copy % Copy X & Y -+ moveto -+ (Job ID: ) RIGHT -+ moveto -+ ({printer-name}-{job-id}) show ++ /* ++ * get the context of the peer connection ++ */ ++ if (getpeercon(con->http.fd, &con->scon)) ++ { ++ close(con->http.fd); ++ cupsdLogMessage(CUPSD_LOG_ERROR, "cupsdAcceptClient: getpeercon() failed"); ++ free(con); ++ return; ++ } + -+ pageWidth 36 mul % x = pageWidth * 1/2 * 72 -+ pageHeight 36 mul % y = pageHeight * 1/2 * 72 -+ pageHeight 2 mul add % y += 1 line -+ 2 copy % Copy X & Y -+ moveto -+ (Title: ) RIGHT -+ moveto -+ ({job-name}) show ++ cupsdLogMessage(CUPSD_LOG_INFO, "cupsdAcceptClient: client context=%s", con->scon); ++ } ++ else ++ { ++ cupsdLogMessage(CUPSD_LOG_DEBUG, "cupsdAcceptClient: skipping getpeercon()"); ++ cupsdSetString(&con->scon, UNKNOWN_SL); ++ } ++#endif /* WITH_LSPP */ + -+ pageWidth 36 mul % x = pageWidth * 1/2 * 72 -+ pageHeight 36 mul % y = pageHeight * 1/2 * 72 -+ pageHeight -1 mul add % y -= 1 line -+ 2 copy % Copy X & Y -+ moveto -+ (Requesting User: ) RIGHT -+ moveto -+ ({job-originating-user-name}) show + #ifdef AF_INET6 + if (con->http.hostaddr->addr.sa_family == AF_INET6) + cupsdLogMessage(CUPSD_LOG_DEBUG, "cupsdAcceptClient: %d from %s:%d (IPv6)", +@@ -731,6 +790,13 @@ cupsdReadClient(cupsd_client_t *con) /* + mime_type_t *type; /* MIME type of file */ + cupsd_printer_t *p; /* Printer */ + static unsigned request_id = 0; /* Request ID for temp files */ ++#ifdef WITH_LSPP ++ security_context_t spoolcon; /* context of the job file */ ++ context_t clicon; /* contex_t container for con->scon */ ++ context_t tmpcon; /* temp context to swap the level */ ++ char *clirange; /* SELinux sensitivity range */ ++ char *cliclearance; /* SELinux low end clearance */ ++#endif /* WITH_LSPP */ + + + status = HTTP_CONTINUE; +@@ -2016,6 +2082,67 @@ cupsdReadClient(cupsd_client_t *con) /* + fchmod(con->file, 0640); + fchown(con->file, RunUser, Group); + fcntl(con->file, F_SETFD, fcntl(con->file, F_GETFD) | FD_CLOEXEC); ++#ifdef WITH_LSPP ++ if (strncmp(con->scon, UNKNOWN_SL, strlen(UNKNOWN_SL)) != 0) ++ { ++ if (getfilecon(con->filename, &spoolcon) == -1) ++ { ++ cupsdSendError(con, HTTP_SERVER_ERROR, CUPSD_AUTH_NONE); ++ return (cupsdCloseClient(con)); ++ } ++ clicon = context_new(con->scon); ++ tmpcon = context_new(spoolcon); ++ freecon(spoolcon); ++ if (!clicon || !tmpcon) ++ { ++ cupsdSendError(con, HTTP_SERVER_ERROR, CUPSD_AUTH_NONE); ++ if (clicon) ++ context_free(clicon); ++ if (tmpcon) ++ context_free(tmpcon); ++ return (cupsdCloseClient(con)); ++ } ++ clirange = context_range_get(clicon); ++ if (clirange) ++ { ++ clirange = strdup(clirange); ++ if ((cliclearance = strtok(clirange, "-")) != NULL) ++ { ++ if (context_range_set(tmpcon, cliclearance) == -1) ++ { ++ cupsdSendError(con, HTTP_SERVER_ERROR, CUPSD_AUTH_NONE); ++ free(clirange); ++ context_free(tmpcon); ++ context_free(clicon); ++ return (cupsdCloseClient(con)); ++ } ++ } ++ else ++ { ++ if (context_range_set(tmpcon, (context_range_get(clicon))) == -1) ++ { ++ cupsdSendError(con, HTTP_SERVER_ERROR, CUPSD_AUTH_NONE); ++ free(clirange); ++ context_free(tmpcon); ++ context_free(clicon); ++ return (cupsdCloseClient(con)); ++ } ++ } ++ free(clirange); ++ } ++ if (setfilecon(con->filename, context_str(tmpcon)) == -1) ++ { ++ cupsdSendError(con, HTTP_SERVER_ERROR, CUPSD_AUTH_NONE); ++ context_free(tmpcon); ++ context_free(clicon); ++ return (cupsdCloseClient(con)); ++ } ++ cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdReadClient: %s set to %s", ++ con->filename, context_str(tmpcon)); ++ context_free(tmpcon); ++ context_free(clicon); ++ } ++#endif /* WITH_LSPP */ + } + + if (con->http.state != HTTP_POST_SEND) +@@ -4255,6 +4382,50 @@ make_certificate(cupsd_client_t *con) /* + #endif /* HAVE_SSL */ + + ++#ifdef WITH_LSPP ++/* ++ * 'client_pid_to_auid()' - Using the client's pid, read /proc and determine the loginuid. ++ */ + -+ pageWidth 36 mul % x = pageWidth * 1/2 * 72 -+ pageHeight 36 mul % y = pageHeight * 1/2 * 72 -+ pageHeight -4 mul add % y -= 2 lines -+ 2 copy % Copy X & Y -+ moveto -+ (Billing Info: ) RIGHT -+ moveto -+ ({?job-billing}) show ++uid_t client_pid_to_auid(pid_t clipid) ++{ ++ uid_t uid; ++ int len, in; ++ char buf[16] = {0}; ++ char fname[32] = {0}; + -+ % Then the CUPS logo.... -+ gsave -+ pageWidth 4 mul -+ pageWidth 6 mul -+ translate -+ pageWidth 9 mul CUPSLOGO -+ grestore + -+ % And the ESP logo.... -+ gsave -+ pageWidth 59 mul -+ pageWidth 6 mul -+ translate -+ pageWidth 6 mul ESPLOGO -+ grestore -+% Show the page... -+grestore -+showpage -+% -+% End of "$Id: mls_template,v 1.1 2005/06/27 18:44:46 colmo Exp $". -+% -+%%EOF ---- /dev/null 2008-05-30 08:00:32.690000973 +0100 -+++ cups-1.3.7/data/selinux 2008-05-30 16:59:10.000000000 +0100 -@@ -0,0 +1,261 @@ -+%!PS-Adobe-3.0 -+%%BoundingBox: 0 0 612 792 -+%%Pages: 1 -+%%LanguageLevel: 1 -+%%DocumentData: Clean7Bit -+%%DocumentSuppliedResources: procset bannerprint/1.0 -+%%DocumentNeededResources: font Helvetica Helvetica-Bold Times-Roman -+%%Creator: Michael Sweet, Easy Software Products -+%%CreationDate: May 10, 2000 -+%%Title: Test Page -+%%EndComments -+%%BeginProlog -+%%BeginResource procset bannerprint 1.1 0 -+% -+% PostScript banner page for the Common UNIX Printing System ("CUPS"). -+% -+% Copyright 1993-2005 by Easy Software Products -+% -+% These coded instructions, statements, and computer programs are the -+% property of Easy Software Products and are protected by Federal -+% copyright law. Distribution and use rights are outlined in the file -+% "LICENSE.txt" which should have been included with this file. If this -+% file is missing or damaged please contact Easy Software Products -+% at: -+% -+% Attn: CUPS Licensing Information -+% Easy Software Products -+% 44141 Airport View Drive, Suite 204 -+% Hollywood, Maryland 20636 USA -+% -+% Voice: (301) 373-9600 -+% EMail: cups-info@cups.org -+% WWW: http://www.cups.org -+% -+/CENTER { % Draw centered text -+ % (name) CENTER - -+ dup stringwidth pop % Get the width of the string -+ 0.5 mul neg 0 rmoveto % Shift left 1/2 of the distance -+ show % Show the string -+} bind def -+/RIGHT { % Draw right-justified text -+ % (name) RIGHT - -+ dup stringwidth pop % Get the width of the string -+ neg 0 rmoveto % Shift left the entire distance -+ show % Show the string -+} bind def -+/NUMBER { % Draw a number -+ % power n NUMBER - -+ 1 index 1 eq { % power == 1? -+ round cvi exch pop % Convert "n" to integer -+ } { -+ 1 index mul round exch div % Truncate extra decimal places -+ } ifelse -+ 100 string cvs show % Convert to a string and show it... -+} bind def -+/CUPSLOGO { % Draw the CUPS logo -+ % height CUPSLOGO -+ % Start with a big C... -+ /Helvetica findfont 1 index scalefont setfont -+ 0 setgray -+ 0 0 moveto -+ (C) show ++ /* ++ * Hopefully this pid is still the one we are interested in. ++ */ ++ snprintf(fname, 32, "/proc/%d/loginuid", clipid); ++ in = open(fname, O_NOFOLLOW|O_RDONLY); + -+ % Then "UNIX Printing System" much smaller... -+ /Helvetica-Bold findfont 1 index 9 div scalefont setfont -+ 0.25 mul -+ dup dup 2.0 mul moveto -+ (UNIX) show -+ dup dup 1.6 mul moveto -+ (Printing) show -+ dup 1.2 mul moveto -+ (System) show -+} bind def -+/ESPLOGO { % Draw the ESP logo -+ % height ESPLOGO -+ % Compute the size of the logo... -+ 0 0 -+ 2 index 1.5 mul 3 index ++ if (in < 0) ++ return -1; + -+ % Do the "metallic" fill from 10% black to 40% black... -+ 1 -0.001 0 { -+ dup % loopval -+ -0.15 mul % loopval * -0.15 -+ 0.9 add % 0.9 - loopval * 0.15 -+ setgray % set gray shade ++ errno = 0; + -+ 0 % x -+ 1 index neg % loopval -+ 1 add % 1 - loopval -+ 3 index % height -+ mul % height * (1 - loopval) -+ moveto % starting point ++ do { ++ len = read(in, buf, sizeof(buf)); ++ } while (len < 0 && errno == EINTR); + -+ dup % loopval -+ 3 index % width -+ mul % loopval * width -+ 2 index % height -+ lineto % Next point ++ close(in); + -+ 0 % x -+ 2 index % height -+ lineto % Next point ++ if (len < 0 || len >= sizeof(buf)) ++ return -1; + -+ closepath -+ fill ++ errno = 0; ++ buf[len] = 0; ++ uid = strtol(buf, 0, 10); + -+ dup % loopval -+ 0.15 mul % loopval * 0.15 -+ 0.6 add % 0.6 + loopval * 0.15 -+ setgray ++ if (errno != 0) ++ return -1; ++ else ++ return uid; ++} ++#endif /* WITH_LSPP */ + -+ dup % loopval -+ neg 1 add % 1 - loopval -+ 3 index % width -+ mul % (1 - loopval) * width -+ 0 % y -+ moveto % Starting point + /* + * 'pipe_command()' - Pipe the output of a command to the remote client. + */ +diff -up cups-1.3.8/scheduler/client.h.lspp cups-1.3.8/scheduler/client.h +--- cups-1.3.8/scheduler/client.h.lspp 2007-10-22 19:52:13.000000000 +0100 ++++ cups-1.3.8/scheduler/client.h 2008-07-28 16:37:51.000000000 +0100 +@@ -17,6 +17,13 @@ + # include + #endif /* HAVE_AUTHORIZATION_H */ + ++/* Copyright (C) 2005 Trusted Computer Solutions, Inc. */ ++/* (c) Copyright 2005-2006 Hewlett-Packard Development Company, L.P. */ + -+ 2 index % width -+ exch % loopval -+ 2 index % height -+ mul % loopval * height -+ lineto % Next point ++#ifdef WITH_LSPP ++#include ++#endif /* WITH_LSPP */ + -+ 1 index % width -+ 0 % y -+ lineto % Next point + /* + * HTTP client structure... + */ +@@ -62,6 +69,10 @@ struct cupsd_client_s + #ifdef HAVE_AUTHORIZATION_H + AuthorizationRef authref; /* Authorization ref */ + #endif /* HAVE_AUTHORIZATION_H */ ++#ifdef WITH_LSPP ++ security_context_t scon; /* Security context of connection */ ++ uid_t auid; /* Audit loginuid of the client */ ++#endif /* WITH_LSPP */ + }; + + #define HTTP(con) &((con)->http) +@@ -129,6 +140,9 @@ extern void cupsdStartListening(void); + extern void cupsdStopListening(void); + extern void cupsdUpdateCGI(void); + extern void cupsdWriteClient(cupsd_client_t *con); ++#ifdef WITH_LSPP ++extern uid_t client_pid_to_auid(pid_t clipid); ++#endif /* WITH_LSPP */ + + + /* +diff -up cups-1.3.8/scheduler/conf.c.lspp cups-1.3.8/scheduler/conf.c +--- cups-1.3.8/scheduler/conf.c.lspp 2008-07-28 16:37:51.000000000 +0100 ++++ cups-1.3.8/scheduler/conf.c 2008-07-28 16:37:51.000000000 +0100 +@@ -26,6 +26,7 @@ + * read_configuration() - Read a configuration file. + * read_location() - Read a definition. + * read_policy() - Read a definition. ++ * is_lspp_config() - Is the system configured for LSPP + */ + + /* +@@ -47,6 +48,9 @@ + # define INADDR_NONE 0xffffffff + #endif /* !INADDR_NONE */ + ++#ifdef WITH_LSPP ++# include ++#endif /* WITH_LSPP */ + + /* + * Configuration variable structure... +@@ -160,6 +164,10 @@ static const cupsd_var_t variables[] = + # if defined(HAVE_LIBSSL) || defined(HAVE_GNUTLS) + { "ServerKey", &ServerKey, CUPSD_VARTYPE_PATHNAME }, + # endif /* HAVE_LIBSSL || HAVE_GNUTLS */ ++#ifdef WITH_LSPP ++ { "AuditLog", &AuditLog, CUPSD_VARTYPE_INTEGER }, ++ { "PerPageLabels", &PerPageLabels, CUPSD_VARTYPE_BOOLEAN }, ++#endif /* WITH_LSPP */ + #endif /* HAVE_SSL */ + { "ServerName", &ServerName, CUPSD_VARTYPE_STRING }, + { "ServerRoot", &ServerRoot, CUPSD_VARTYPE_PATHNAME }, +@@ -350,6 +358,9 @@ cupsdReadConfiguration(void) + *old_requestroot; /* Old RequestRoot */ + const char *tmpdir; /* TMPDIR environment variable */ + struct stat tmpinfo; /* Temporary directory info */ ++#ifdef WITH_LSPP ++ char *audit_message; /* Audit message string */ ++#endif /* WITH_LSPP */ + + + /* +@@ -611,6 +622,25 @@ cupsdReadConfiguration(void) + + RunUser = getuid(); + ++#ifdef WITH_LSPP ++ if (AuditLog != -1) ++ { ++ /* ++ * ClassifyOverride is set during read_configuration, if its ON, report it now ++ */ ++ if (ClassifyOverride) ++ audit_log_user_message(AuditLog, AUDIT_USYS_CONFIG, ++ "[Config] ClassifyOverride=enabled Users can override print banners", ++ ServerName, NULL, NULL, 1); ++ /* ++ * PerPageLabel is set during read_configuration, if its OFF, report it now ++ */ ++ if (!PerPageLabels) ++ audit_log_user_message(AuditLog, AUDIT_USYS_CONFIG, ++ "[Config] PerPageLabels=disabled", ServerName, NULL, NULL, 1); ++ } ++#endif /* WITH_LSPP */ + -+ closepath -+ fill -+ } for + /* + * See if the ServerName is an IP address... + */ +@@ -889,11 +919,23 @@ cupsdReadConfiguration(void) + if (MaxActiveJobs > (MaxFDs / 3)) + MaxActiveJobs = MaxFDs / 3; + +- if (Classification && !strcasecmp(Classification, "none")) ++ if (Classification && strcasecmp(Classification, "none") == 0) + cupsdClearString(&Classification); + + if (Classification) ++ { + cupsdLogMessage(CUPSD_LOG_INFO, "Security set to \"%s\"", Classification); ++#ifdef WITH_LSPP ++ if (AuditLog != -1) ++ { ++ audit_message = NULL; ++ cupsdSetStringf(&audit_message, "[Config] Classification=%s", Classification); ++ audit_log_user_message(AuditLog, AUDIT_LABEL_LEVEL_CHANGE, audit_message, ++ ServerName, NULL, NULL, 1); ++ cupsdClearString(&audit_message); ++ } ++#endif /* WITH_LSPP */ ++ } + + /* + * Update the MaxClientsPerHost value, as needed... +@@ -3360,6 +3402,18 @@ read_policy(cups_file_t *fp, /* I - Con + return (0); + } + ++#ifdef WITH_LSPP ++int is_lspp_config() ++{ ++ if (Classification != NULL) ++ return ((strcasecmp(Classification, MLS_CONFIG) == 0) ++ || (strcasecmp(Classification, TE_CONFIG) == 0) ++ || (strcasecmp(Classification, SELINUX_CONFIG) == 0)); ++ else ++ return 0; ++} ++#endif /* WITH_LSPP */ + -+ 0 setgray rectstroke + + /* + * End of "$Id: conf.c 7648 2008-06-16 17:41:11Z mike $". +diff -up cups-1.3.8/scheduler/conf.h.lspp cups-1.3.8/scheduler/conf.h +--- cups-1.3.8/scheduler/conf.h.lspp 2008-07-28 16:37:51.000000000 +0100 ++++ cups-1.3.8/scheduler/conf.h 2008-07-28 16:37:51.000000000 +0100 +@@ -193,6 +193,12 @@ VAR char *ServerKey VALUE(NULL); + /* Server key file */ + # endif /* HAVE_LIBSSL || HAVE_GNUTLS */ + #endif /* HAVE_SSL */ ++#ifdef WITH_LSPP ++VAR int AuditLog VALUE(-1), ++ /* File descriptor for audit */ ++ PerPageLabels VALUE(TRUE); ++ /* Put the label on each page */ ++#endif /* WITH_LSPP */ + + #ifdef HAVE_LAUNCHD + VAR int LaunchdTimeout VALUE(DEFAULT_TIMEOUT); +@@ -211,6 +217,9 @@ VAR char *SystemGroupAuthKey VALUE(NULL + /* System group auth key */ + #endif /* HAVE_AUTHORIZATION_H */ + ++#ifdef WITH_LSPP ++extern int is_lspp_config(void); ++#endif /* WITH_LSPP */ + + /* + * Prototypes... +diff -up cups-1.3.8/scheduler/ipp.c.lspp cups-1.3.8/scheduler/ipp.c +--- cups-1.3.8/scheduler/ipp.c.lspp 2008-07-28 16:37:51.000000000 +0100 ++++ cups-1.3.8/scheduler/ipp.c 2008-07-28 16:39:08.000000000 +0100 +@@ -36,6 +36,7 @@ + * cancel_all_jobs() - Cancel all print jobs. + * cancel_job() - Cancel a print job. + * cancel_subscription() - Cancel a subscription. ++ * check_context() - Check the SELinux context for a user and job + * check_quotas() - Check quotas for a printer and user. + * check_rss_recipient() - Check that we do not have a duplicate RSS + * feed URI. +@@ -95,6 +96,9 @@ + * validate_user() - Validate the user for the request. + */ + ++/* Copyright (C) 2005 Trusted Computer Solutions, Inc. */ ++/* (c) Copyright 2005-2006 Hewlett-Packard Development Company, L.P. */ + -+ /Helvetica-BoldOblique findfont 1 index 3 div scalefont setfont -+ dup 40 div + /* + * Include necessary headers... + */ +@@ -118,6 +122,14 @@ extern int mbr_check_membership_by_id(uu + # endif /* HAVE_MEMBERSHIPPRIV_H */ + #endif /* __APPLE__ */ + ++#ifdef WITH_LSPP ++#include ++#include ++#include ++#include ++#include ++#include ++#endif /* WITH_LSPP */ + + /* + * Local functions... +@@ -143,6 +155,9 @@ static void cancel_all_jobs(cupsd_client + static void cancel_job(cupsd_client_t *con, ipp_attribute_t *uri); + static void cancel_subscription(cupsd_client_t *con, int id); + static int check_rss_recipient(const char *recipient); ++#ifdef WITH_LSPP ++static int check_context(cupsd_client_t *con, cupsd_job_t *job); ++#endif /* WITH_LSPP */ + static int check_quotas(cupsd_client_t *con, cupsd_printer_t *p); + static ipp_attribute_t *copy_attribute(ipp_t *to, ipp_attribute_t *attr, + int quickcopy); +@@ -1270,6 +1285,21 @@ add_job(cupsd_client_t *con, /* I - Cl + int kbytes; /* Size of print file */ + int i; /* Looping var */ + int lowerpagerange; /* Page range bound */ ++#ifdef WITH_LSPP ++ char *audit_message; /* Audit message string */ ++ char *printerfile; /* device file pointed to by the printer */ ++ char *userheader = NULL; /* User supplied job-sheets[0] */ ++ char *userfooter = NULL; /* User supplied job-sheets[1] */ ++ int override = 0; /* Was a banner overrode on a job */ ++ security_id_t clisid; /* SELinux SID for the client */ ++ security_id_t psid; /* SELinux SID for the printer */ ++ context_t printercon; /* Printer's context string */ ++ struct stat printerstat; /* Printer's stat buffer */ ++ security_context_t devcon; /* Printer's SELinux context */ ++ struct avc_entry_ref avcref; /* Pointer to the access vector cache */ ++ security_class_t tclass; /* Object class for the SELinux check */ ++ access_vector_t avr; /* Access method being requested */ ++#endif /* WITH_LSPP */ + + + cupsdLogMessage(CUPSD_LOG_DEBUG2, "add_job(%p[%d], %p(%s), %p(%s/%s))", +@@ -1486,6 +1516,104 @@ add_job(cupsd_client_t *con, /* I - Cl + ippAddString(con->request, IPP_TAG_JOB, IPP_TAG_NAME, "job-name", NULL, + title = "Untitled"); + ++#ifdef WITH_LSPP ++ if (is_lspp_config()) ++ { ++ if (!con->scon || strncmp(con->scon, UNKNOWN_SL, strlen(UNKNOWN_SL)) == 0) ++ { ++ cupsdLogMessage(CUPSD_LOG_ERROR, "add_job: missing classification for connection \'%s\'!", printer->name); ++ send_ipp_status(con, IPP_INTERNAL_ERROR, _("Missing required security attributes.")); ++ return (NULL); ++ } + -+ dup 4 mul 1 index 25 mul moveto (E) show -+ dup 10 mul 1 index 15 mul moveto (S) show -+ dup 16 mul 1 index 5 mul moveto (P) show ++ /* ++ * Perform an access check so that if the user gets feedback at enqueue time ++ */ + -+ /Helvetica-BoldOblique findfont 2 index 5 div scalefont setfont -+ dup 14 mul 1 index 29 mul moveto (asy) show -+ dup 20 mul 1 index 19 mul moveto (oftware) show -+ dup 26 mul 1 index 9 mul moveto (roducts) show ++ printerfile = strstr(printer->device_uri, "/dev/"); ++ if (printerfile == NULL && (strncmp(printer->device_uri, "file:/", 6) == 0)) ++ printerfile = strdup(printer->device_uri + strlen("file:/")); ++ ++ if (printerfile != NULL) ++ { ++ cupsdLogMessage(CUPSD_LOG_DEBUG, "add_job: Attempting an access check on printer device %s", ++ printerfile); + -+ pop -+} bind def -+%%EndResource -+%%EndProlog -+%%Page: 1 1 -+gsave ++ if (lstat(printerfile, &printerstat) < 0) ++ { ++ if (errno != ENOENT) ++ { ++ send_ipp_status(con, IPP_NOT_AUTHORIZED, _("Unable to stat the printer")); ++ return (NULL); ++ } ++ /* ++ * The printer does not exist, so for now assume it's a FileDevice ++ */ ++ tclass = SECCLASS_FILE; ++ avr = FILE__WRITE; ++ } ++ else if (S_ISCHR(printerstat.st_mode)) ++ { ++ tclass = SECCLASS_CHR_FILE; ++ avr = CHR_FILE__WRITE; ++ } ++ else if (S_ISREG(printerstat.st_mode)) ++ { ++ tclass = SECCLASS_FILE; ++ avr = FILE__WRITE; ++ } ++ else ++ { ++ send_ipp_status(con, IPP_NOT_AUTHORIZED, _("Printer is not a character device or regular file")); ++ return (NULL); ++ } ++ avc_init("cupsd_enqueue_", NULL, NULL, NULL, NULL); ++ avc_entry_ref_init(&avcref); ++ if (avc_context_to_sid(con->scon, &clisid) != 0) ++ { ++ send_ipp_status(con, IPP_NOT_AUTHORIZED, _("Unable to get the SELinux sid of the client")); ++ return (NULL); ++ } ++ if (getfilecon(printerfile, &devcon) == -1) ++ { ++ send_ipp_status(con, IPP_NOT_AUTHORIZED, _("Unable to get the SELinux context of the printer")); ++ return (NULL); ++ } ++ printercon = context_new(devcon); ++ cupsdLogMessage(CUPSD_LOG_DEBUG, "add_job: printer context %s client context %s", ++ context_str(printercon), con->scon); ++ context_free(printercon); + -+ % Determine the imageable area and device resolution... -+ initclip newpath clippath pathbbox % Get bounding rectangle -+ 72 div /pageTop exch def % Get top margin in inches -+ 72 div /pageRight exch def % Get right margin in inches -+ 72 div /pageBottom exch def % Get bottom margin in inches -+ 72 div /pageLeft exch def % Get left margin in inches ++ if (avc_context_to_sid(devcon, &psid) != 0) ++ { ++ send_ipp_status(con, IPP_NOT_AUTHORIZED, _("Unable to get the SELinux sid of the printer")); ++ freecon(devcon); ++ return (NULL); ++ } ++ freecon(devcon); ++ if (avc_has_perm(clisid, psid, tclass, avr, &avcref, NULL) != 0) ++ { ++ /* ++ * The access check failed, so cancel the job and send an audit message ++ */ ++ if (AuditLog != -1) ++ { ++ audit_message = NULL; ++ cupsdSetStringf(&audit_message, "job=? auid=%u acct=%s obj=%s refused" ++ " unable to access printer=%s", con->auid, ++ con->username, con->scon, printer->name); ++ audit_log_user_message(AuditLog, AUDIT_USER_LABELED_EXPORT, audit_message, ++ ServerName, NULL, NULL, 0); ++ cupsdClearString(&audit_message); ++ } + -+ /pageWidth pageRight pageLeft sub def % pageWidth = pageRight - pageLeft -+ /pageHeight pageTop pageBottom sub def% pageHeight = pageTop - pageBottom ++ send_ipp_status(con, IPP_NOT_AUTHORIZED, _("SELinux prohibits access to the printer")); ++ return (NULL); ++ } ++ } ++ } ++#endif /* WITH_LSPP */ + -+ /boxWidth % width of text box -+ pageWidth pageHeight lt -+ { pageWidth 54 mul } -+ { pageHeight 42 mul } -+ ifelse def + if ((job = cupsdAddJob(priority, printer->name)) == NULL) + { + send_ipp_status(con, IPP_INTERNAL_ERROR, +@@ -1494,6 +1622,32 @@ add_job(cupsd_client_t *con, /* I - Cl + return (NULL); + } + ++#ifdef WITH_LSPP ++ if (is_lspp_config()) ++ { ++ /* ++ * duplicate the security context and auid of the connection into the job structure ++ */ ++ job->scon = strdup(con->scon); ++ job->auid = con->auid; + -+ newpath % Clear bounding path ++ /* ++ * add the security context to the request so that on a restart the security ++ * attributes will be able to be restored ++ */ ++ ippAddString(con->request, IPP_TAG_JOB, IPP_TAG_NAME, "security-context", ++ NULL, job->scon); ++ } ++ else ++ { ++ /* ++ * Fill in the security context of the job as unlabeled ++ */ ++ cupsdLogMessage(CUPSD_LOG_DEBUG, "add_job: setting context of job to %s", UNKNOWN_SL); ++ cupsdSetString(&job->scon, UNKNOWN_SL); ++ } ++#endif /* WITH_LSPP */ + -+ % Create fonts... -+ /bigFont /Helvetica-Bold findfont % bigFont = Helvetica-Bold -+ pageHeight 3 mul scalefont def % size = pageHeight * 3 (nominally 33) + job->dtype = printer->type & (CUPS_PRINTER_CLASS | CUPS_PRINTER_IMPLICIT | + CUPS_PRINTER_REMOTE); + job->attrs = con->request; +@@ -1699,6 +1853,29 @@ add_job(cupsd_client_t *con, /* I - Cl + attr->values[0].string.text = _cupsStrAlloc(printer->job_sheets[0]); + attr->values[1].string.text = _cupsStrAlloc(printer->job_sheets[1]); + } ++#ifdef WITH_LSPP ++ else ++ { ++ /* ++ * The option was present, so capture the user supplied strings ++ */ ++ userheader = strdup(attr->values[0].string.text); + -+ /mediumFont /Helvetica findfont % mediumFont = Helvetica -+ pageHeight 1.5 mul scalefont def % size = pageHeight * 1.5 (nominally 16.5) ++ if (attr->num_values > 1) ++ userfooter = strdup(attr->values[1].string.text); ++ ++ if (Classification != NULL && (strcmp(userheader, Classification) == 0) ++ && userfooter &&(strcmp(userfooter, Classification) == 0)) ++ { ++ /* ++ * Since both values are Classification, the user is not trying to Override ++ */ ++ free(userheader); ++ if (userfooter) free(userfooter); ++ userheader = userfooter = NULL; ++ } ++ } ++#endif /* WITH_LSPP */ + + job->job_sheets = attr; + +@@ -1729,6 +1906,9 @@ add_job(cupsd_client_t *con, /* I - Cl + "job-sheets=\"%s,none\", " + "job-originating-user-name=\"%s\"", + job->id, Classification, job->username); ++#ifdef WITH_LSPP ++ override = 1; ++#endif /* WITH_LSPP */ + } + else if (attr->num_values == 2 && + strcmp(attr->values[0].string.text, +@@ -1747,6 +1927,9 @@ add_job(cupsd_client_t *con, /* I - Cl + "job-originating-user-name=\"%s\"", + job->id, attr->values[0].string.text, + attr->values[1].string.text, job->username); ++#ifdef WITH_LSPP ++ override = 1; ++#endif /* WITH_LSPP */ + } + else if (strcmp(attr->values[0].string.text, Classification) && + strcmp(attr->values[0].string.text, "none") && +@@ -1767,6 +1950,9 @@ add_job(cupsd_client_t *con, /* I - Cl + "job-originating-user-name=\"%s\"", + job->id, attr->values[0].string.text, + attr->values[1].string.text, job->username); ++#ifdef WITH_LSPP ++ override = 1; ++#endif /* WITH_LSPP */ + } + } + else if (strcmp(attr->values[0].string.text, Classification) && +@@ -1807,9 +1993,52 @@ add_job(cupsd_client_t *con, /* I - Cl + "job-sheets=\"%s\", " + "job-originating-user-name=\"%s\"", + job->id, Classification, job->username); ++#ifdef WITH_LSPP ++ override = 1; ++#endif /* WITH_LSPP */ ++ } ++#ifdef WITH_LSPP ++ if (is_lspp_config() && AuditLog != -1) ++ { ++ audit_message = NULL; + -+ % Offset page to account for lower-left margin... -+ pageLeft 72 mul -+ pageBottom 72 mul -+ translate ++ if (userheader || userfooter) ++ { ++ if (!override) ++ { ++ /* ++ * The user overrode the banner, so audit it ++ */ ++ cupsdSetStringf(&audit_message, "job=%d user supplied job-sheets=%s,%s" ++ " using banners=%s,%s", job->id, userheader, ++ userfooter, attr->values[0].string.text, ++ (attr->num_values > 1) ? attr->values[1].string.text : "(null)"); ++ audit_log_user_message(AuditLog, AUDIT_LABEL_OVERRIDE, audit_message, ++ ServerName, NULL, NULL, 1); ++ } ++ else ++ { ++ /* ++ * The user tried to override the banner, audit the failure ++ */ ++ cupsdSetStringf(&audit_message, "job=%d user supplied job-sheets=%s,%s" ++ " ignored banners=%s,%s", job->id, userheader, ++ userfooter, attr->values[0].string.text, ++ (attr->num_values > 1) ? attr->values[1].string.text : "(null)"); ++ audit_log_user_message(AuditLog, AUDIT_LABEL_OVERRIDE, audit_message, ++ ServerName, NULL, NULL, 0); ++ } ++ cupsdClearString(&audit_message); + } + } + ++ if (userheader) ++ free(userheader); ++ if (userfooter) ++ free(userfooter); ++#endif /* WITH_LSPP */ ++ } + -+ % Job information box... -+ pageWidth 36 mul 9 add % x = pageWidth * 1/2 * 72 + 9 -+ boxWidth 0.5 mul sub % x-= 1/2 box width -+ pageHeight 30 mul 9 sub % y = pageHeight * 1/2 * 72 - 9 -+ boxWidth % w = box width -+ pageHeight 14 mul % h = pageHeight * 1/2 * 72 -+ 0.5 setgray rectfill % Draw a shadow + /* + * See if we need to add the starting sheet... + */ +@@ -3521,6 +3750,103 @@ check_rss_recipient( + } + + ++#ifdef WITH_LSPP ++/* ++ * 'check_context()' - Check SELinux security context of a user and job ++ */ ++ ++static int /* O - 1 if OK, 0 if not, -1 on error */ ++check_context(cupsd_client_t *con, /* I - Client connection */ ++ cupsd_job_t *job) /* I - Job */ ++{ ++ int enforcing; /* is SELinux in enforcing mode */ ++ char filename[1024]; /* Filename of the spool file */ ++ security_id_t clisid; /* SELinux SID of the client */ ++ security_id_t jobsid; /* SELinux SID of the job */ ++ security_id_t filesid; /* SELinux SID of the spool file */ ++ struct avc_entry_ref avcref; /* AVC entry cache pointer */ ++ security_class_t tclass; /* SELinux security class */ ++ access_vector_t avr; /* SELinux access being queried */ ++ security_context_t spoolfilecon; /* SELinux context of the spool file */ + -+ pageWidth 36 mul % x = pageWidth * 1/2 * 72 -+ boxWidth 0.5 mul sub % x-= 1/2 box width -+ pageHeight 30 mul % y = pageHeight * 1/4 * 72 -+ boxWidth % w = box width -+ pageHeight 14 mul % h = pageHeight * 1/2 * 72 + -+ 4 copy 1 setgray rectfill % Clear the box to white -+ 0 setgray rectstroke % Draw a black box around it... ++ /* ++ * Validate the input to be sure there are contexts to work with... ++ */ + -+ % Job information text... -+ mediumFont setfont % Medium sized font ++ if (con->scon == NULL || job->scon == NULL ++ || strncmp(con->scon, UNKNOWN_SL, strlen(UNKNOWN_SL)) == 0 ++ || strncmp(job->scon, UNKNOWN_SL, strlen(UNKNOWN_SL)) == 0) ++ return -1; + -+ pageWidth 36 mul % x = pageWidth * 1/2 * 72 -+ pageHeight 36 mul % y = pageHeight * 1/2 * 72 -+ pageHeight 5 mul add % y += 2 lines -+ 2 copy % Copy X & Y -+ moveto -+ (Job ID: ) RIGHT -+ moveto -+ ({printer-name}-{job-id}) show ++ if ((enforcing = security_getenforce()) == -1) ++ { ++ cupsdLogMessage(CUPSD_LOG_ERROR, "Error while determining SELinux enforcement"); ++ return -1; ++ } ++ cupsdLogMessage(CUPSD_LOG_DEBUG, "check_context: client context %s job context %s", con->scon, job->scon); + -+ pageWidth 36 mul % x = pageWidth * 1/2 * 72 -+ pageHeight 36 mul % y = pageHeight * 1/2 * 72 -+ pageHeight 2 mul add % y += 1 line -+ 2 copy % Copy X & Y -+ moveto -+ (Title: ) RIGHT -+ moveto -+ ({job-name}) show + -+ pageWidth 36 mul % x = pageWidth * 1/2 * 72 -+ pageHeight 36 mul % y = pageHeight * 1/2 * 72 -+ pageHeight -1 mul add % y -= 1 line -+ 2 copy % Copy X & Y -+ moveto -+ (Requesting User: ) RIGHT -+ moveto -+ ({job-originating-user-name}) show ++ /* ++ * Initialize the avc engine... ++ */ + -+ pageWidth 36 mul % x = pageWidth * 1/2 * 72 -+ pageHeight 36 mul % y = pageHeight * 1/2 * 72 -+ pageHeight -4 mul add % y -= 2 lines -+ 2 copy % Copy X & Y -+ moveto -+ (Billing Info: ) RIGHT -+ moveto -+ ({?job-billing}) show ++ if (avc_init("cupsd", NULL, NULL, NULL, NULL) < 0) ++ { ++ cupsdLogMessage(CUPSD_LOG_ERROR, "check_context: unable avc_init"); ++ return -1; ++ } ++ if (avc_context_to_sid(con->scon, &clisid) != 0) ++ { ++ cupsdLogMessage(CUPSD_LOG_ERROR, "check_context: unable to convert %s to SELinux sid", con->scon); ++ return -1; ++ } ++ avc_context_to_sid(job->scon, &jobsid); ++ avc_entry_ref_init(&avcref); ++ tclass = SECCLASS_FILE; ++ avr = FILE__READ; + -+ % Then the CUPS logo.... -+ gsave -+ pageWidth 4 mul -+ pageWidth 6 mul -+ translate -+ pageWidth 9 mul CUPSLOGO -+ grestore ++ /* ++ * Perform the check with the client as the subject, first with the job as the object ++ * if that fails then with the spool file as the object... ++ */ + -+ % And the ESP logo.... -+ gsave -+ pageWidth 59 mul -+ pageWidth 6 mul -+ translate -+ pageWidth 6 mul ESPLOGO -+ grestore -+% Show the page... -+grestore -+showpage -+% -+% End of "$Id: mls_template,v 1.1 2005/06/27 18:44:46 colmo Exp $". -+% -+%%EOF ---- /dev/null 2008-05-30 08:00:32.690000973 +0100 -+++ cups-1.3.7/data/mls 2008-05-30 16:59:10.000000000 +0100 -@@ -0,0 +1,261 @@ -+%!PS-Adobe-3.0 -+%%BoundingBox: 0 0 612 792 -+%%Pages: 1 -+%%LanguageLevel: 1 -+%%DocumentData: Clean7Bit -+%%DocumentSuppliedResources: procset bannerprint/1.0 -+%%DocumentNeededResources: font Helvetica Helvetica-Bold Times-Roman -+%%Creator: Michael Sweet, Easy Software Products -+%%CreationDate: May 10, 2000 -+%%Title: Test Page -+%%EndComments -+%%BeginProlog -+%%BeginResource procset bannerprint 1.1 0 -+% -+% PostScript banner page for the Common UNIX Printing System ("CUPS"). -+% -+% Copyright 1993-2005 by Easy Software Products -+% -+% These coded instructions, statements, and computer programs are the -+% property of Easy Software Products and are protected by Federal -+% copyright law. Distribution and use rights are outlined in the file -+% "LICENSE.txt" which should have been included with this file. If this -+% file is missing or damaged please contact Easy Software Products -+% at: -+% -+% Attn: CUPS Licensing Information -+% Easy Software Products -+% 44141 Airport View Drive, Suite 204 -+% Hollywood, Maryland 20636 USA -+% -+% Voice: (301) 373-9600 -+% EMail: cups-info@cups.org -+% WWW: http://www.cups.org -+% -+/CENTER { % Draw centered text -+ % (name) CENTER - -+ dup stringwidth pop % Get the width of the string -+ 0.5 mul neg 0 rmoveto % Shift left 1/2 of the distance -+ show % Show the string -+} bind def -+/RIGHT { % Draw right-justified text -+ % (name) RIGHT - -+ dup stringwidth pop % Get the width of the string -+ neg 0 rmoveto % Shift left the entire distance -+ show % Show the string -+} bind def -+/NUMBER { % Draw a number -+ % power n NUMBER - -+ 1 index 1 eq { % power == 1? -+ round cvi exch pop % Convert "n" to integer -+ } { -+ 1 index mul round exch div % Truncate extra decimal places -+ } ifelse -+ 100 string cvs show % Convert to a string and show it... -+} bind def -+/CUPSLOGO { % Draw the CUPS logo -+ % height CUPSLOGO -+ % Start with a big C... -+ /Helvetica findfont 1 index scalefont setfont -+ 0 setgray -+ 0 0 moveto -+ (C) show ++ if (avc_has_perm_noaudit(clisid, jobsid, tclass, avr, &avcref, NULL) != 0) ++ { ++ cupsdLogMessage(CUPSD_LOG_INFO, "check_context: SELinux denied access based on the client context"); + -+ % Then "UNIX Printing System" much smaller... -+ /Helvetica-Bold findfont 1 index 9 div scalefont setfont -+ 0.25 mul -+ dup dup 2.0 mul moveto -+ (UNIX) show -+ dup dup 1.6 mul moveto -+ (Printing) show -+ dup 1.2 mul moveto -+ (System) show -+} bind def -+/ESPLOGO { % Draw the ESP logo -+ % height ESPLOGO -+ % Compute the size of the logo... -+ 0 0 -+ 2 index 1.5 mul 3 index ++ snprintf(filename, sizeof(filename), "%s/c%05d", RequestRoot, job->id); ++ if (getfilecon(filename, &spoolfilecon) == -1) ++ { ++ cupsdLogMessage(CUPSD_LOG_ERROR, "check_context: Unable to get spoolfile context"); ++ return -1; ++ } ++ if (avc_context_to_sid(spoolfilecon, &filesid) != 0) ++ { ++ cupsdLogMessage(CUPSD_LOG_ERROR, "check_context: Unable to determine the SELinux sid for the spool file"); ++ freecon(spoolfilecon); ++ return -1; ++ } ++ freecon(spoolfilecon); ++ if (avc_has_perm_noaudit(clisid, filesid, tclass, avr, &avcref, NULL) != 0) ++ { ++ cupsdLogMessage(CUPSD_LOG_INFO, "check_context: SELinux denied access to the spool file"); ++ return 0; ++ } ++ cupsdLogMessage(CUPSD_LOG_INFO, "check_context: SELinux allowed access to the spool file"); ++ return 1; ++ } ++ else ++ if (enforcing == 0) ++ cupsdLogMessage(CUPSD_LOG_INFO, "check_context: allowing operation due to permissive mode"); ++ else ++ cupsdLogMessage(CUPSD_LOG_INFO, "check_context: SELinux allowed access based on the client context"); + -+ % Do the "metallic" fill from 10% black to 40% black... -+ 1 -0.001 0 { -+ dup % loopval -+ -0.15 mul % loopval * -0.15 -+ 0.9 add % 0.9 - loopval * 0.15 -+ setgray % set gray shade ++ return 1; ++} ++#endif /* WITH_LSPP */ + -+ 0 % x -+ 1 index neg % loopval -+ 1 add % 1 - loopval -+ 3 index % height -+ mul % height * (1 - loopval) -+ moveto % starting point + -+ dup % loopval -+ 3 index % width -+ mul % loopval * width -+ 2 index % height -+ lineto % Next point + /* + * 'check_quotas()' - Check quotas for a printer and user. + */ +@@ -4042,6 +4368,15 @@ copy_banner(cupsd_client_t *con, /* I - + char attrname[255], /* Name of attribute */ + *s; /* Pointer into name */ + ipp_attribute_t *attr; /* Attribute */ ++#ifdef WITH_LSPP ++ const char *mls_label; /* SL of print job */ ++ char *jobrange; /* SELinux sensitivity range */ ++ char *jobclearance; /* SELinux low end clearance */ ++ context_t jobcon; /* SELinux context of the job */ ++ context_t tmpcon; /* Temp context to set the level */ ++ security_context_t spoolcon; /* Context of the file in the spool */ ++#endif /* WITH_LSPP */ + -+ 0 % x -+ 2 index % height -+ lineto % Next point + + + cupsdLogMessage(CUPSD_LOG_DEBUG2, +@@ -4077,6 +4412,82 @@ copy_banner(cupsd_client_t *con, /* I - + + fchmod(cupsFileNumber(out), 0640); + fchown(cupsFileNumber(out), RunUser, Group); ++#ifdef WITH_LSPP ++ if (job->scon != NULL && ++ strncmp(job->scon, UNKNOWN_SL, strlen(UNKNOWN_SL)) != 0) ++ { ++ if (getfilecon(filename, &spoolcon) == -1) ++ { ++ cupsdLogMessage(CUPSD_LOG_ERROR, ++ "copy_banner: Unable to get the context of the banner file %s - %s", ++ filename, strerror(errno)); ++ job->num_files --; ++ return (0); ++ } ++ tmpcon = context_new(spoolcon); ++ jobcon = context_new(job->scon); ++ freecon(spoolcon); ++ if (!tmpcon || !jobcon) ++ { ++ if (tmpcon) ++ context_free(tmpcon); ++ if (jobcon) ++ context_free(jobcon); ++ cupsdLogMessage(CUPSD_LOG_ERROR, ++ "copy_banner: Unable to get the SELinux contexts"); ++ job->num_files --; ++ return (0); ++ } ++ jobrange = context_range_get(jobcon); ++ if (jobrange) ++ { ++ jobrange = strdup(jobrange); ++ if ((jobclearance = strtok(jobrange, "-")) != NULL) ++ { ++ if (context_range_set(tmpcon, jobclearance) == -1) ++ { ++ cupsdLogMessage(CUPSD_LOG_ERROR, ++ "copy_banner: Unable to set the level of the context for file %s - %s", ++ filename, strerror(errno)); ++ free(jobrange); ++ context_free(jobcon); ++ context_free(tmpcon); ++ job->num_files --; ++ return (0); ++ } ++ } ++ else ++ { ++ if (context_range_set(tmpcon, (context_range_get(jobcon))) == -1) ++ { ++ cupsdLogMessage(CUPSD_LOG_ERROR, ++ "copy_banner: Unable to set the level of the context for file %s - %s", ++ filename, strerror(errno)); ++ free(jobrange); ++ context_free(jobcon); ++ context_free(tmpcon); ++ job->num_files --; ++ return (0); ++ } ++ } ++ free(jobrange); ++ } ++ if (setfilecon(filename, context_str(tmpcon)) == -1) ++ { ++ cupsdLogMessage(CUPSD_LOG_ERROR, ++ "copy_banner: Unable to set the context of the banner file %s - %s", ++ filename, strerror(errno)); ++ context_free(jobcon); ++ context_free(tmpcon); ++ job->num_files --; ++ return (0); ++ } ++ cupsdLogMessage(CUPSD_LOG_DEBUG2, "copy_banner: %s set to %s", ++ filename, context_str(tmpcon)); ++ context_free(jobcon); ++ context_free(tmpcon); ++ } ++#endif /* WITH_LSPP */ + + /* + * Try the localized banner file under the subdirectory... +@@ -4171,6 +4582,24 @@ copy_banner(cupsd_client_t *con, /* I - + else + s = attrname; + ++#ifdef WITH_LSPP ++ if (strcmp(s, "mls-label") == 0) ++ { ++ if (job->scon != NULL && strncmp(job->scon, UNKNOWN_SL, strlen(UNKNOWN_SL)) != 0) ++ { ++ jobcon = context_new(job->scon); ++ if (strcasecmp(name, MLS_CONFIG) == 0) ++ mls_label = context_range_get(jobcon); ++ else if (strcasecmp(name, TE_CONFIG) == 0) ++ mls_label = context_type_get(jobcon); ++ else // default to using the whole context string ++ mls_label = context_str(jobcon); ++ cupsFilePuts(out, mls_label); ++ context_free(jobcon); ++ } ++ continue; ++ } ++#endif /* WITH_LSPP */ + if (!strcmp(s, "printer-name")) + { + cupsFilePuts(out, job->dest); +@@ -5938,6 +6367,22 @@ get_job_attrs(cupsd_client_t *con, /* I + return; + } + + -+ closepath -+ fill ++#ifdef WITH_LSPP ++ /* ++ * Check SELinux... ++ */ ++ if (is_lspp_config() && check_context(con, job) != 1) ++ { ++ /* ++ * Unfortunately we have to lie to the user... ++ */ ++ send_ipp_status(con, IPP_NOT_FOUND, _("Job #%d does not exist!"), jobid); ++ return; ++ } ++#endif /* WITH_LSPP */ + -+ dup % loopval -+ 0.15 mul % loopval * 0.15 -+ 0.6 add % 0.6 + loopval * 0.15 -+ setgray + -+ dup % loopval -+ neg 1 add % 1 - loopval -+ 3 index % width -+ mul % (1 - loopval) * width -+ 0 % y -+ moveto % Starting point + /* + * Copy attributes... + */ +@@ -6143,6 +6588,11 @@ get_jobs(cupsd_client_t *con, /* I - C + if (count > 0) + ippAddSeparator(con->response); + ++#ifdef WITH_LSPP ++ if (is_lspp_config() && check_context(con, job) != 1) ++ continue; ++#endif /* WITH_LSPP */ + -+ 2 index % width -+ exch % loopval -+ 2 index % height -+ mul % loopval * height -+ lineto % Next point + count ++; + + cupsdLogMessage(CUPSD_LOG_DEBUG2, "get_jobs: count = %d", count); +@@ -10255,6 +10705,11 @@ validate_user(cupsd_job_t *job, /* I + + strlcpy(username, get_username(con), userlen); + ++#ifdef WITH_LSPP ++ if (is_lspp_config() && check_context(con, job) != 1) ++ return 0; ++#endif /* WITH_LSPP */ + -+ 1 index % width -+ 0 % y -+ lineto % Next point + /* + * Check the username against the owner... + */ +diff -up cups-1.3.8/scheduler/job.c.lspp cups-1.3.8/scheduler/job.c +--- cups-1.3.8/scheduler/job.c.lspp 2008-07-28 16:37:51.000000000 +0100 ++++ cups-1.3.8/scheduler/job.c 2008-07-28 16:37:51.000000000 +0100 +@@ -60,6 +60,9 @@ + * update_job_attrs() - Update the job-printer-* attributes. + */ + ++/* Copyright (C) 2005 Trusted Computer Solutions, Inc. */ ++/* (c) Copyright 2005-2006 Hewlett-Packard Development Company, L.P. */ + -+ closepath -+ fill -+ } for + /* + * Include necessary headers... + */ +@@ -69,6 +72,14 @@ + #include + #include + ++#ifdef WITH_LSPP ++#include ++#include ++#include ++#include ++#include ++#include ++#endif /* WITH_LSPP */ + + /* + * Local globals... +@@ -1136,6 +1147,23 @@ cupsdLoadJob(cupsd_job_t *job) /* I - J + return; + } + ++#ifdef WITH_LSPP ++ if ((attr = ippFindAttribute(job->attrs, "security-context", IPP_TAG_NAME)) != NULL) ++ cupsdSetString(&job->scon, attr->values[0].string.text); ++ else if (is_lspp_config()) ++ { ++ /* ++ * There was no security context so delete the job ++ */ ++ cupsdLogMessage(CUPSD_LOG_ERROR, "LoadAllJobs: Missing or bad security-context attribute in control file \"%s\"!", ++ jobfile); ++ ippDelete(job->attrs); ++ job->attrs = NULL; ++ unlink(jobfile); ++ return; ++ } ++#endif /* WITH_LSPP */ + -+ 0 setgray rectstroke + job->sheets = ippFindAttribute(job->attrs, "job-media-sheets-completed", + IPP_TAG_INTEGER); + job->job_sheets = ippFindAttribute(job->attrs, "job-sheets", IPP_TAG_NAME); +@@ -1493,6 +1521,13 @@ cupsdSaveJob(cupsd_job_t *job) /* I - J + { + char filename[1024]; /* Job control filename */ + cups_file_t *fp; /* Job file */ ++#ifdef WITH_LSPP ++ security_context_t spoolcon; /* context of the job control file */ ++ context_t jobcon; /* contex_t container for job->scon */ ++ context_t tmpcon; /* Temp context to swap the level */ ++ char *jobclearance; /* SELinux low end clearance */ ++ char *jobrange; /* SELinux sensitivity range */ ++#endif /* WITH_LSPP */ + + + cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdSaveJob(job=%p(%d)): job->attrs=%p", +@@ -1511,6 +1546,76 @@ cupsdSaveJob(cupsd_job_t *job) /* I - J + fchmod(cupsFileNumber(fp), 0600); + fchown(cupsFileNumber(fp), RunUser, Group); + ++#ifdef WITH_LSPP ++ if (job->scon && strncmp(job->scon, UNKNOWN_SL, strlen(UNKNOWN_SL)) != 0) ++ { ++ if (getfilecon(filename, &spoolcon) == -1) ++ { ++ cupsdLogMessage(CUPSD_LOG_ERROR, ++ "Unable to get context of job control file \"%s\" - %s.", ++ filename, strerror(errno)); ++ return; ++ } ++ jobcon = context_new(job->scon); ++ tmpcon = context_new(spoolcon); ++ freecon(spoolcon); ++ if (!jobcon || !tmpcon) ++ { ++ if (jobcon) ++ context_free(jobcon); ++ if (tmpcon) ++ context_free(tmpcon); ++ cupsdLogMessage(CUPSD_LOG_ERROR, "Unable to get SELinux contexts"); ++ return; ++ } ++ jobrange = context_range_get(jobcon); ++ if (jobrange) ++ { ++ jobrange = strdup(jobrange); ++ if ((jobclearance = strtok(jobrange, "-")) != NULL) ++ { ++ if (context_range_set(tmpcon, jobclearance) == -1) ++ { ++ cupsdLogMessage(CUPSD_LOG_ERROR, ++ "Unable to set the range for job control file \"%s\" - %s.", ++ filename, strerror(errno)); ++ free(jobrange); ++ context_free(tmpcon); ++ context_free(jobcon); ++ return; ++ } ++ } ++ else ++ { ++ if (context_range_set(tmpcon, (context_range_get(jobcon))) == -1) ++ { ++ cupsdLogMessage(CUPSD_LOG_ERROR, ++ "Unable to set the range for job control file \"%s\" - %s.", ++ filename, strerror(errno)); ++ free(jobrange); ++ context_free(tmpcon); ++ context_free(jobcon); ++ return; ++ } ++ } ++ free(jobrange); ++ } ++ if (setfilecon(filename, context_str(tmpcon)) == -1) ++ { ++ cupsdLogMessage(CUPSD_LOG_ERROR, ++ "Unable to set context of job control file \"%s\" - %s.", ++ filename, strerror(errno)); ++ context_free(tmpcon); ++ context_free(jobcon); ++ return; ++ } ++ cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdSaveJob(job=%p): new spool file context=%s", ++ job, context_str(tmpcon)); ++ context_free(tmpcon); ++ context_free(jobcon); ++ } ++#endif /* WITH_LSPP */ + -+ /Helvetica-BoldOblique findfont 1 index 3 div scalefont setfont -+ dup 40 div + job->attrs->state = IPP_IDLE; + + if (ippWriteIO(fp, (ipp_iocb_t)cupsFileWrite, 1, NULL, +@@ -2485,6 +2590,21 @@ start_job(cupsd_job_t *job, /* I - + /* RIP_MAX_CACHE env variable */ + static char *options = NULL;/* Full list of options */ + static int optlength = 0; /* Length of option buffer */ ++#ifdef WITH_LSPP ++ const char *mls_label = NULL; /* SL to put in classification env var */ ++ char *label_template = NULL; /* SL to put in classification env var */ ++ char *audit_message = NULL; /* Audit message string */ ++ char *printerfile = NULL; /* Device file pointed to by the printer */ ++ context_t jobcon; /* SELinux context of the job */ ++ security_id_t clisid; /* SELinux SID for the client */ ++ security_id_t psid; /* SELinux SID for the printer */ ++ context_t printercon; /* Printer's context string */ ++ struct stat printerstat; /* Printer's stat buffer */ ++ security_context_t devcon; /* Printer's SELinux context */ ++ struct avc_entry_ref avcref; /* Pointer to the access vector cache */ ++ security_class_t tclass; /* Object class for the SELinux check */ ++ access_vector_t avr; /* Access method being requested */ ++#endif /* WITH_LSPP */ + + + cupsdLogMessage(CUPSD_LOG_DEBUG2, "[Job %d] start_job: file = %d/%d", +@@ -2756,6 +2876,106 @@ start_job(cupsd_job_t *job, /* I - + fcntl(job->side_pipes[1], F_GETFL) | O_NONBLOCK); + } + ++#ifdef WITH_LSPP ++ if (is_lspp_config()) ++ { ++ /* ++ * Perform an access check before printing, but only if the printer starts with /dev/ ++ */ ++ printerfile = strstr(printer->device_uri, "/dev/"); ++ if (printerfile == NULL && (strncmp(printer->device_uri, "file:/", 6) == 0)) ++ printerfile = strdup(printer->device_uri + strlen("file:/")); + -+ dup 4 mul 1 index 25 mul moveto (E) show -+ dup 10 mul 1 index 15 mul moveto (S) show -+ dup 16 mul 1 index 5 mul moveto (P) show ++ if (printerfile != NULL) ++ { ++ cupsdLogMessage(CUPSD_LOG_DEBUG, ++ "StartJob: Attempting to check access on printer device %s", printerfile); ++ if (lstat(printerfile, &printerstat) < 0) ++ { ++ if (errno != ENOENT) ++ { ++ cupsdLogMessage(CUPSD_LOG_ERROR, "StartJob: Unable to stat the printer"); ++ cupsdCancelJob(job, 0, IPP_JOB_ABORTED); ++ return ; ++ } ++ /* ++ * The printer does not exist, so for now assume it's a FileDevice ++ */ ++ tclass = SECCLASS_FILE; ++ avr = FILE__WRITE; ++ } ++ else if (S_ISCHR(printerstat.st_mode)) ++ { ++ tclass = SECCLASS_CHR_FILE; ++ avr = CHR_FILE__WRITE; ++ } ++ else if (S_ISREG(printerstat.st_mode)) ++ { ++ tclass = SECCLASS_FILE; ++ avr = FILE__WRITE; ++ } ++ else ++ { ++ cupsdLogMessage(CUPSD_LOG_ERROR, ++ "StartJob: Printer is not a character device or regular file"); ++ cupsdCancelJob(job, 0, IPP_JOB_ABORTED); ++ return ; ++ } ++ avc_init("cupsd_dequeue_", NULL, NULL, NULL, NULL); ++ avc_entry_ref_init(&avcref); ++ if (avc_context_to_sid(job->scon, &clisid) != 0) ++ { ++ cupsdLogMessage(CUPSD_LOG_ERROR, ++ "StartJob: Unable to determine the SELinux sid for the job"); ++ cupsdCancelJob(job, 0, IPP_JOB_ABORTED); ++ return ; ++ } ++ if (getfilecon(printerfile, &devcon) == -1) ++ { ++ cupsdLogMessage(CUPSD_LOG_ERROR, "StartJob: Unable to get the SELinux context of %s", ++ printerfile); ++ cupsdCancelJob(job, 0, IPP_JOB_ABORTED); ++ return ; ++ } ++ printercon = context_new(devcon); ++ cupsdLogMessage(CUPSD_LOG_DEBUG, "StartJob: printer context %s client context %s", ++ context_str(printercon), job->scon); ++ context_free(printercon); + -+ /Helvetica-BoldOblique findfont 2 index 5 div scalefont setfont -+ dup 14 mul 1 index 29 mul moveto (asy) show -+ dup 20 mul 1 index 19 mul moveto (oftware) show -+ dup 26 mul 1 index 9 mul moveto (roducts) show ++ if (avc_context_to_sid(devcon, &psid) != 0) ++ { ++ cupsdLogMessage(CUPSD_LOG_ERROR, ++ "StartJob: Unable to determine the SELinux sid for the printer"); ++ freecon(devcon); ++ cupsdCancelJob(job, 0, IPP_JOB_ABORTED); ++ return ; ++ } ++ freecon(devcon); + -+ pop -+} bind def -+%%EndResource -+%%EndProlog -+%%Page: 1 1 -+gsave ++ if (avc_has_perm(clisid, psid, tclass, avr, &avcref, NULL) != 0) ++ { ++ /* ++ * The access check failed, so cancel the job and send an audit message ++ */ ++ if (AuditLog != -1) ++ { ++ audit_message = NULL; ++ cupsdSetStringf(&audit_message, "job=%d auid=%u acct=%s obj=%s canceled" ++ " unable to access printer=%s", job->id, ++ job->auid, (job->username)?job->username:"?", job->scon, printer->name); ++ audit_log_user_message(AuditLog, AUDIT_USER_LABELED_EXPORT, audit_message, ++ ServerName, NULL, NULL, 0); ++ cupsdClearString(&audit_message); ++ } + -+ % Determine the imageable area and device resolution... -+ initclip newpath clippath pathbbox % Get bounding rectangle -+ 72 div /pageTop exch def % Get top margin in inches -+ 72 div /pageRight exch def % Get right margin in inches -+ 72 div /pageBottom exch def % Get bottom margin in inches -+ 72 div /pageLeft exch def % Get left margin in inches ++ cupsdCancelJob(job, 0, IPP_JOB_ABORTED); + -+ /pageWidth pageRight pageLeft sub def % pageWidth = pageRight - pageLeft -+ /pageHeight pageTop pageBottom sub def% pageHeight = pageTop - pageBottom ++ return ; ++ } ++ } ++ } ++#endif /* WITH_LSPP */ + -+ /boxWidth % width of text box -+ pageWidth pageHeight lt -+ { pageWidth 54 mul } -+ { pageHeight 42 mul } -+ ifelse def + /* + * Determine if we are printing a banner page or not... + */ +@@ -2904,6 +3124,18 @@ start_job(cupsd_job_t *job, /* I - + banner_page) + continue; + ++#ifdef WITH_LSPP ++ /* ++ * In LSPP mode refuse to honor the page-label ++ */ ++ if (is_lspp_config() && ++ !strcmp(attr->name, "page-label")) ++ { ++ cupsdLogMessage(CUPSD_LOG_DEBUG, "Ignoring page-label option due to LSPP mode"); ++ continue; ++ } ++#endif /* WITH_LSPP */ + -+ newpath % Clear bounding path + /* + * Otherwise add them to the list... + */ +@@ -3146,6 +3378,67 @@ start_job(cupsd_job_t *job, /* I - + } + } + ++#ifdef WITH_LSPP ++ if (is_lspp_config()) ++ { ++ if (!job->scon || strncmp(job->scon, UNKNOWN_SL, strlen(UNKNOWN_SL)) == 0) ++ { ++ if (AuditLog != -1) ++ { ++ audit_message = NULL; ++ cupsdSetStringf(&audit_message, "job=%d auid=%u acct=%s printer=%s title=%s", ++ job->id, job->auid, job->username, printer->name, title); ++ audit_log_user_message(AuditLog, AUDIT_USER_UNLABELED_EXPORT, audit_message, ++ ServerName, NULL, NULL, 1); ++ cupsdClearString(&audit_message); ++ } ++ } ++ else ++ { ++ jobcon = context_new(job->scon); + -+ % Create fonts... -+ /bigFont /Helvetica-Bold findfont % bigFont = Helvetica-Bold -+ pageHeight 3 mul scalefont def % size = pageHeight * 3 (nominally 33) ++ if ((attr = ippFindAttribute(job->attrs, "job-sheets", IPP_TAG_NAME)) == NULL) ++ label_template = strdup(Classification); ++ else if (attr->num_values > 1 && ++ strcmp(attr->values[1].string.text, "none") != 0) ++ label_template = strdup(attr->values[1].string.text); ++ else ++ label_template = strdup(attr->values[0].string.text); + -+ /mediumFont /Helvetica findfont % mediumFont = Helvetica -+ pageHeight 1.5 mul scalefont def % size = pageHeight * 1.5 (nominally 16.5) ++ if (strcasecmp(label_template, MLS_CONFIG) == 0) ++ mls_label = context_range_get(jobcon); ++ else if (strcasecmp(label_template, TE_CONFIG) == 0) ++ mls_label = context_type_get(jobcon); ++ else if (strcasecmp(label_template, SELINUX_CONFIG) == 0) ++ mls_label = context_str(jobcon); ++ else ++ mls_label = label_template; + -+ % Offset page to account for lower-left margin... -+ pageLeft 72 mul -+ pageBottom 72 mul -+ translate ++ if (mls_label && (PerPageLabels || banner_page)) ++ { ++ snprintf(classification, sizeof(classification), "CLASSIFICATION=LSPP:%s", mls_label); ++ envp[envc ++] = classification; ++ } + -+ % Job information box... -+ pageWidth 36 mul 9 add % x = pageWidth * 1/2 * 72 + 9 -+ boxWidth 0.5 mul sub % x-= 1/2 box width -+ pageHeight 30 mul 9 sub % y = pageHeight * 1/2 * 72 - 9 -+ boxWidth % w = box width -+ pageHeight 14 mul % h = pageHeight * 1/2 * 72 -+ 0.5 setgray rectfill % Draw a shadow ++ if ((AuditLog != -1) && !banner_page) ++ { ++ audit_message = NULL; ++ cupsdSetStringf(&audit_message, "job=%d auid=%u acct=%s printer=%s title=%s" ++ " obj=%s label=%s", job->id, job->auid, job->username, ++ printer->name, title, job->scon, mls_label?mls_label:"none"); ++ audit_log_user_message(AuditLog, AUDIT_USER_LABELED_EXPORT, audit_message, ++ ServerName, NULL, NULL, 1); ++ cupsdClearString(&audit_message); ++ } ++ context_free(jobcon); ++ free(label_template); ++ } ++ } ++ else ++ /* ++ * Fall through to the non-LSPP behavior ++ */ ++#endif /* WITH_LSPP */ + if (Classification && !banner_page) + { + if ((attr = ippFindAttribute(job->attrs, "job-sheets", +diff -up cups-1.3.8/scheduler/job.h.lspp cups-1.3.8/scheduler/job.h +--- cups-1.3.8/scheduler/job.h.lspp 2008-01-16 22:20:33.000000000 +0000 ++++ cups-1.3.8/scheduler/job.h 2008-07-28 16:37:51.000000000 +0100 +@@ -13,6 +13,13 @@ + * file is missing or damaged, see the license at "http://www.cups.org/". + */ + ++/* Copyright (C) 2005 Trusted Computer Solutions, Inc. */ ++/* (c) Copyright 2005-2006 Hewlett-Packard Development Company, L.P. */ + -+ pageWidth 36 mul % x = pageWidth * 1/2 * 72 -+ boxWidth 0.5 mul sub % x-= 1/2 box width -+ pageHeight 30 mul % y = pageHeight * 1/4 * 72 -+ boxWidth % w = box width -+ pageHeight 14 mul % h = pageHeight * 1/2 * 72 ++#ifdef WITH_LSPP ++#include ++#endif /* WITH_LSPP */ + -+ 4 copy 1 setgray rectfill % Clear the box to white -+ 0 setgray rectstroke % Draw a black box around it... + /* + * Job request structure... + */ +@@ -60,6 +67,10 @@ typedef struct cupsd_job_s + krb5_ccache ccache; /* Kerberos credential cache */ + char *ccname; /* KRB5CCNAME environment variable */ + #endif /* HAVE_GSSAPI */ ++#ifdef WITH_LSPP ++ security_context_t scon; /* Security context of job */ ++ uid_t auid; /* Audit loginuid for this job */ ++#endif /* WITH_LSPP */ + } cupsd_job_t; + + +diff -up cups-1.3.8/scheduler/main.c.lspp cups-1.3.8/scheduler/main.c +--- cups-1.3.8/scheduler/main.c.lspp 2008-07-28 16:37:51.000000000 +0100 ++++ cups-1.3.8/scheduler/main.c 2008-07-28 16:37:51.000000000 +0100 +@@ -35,6 +35,8 @@ + * usage() - Show scheduler usage. + */ + ++/* (c) Copyright 2005-2006 Hewlett-Packard Development Company, L.P. */ + -+ % Job information text... -+ mediumFont setfont % Medium sized font + /* + * Include necessary headers... + */ +@@ -73,6 +75,9 @@ + # include + #endif /* __APPLE__ && HAVE_DLFCN_H */ + ++#ifdef WITH_LSPP ++# include ++#endif /* WITH_LSPP */ + + /* + * Local functions... +@@ -154,6 +159,9 @@ main(int argc, /* I - Number of comm + int launchd_idle_exit; + /* Idle exit on select timeout? */ + #endif /* HAVE_LAUNCHD */ ++#if WITH_LSPP ++ auditfail_t failmode; /* Action for audit_open failure */ ++#endif /* WITH_LSPP */ + + + #ifdef HAVE_GETEUID +@@ -413,6 +421,25 @@ main(int argc, /* I - Number of comm + #endif /* DEBUG */ + } + ++#ifdef WITH_LSPP ++ if ((AuditLog = audit_open()) < 0 ) ++ { ++ if (get_auditfail_action(&failmode) == 0) ++ { ++ if (failmode == FAIL_LOG) ++ { ++ cupsdLogMessage(CUPSD_LOG_ERROR, "Unable to connect to audit subsystem."); ++ AuditLog = -1; ++ } ++ else if (failmode == FAIL_TERMINATE) ++ { ++ fprintf(stderr, "cupsd: unable to start auditing, terminating"); ++ return -1; ++ } ++ } ++ } ++#endif /* WITH_LSPP */ + -+ pageWidth 36 mul % x = pageWidth * 1/2 * 72 -+ pageHeight 36 mul % y = pageHeight * 1/2 * 72 -+ pageHeight 5 mul add % y += 2 lines -+ 2 copy % Copy X & Y -+ moveto -+ (Job ID: ) RIGHT -+ moveto -+ ({printer-name}-{job-id}) show + /* + * Set the timezone info... + */ +@@ -1160,6 +1187,11 @@ main(int argc, /* I - Number of comm + + cupsdStopSelect(); + ++#ifdef WITH_LSPP ++ if (AuditLog != -1) ++ audit_close(AuditLog); ++#endif /* WITH_LSPP */ + -+ pageWidth 36 mul % x = pageWidth * 1/2 * 72 -+ pageHeight 36 mul % y = pageHeight * 1/2 * 72 -+ pageHeight 2 mul add % y += 1 line -+ 2 copy % Copy X & Y -+ moveto -+ (Title: ) RIGHT -+ moveto -+ ({job-name}) show + return (!stop_scheduler); + } + +diff -up cups-1.3.8/scheduler/printers.c.lspp cups-1.3.8/scheduler/printers.c +--- cups-1.3.8/scheduler/printers.c.lspp 2008-07-28 16:37:51.000000000 +0100 ++++ cups-1.3.8/scheduler/printers.c 2008-07-28 16:37:51.000000000 +0100 +@@ -51,6 +51,8 @@ + * printing desktop tools. + */ + ++/* (c) Copyright 2005-2006 Hewlett-Packard Development Company, L.P. */ + -+ pageWidth 36 mul % x = pageWidth * 1/2 * 72 -+ pageHeight 36 mul % y = pageHeight * 1/2 * 72 -+ pageHeight -1 mul add % y -= 1 line -+ 2 copy % Copy X & Y -+ moveto -+ (Requesting User: ) RIGHT -+ moveto -+ ({job-originating-user-name}) show + /* + * Include necessary headers... + */ +@@ -74,6 +76,10 @@ static void write_irix_config(cupsd_prin + static void write_irix_state(cupsd_printer_t *p); + #endif /* __sgi */ + ++#ifdef WITH_LSPP ++# include ++# include ++#endif /* WITH_LSPP */ + + /* + * 'cupsdAddPrinter()' - Add a printer to the system. +@@ -1846,6 +1852,13 @@ cupsdSetPrinterAttrs(cupsd_printer_t *p) + { /* No authentication */ + "none" + }; ++#ifdef WITH_LSPP ++ char *audit_message; /* Audit message string */ ++ char *printerfile; /* Path to a local printer dev */ ++ char *rangestr; /* Printer's range if its available */ ++ security_context_t devcon; /* Printer SELinux context */ ++ context_t printercon; /* context_t for the printer */ ++#endif /* WITH_LSPP */ + + + DEBUG_printf(("cupsdSetPrinterAttrs: entering name = %s, type = %x\n", p->name, +@@ -1989,6 +2002,44 @@ cupsdSetPrinterAttrs(cupsd_printer_t *p) + attr->values[1].string.text = _cupsStrAlloc(Classification ? + Classification : p->job_sheets[1]); + } ++#ifdef WITH_LSPP ++ if (AuditLog != -1) ++ { ++ char uri[HTTP_MAX_URI]; ++ audit_message = NULL; ++ rangestr = NULL; ++ printercon = 0; ++ printerfile = strstr(p->device_uri, "/dev/"); ++ if (printerfile == NULL && (strncmp(p->device_uri, "file:/", 6) == 0)) ++ printerfile = strdup(p->device_uri + strlen("file:/")); + -+ pageWidth 36 mul % x = pageWidth * 1/2 * 72 -+ pageHeight 36 mul % y = pageHeight * 1/2 * 72 -+ pageHeight -4 mul add % y -= 2 lines -+ 2 copy % Copy X & Y -+ moveto -+ (Billing Info: ) RIGHT -+ moveto -+ ({?job-billing}) show ++ if (printerfile != NULL) ++ { ++ if (getfilecon(printerfile, &devcon) == -1) ++ cupsdLogMessage(CUPSD_LOG_ERROR, "cupsdSetPrinterAttrs: Unable to get printer context"); ++ else ++ { ++ printercon = context_new(devcon); ++ freecon(devcon); ++ } ++ } + -+ % Then the CUPS logo.... -+ gsave -+ pageWidth 4 mul -+ pageWidth 6 mul -+ translate -+ pageWidth 9 mul CUPSLOGO -+ grestore ++ if (printercon && context_range_get(printercon)) ++ rangestr = strdup(context_range_get(printercon)); ++ else ++ rangestr = strdup("unknown"); + -+ % And the ESP logo.... -+ gsave -+ pageWidth 59 mul -+ pageWidth 6 mul -+ translate -+ pageWidth 6 mul ESPLOGO -+ grestore -+% Show the page... -+grestore -+showpage -+% -+% End of "$Id: mls_template,v 1.1 2005/06/27 18:44:46 colmo Exp $". -+% -+%%EOF ++ cupsdSanitizeURI(p->device_uri, uri, sizeof(uri)); ++ cupsdSetStringf(&audit_message, "printer=%s uri=%s banners=%s,%s range=%s", ++ p->name, uri, p->job_sheets[0], p->job_sheets[1], rangestr); ++ audit_log_user_message(AuditLog, AUDIT_LABEL_LEVEL_CHANGE, audit_message, ++ ServerName, NULL, NULL, 1); ++ if (printercon) ++ context_free(printercon); ++ free(rangestr); ++ cupsdClearString(&audit_message); ++ } ++#endif /* WITH_LSPP */ + } + + p->raw = 0; diff --git a/cups-str2892.patch b/cups-str2892.patch new file mode 100644 index 0000000..6c1a5e1 --- /dev/null +++ b/cups-str2892.patch @@ -0,0 +1,86 @@ +diff -up cups-1.3.7/scheduler/client.c.str2892 cups-1.3.7/scheduler/client.c +--- cups-1.3.7/scheduler/client.c.str2892 2008-02-12 00:20:32.000000000 +0000 ++++ cups-1.3.7/scheduler/client.c 2008-08-01 22:18:22.000000000 +0100 +@@ -28,6 +28,7 @@ + * cupsdUpdateCGI() - Read status messages from CGI scripts and programs. + * cupsdWriteClient() - Write data to a client as needed. + * check_if_modified() - Decode an "If-Modified-Since" line. ++ * data_ready() - Check whether data is available from a client. + * encrypt_client() - Enable encryption for the client... + * get_cdsa_certificate() - Convert a keychain name into the CFArrayRef + * required by SSLSetCertificate. +@@ -83,6 +84,7 @@ extern const char *cssmErrorString(int e + + static int check_if_modified(cupsd_client_t *con, + struct stat *filestats); ++static int data_ready(cupsd_client_t *con); + #ifdef HAVE_SSL + static int encrypt_client(cupsd_client_t *con); + #endif /* HAVE_SSL */ +@@ -986,8 +988,7 @@ cupsdReadClient(cupsd_client_t *con) /* + */ + + while ((status = httpUpdate(HTTP(con))) == HTTP_CONTINUE) +- if (con->http.used == 0 || +- !memchr(con->http.buffer, '\n', con->http.used)) ++ if (!data_ready(con)) + break; + + if (status != HTTP_OK && status != HTTP_CONTINUE) +@@ -1884,7 +1885,7 @@ cupsdReadClient(cupsd_client_t *con) /* + } + } + } +- while (con->http.state == HTTP_PUT_RECV && con->http.used > 0); ++ while (con->http.state == HTTP_PUT_RECV && data_ready(con)); + + if (con->http.state == HTTP_WAITING) + { +@@ -2059,7 +2060,7 @@ cupsdReadClient(cupsd_client_t *con) /* + } + } + } +- while (con->http.state == HTTP_POST_RECV && con->http.used > 0); ++ while (con->http.state == HTTP_POST_RECV && data_ready(con)); + + if (con->http.state == HTTP_POST_SEND) + { +@@ -2909,6 +2910,38 @@ check_if_modified( + } + + ++/* ++ * 'data_ready()' - Check whether data is available from a client. ++ */ ++ ++static int /* O - 1 if data is ready, 0 otherwise */ ++data_ready(cupsd_client_t *con) /* I - Client */ ++{ ++ if (con->http.used > 0) ++ return (1); ++#ifdef HAVE_SSL ++ else if (con->http.tls) ++ { ++# ifdef HAVE_LIBSSL ++ if (SSL_pending((SSL *)(con->http.tls))) ++ return (1); ++# elif defined(HAVE_GNUTLS) ++ if (gnutls_record_check_pending(((http_tls_t *)(con->http.tls))->session)) ++ return (1); ++# elif defined(HAVE_CDSASSL) ++ size_t bytes; /* Bytes that are available */ ++ ++ if (!SSLGetBufferedReadSize(((http_tls_t *)(con->http.tls))->session, ++ &bytes) && bytes > 0) ++ return (1); ++# endif /* HAVE_LIBSSL */ ++ } ++#endif /* HAVE_SSL */ ++ ++ return (0); ++} ++ ++ + #ifdef HAVE_SSL + /* + * 'encrypt_client()' - Enable encryption for the client... diff --git a/cups.spec b/cups.spec index 785f70c..3647773 100644 --- a/cups.spec +++ b/cups.spec @@ -6,8 +6,8 @@ Summary: Common Unix Printing System Name: cups -Version: 1.3.7 -Release: 8%{?svn:.svn%{svn}}%{?dist} +Version: 1.3.8 +Release: 1%{?svn:.svn%{svn}}%{?dist} License: GPLv2 Group: System Environment/Daemons Source: ftp://ftp.easysw.com/pub/cups/test//cups-%{version}%{?svn:svn-r%{svn}}-source.tar.bz2 @@ -25,31 +25,29 @@ Source12: cups.cron Source13: pdftops.conf Source14: textonly.filter Source15: textonly.ppd -Patch2: cups-no-gzip-man.patch -Patch3: cups-1.1.16-system-auth.patch -Patch4: cups-multilib.patch -Patch5: cups-ext.patch -Patch6: cups-includeifexists.patch -Patch7: cups-banners.patch -Patch8: cups-serverbin-compat.patch -Patch10: cups-no-export-ssllibs.patch -Patch11: cups-paps.patch -Patch12: cups-wbuffer.patch -Patch13: cups-direct-usb.patch -Patch14: cups-lpr-help.patch -Patch15: cups-peercred.patch -Patch16: cups-pid.patch -Patch17: cups-foomatic-recommended.patch -Patch18: cups-str2750.patch -Patch19: cups-eggcups.patch -Patch20: cups-getpass.patch -Patch21: cups-driverd-timeout.patch -Patch22: cups-strict-ppd-line-length.patch -Patch23: cups-logrotate.patch -Patch25: cups-usb-paperout.patch -Patch29: cups-CVE-2008-1373.patch -Patch30: cups-CVE-2008-1722.patch -Patch31: cups-getnameddest.patch +Patch1: cups-no-gzip-man.patch +Patch2: cups-1.1.16-system-auth.patch +Patch3: cups-multilib.patch +Patch4: cups-ext.patch +Patch5: cups-includeifexists.patch +Patch6: cups-banners.patch +Patch7: cups-serverbin-compat.patch +Patch8: cups-no-export-ssllibs.patch +Patch9: cups-paps.patch +Patch10: cups-wbuffer.patch +Patch11: cups-direct-usb.patch +Patch12: cups-lpr-help.patch +Patch13: cups-peercred.patch +Patch14: cups-pid.patch +Patch15: cups-foomatic-recommended.patch +Patch16: cups-eggcups.patch +Patch17: cups-getpass.patch +Patch18: cups-driverd-timeout.patch +Patch19: cups-strict-ppd-line-length.patch +Patch20: cups-logrotate.patch +Patch21: cups-usb-paperout.patch +Patch22: cups-getnameddest.patch +Patch23: cups-str2892.patch Patch100: cups-lspp.patch Epoch: 1 Url: http://www.cups.org/ @@ -81,7 +79,6 @@ BuildRequires: libpng-devel BuildRequires: libtiff-devel BuildRequires: krb5-devel BuildRequires: avahi-compat-libdns_sd-devel -BuildRequires: autoconf %if %lspp BuildPrereq: libselinux-devel >= 1.23 @@ -107,6 +104,7 @@ License: LGPLv2 Requires: %{name}-libs = %{epoch}:%{version}-%{release} Requires: gnutls-devel Requires: krb5-devel +Requires: zlib-devel %package libs Summary: Common Unix Printing System - libraries @@ -145,38 +143,35 @@ lpd emulation. %prep %setup -q -n %{name}-%{version}%{?svn:svn-r%{svn}} -%patch2 -p1 -b .no-gzip-man -%patch3 -p1 -b .system-auth -%patch4 -p1 -b .multilib -%patch5 -p1 -b .ext -%patch6 -p1 -b .includeifexists -%patch7 -p1 -b .banners -%patch8 -p1 -b .serverbin-compat -%patch10 -p1 -b .no-export-ssllibs -%patch11 -p1 -b .paps -%patch12 -p1 -b .wbuffer -%patch13 -p1 -b .direct-usb -%patch14 -p1 -b .lpr-help -%patch15 -p1 -b .peercred -%patch16 -p1 -b .pid -%patch17 -p1 -b .foomatic-recommended -%patch18 -p1 -b .str2750 -%patch19 -p1 -b .eggcups -%patch20 -p1 -b .getpass -%patch21 -p1 -b .driverd-timeout -%patch22 -p1 -b .strict-ppd-line-length -%patch23 -p1 -b .logrotate -%patch25 -p1 -b .usb-paperout -%patch29 -p1 -b .CVE-2008-1373 -%patch30 -p1 -b .CVE-2008-1722 -%patch31 -p1 -b .getnameddest +%patch1 -p1 -b .no-gzip-man +%patch2 -p1 -b .system-auth +%patch3 -p1 -b .multilib +%patch4 -p1 -b .ext +%patch5 -p1 -b .includeifexists +%patch6 -p1 -b .banners +%patch7 -p1 -b .serverbin-compat +%patch8 -p1 -b .no-export-ssllibs +%patch9 -p1 -b .paps +%patch10 -p1 -b .wbuffer +%patch11 -p1 -b .direct-usb +%patch12 -p1 -b .lpr-help +%patch13 -p1 -b .peercred +%patch14 -p1 -b .pid +%patch15 -p1 -b .foomatic-recommended +%patch16 -p1 -b .eggcups +%patch17 -p1 -b .getpass +%patch18 -p1 -b .driverd-timeout +%patch19 -p1 -b .strict-ppd-line-length +%patch20 -p1 -b .logrotate +%patch21 -p1 -b .usb-paperout +%patch22 -p1 -b .getnameddest +%patch23 -p1 -b .str2892 %if %lspp %patch100 -p1 -b .lspp %endif sed -i -e '1iMaxLogSize 0' conf/cupsd.conf.in -autoconf cp %{SOURCE5} cups-lpd.real perl -pi -e "s,\@LIBDIR\@,%{_libdir},g" cups-lpd.real @@ -365,25 +360,26 @@ rm -rf $RPM_BUILD_ROOT %config(noreplace) /etc/pam.d/cups %config(noreplace) %{_sysconfdir}/logrotate.d/cups %dir %{_datadir}/%{name}/www -%{_datadir}/%{name}/www/favicon.* -%{_datadir}/%{name}/www/images +%config(noreplace) %{_datadir}/%{name}/www/favicon.* +%config(noreplace) %{_datadir}/%{name}/www/images %if %{?svn:1}%{!?svn:0} %else -%{_datadir}/%{name}/www/de -%{_datadir}/%{name}/www/es -%{_datadir}/%{name}/www/et -%{_datadir}/%{name}/www/fr -%{_datadir}/%{name}/www/he -%{_datadir}/%{name}/www/it -%{_datadir}/%{name}/www/ja -%{_datadir}/%{name}/www/pl -%{_datadir}/%{name}/www/sv -%{_datadir}/%{name}/www/zh_TW +%config(noreplace) %{_datadir}/%{name}/www/de +%config(noreplace) %{_datadir}/%{name}/www/es +%config(noreplace) %{_datadir}/%{name}/www/et +%config(noreplace) %{_datadir}/%{name}/www/fr +%config(noreplace) %{_datadir}/%{name}/www/he +%config(noreplace) %{_datadir}/%{name}/www/id +%config(noreplace) %{_datadir}/%{name}/www/it +%config(noreplace) %{_datadir}/%{name}/www/ja +%config(noreplace) %{_datadir}/%{name}/www/pl +%config(noreplace) %{_datadir}/%{name}/www/sv +%config(noreplace) %{_datadir}/%{name}/www/zh_TW %endif -%{_datadir}/%{name}/www/*.css -%doc %{_datadir}/%{name}/www/index.html -%doc %{_datadir}/%{name}/www/help -%doc %{_datadir}/%{name}/www/robots.txt +%config(noreplace) %{_datadir}/%{name}/www/*.css +%config(noreplace) %doc %{_datadir}/%{name}/www/index.html +%config(noreplace) %doc %{_datadir}/%{name}/www/help +%config(noreplace) %doc %{_datadir}/%{name}/www/robots.txt %config(noreplace) %{initdir}/cups %{_bindir}/cupstestppd %{_bindir}/cupstestdsc @@ -439,6 +435,16 @@ rm -rf $RPM_BUILD_ROOT %{cups_serverbin}/daemon/cups-lpd %changelog +* Sun Aug 3 2008 Tim Waugh 1:1.3.8-1 +- 1.3.8. +- Applied patch to fix STR #2892 (bug #453610). +- Removed autoconf requirement by applying autoconf-generated changes + to patches that caused them. Affected patches: cups-lspp. +- CVE-2008-1373 patch is no longer needed (applied upstream). +- Mark HTML files and templates config(noreplace) for site-local + modifications (bug #441719). +- The cups-devel package requires zlib-devel (bug #455192). + * Tue Jul 1 2008 Tim Waugh 1:1.3.7-8 - Fixed bug #447200 again. diff --git a/sources b/sources index 27ea9c4..b08d800 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ b0bb017098e8e76b8a25e666c41ce540 postscript.ppd.gz -db4a45a17104f10f3ee599d88267c9e5 cups-1.3.7-source.tar.bz2 +84e09577d673b212f605dd09caee456c cups-1.3.8-source.tar.bz2