[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

Re: [patch] CUPS 1.2 SELinux policy changes...

On Nov 21, 2005, at 11:57 AM, Michael Sweet wrote:

Chad Hanson wrote:
I am positive there are customer requirements for this. The example could be multiple classified networks, instead of unclass/class as well. This can provide printer reduction in these cases with a multilevel print server.

Again, in my experience (having managed many DoD and other gov't
contracts), this type of configuration just isn't allowed.  There
is typically a single "system high" classification level and all
print jobs are labeled as such.  Users must then mark each page in
a document with a lower classification by hand.  The CUPS classified
printing support is actually modeled on specific DoD requirements...

Michael, in a non LSPP system environment your summary is correct.

In an LSPP system, since the label is bound to the document (file) with some assurance, you can print real labels on documents. We spool multilevel print jobs from our Compartmented Mode Workstations (B1 era MLS) with print banners that reflect the document classification - not the network system high. Banner pages and markings at the top and bottom of each page. Accredited in 5 different countries and multiple domains :)

DoD is not the only set of US rules (DCID 6/3 vs DoD 8500) and other nations have their own rules. If possible, I would certainly like to see real multilevel printer support. Anything less will be a step backwards for our users.


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]