Initial CUPS auditing patch

[Matt Anderson]

After seeing what Cory and TCS have done I started working on some of
the other LSPP requirements around printing.  Attached is a patch that
applies on top of Cups 1.2.23 with the TCS patch applied.

Right now the patch is a basic audting framework with only a few audited 
events such as the classification of the cups daemon, if users are 
allowed to override the banners on the command line, that sort of thing. 
  The patch currently uses AUDIT_USER as the message type.  This was 
suggested by Steve as a work around while the message types are being 
decided.  So far I've only really made Job related messages and Config 
related messages, but I'm sure more will come.

Some sample messages are:
'CUPS Config: ClassifyOverride is enabled'
'CUPS Config: System wide Classification set to "classified"'
'CUPS Config: Setting printer "freecoffee" banners to "secret" "secret"'
'CUPS Config: Setting printer "localghost" banners to "topsecret" "none"'
'CUPS Job #1: being printed on "freecoffee" with labels "classified"
"classified"'

One thing I did try to do, but have since removed, is attempt to
determine if the user specified "-o job_sheets=foo" which is the cups
way to override the banners.  It seems that with a system wide
classification set this user option is overwritten.  Auditing the
client's end of printing could present some challenges due to the client
- server nature of cups.  One option may be to expand the way cups does
IPP to include more meta data in the client request, although this is
not without issues.

Cups does seem to have support for classifications and labels, and this
patch and the one from TCS improve on those features,  but at this point 
I'm concerned that its basic infrastucture isn't right for what we need 
from a strict LSPP perspective.  Things like a label translation table 
built-in seems like a feature that Trusted/Labeled printing users would 
like, but doesn't seem like something Cups would want to upstream.

I'm going to be away thru the end of this week, but I wanted to get this
out for comments.  I'll be checking in on my mail, but don't be offened 
if I don't get back to you right away.

-matt

-------------- next part --------------
A non-text attachment was scrubbed...
Name: cups-audit.patch
Type: text/x-patch
Size: 6725 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/linux-audit/attachments/20050816/400f252b/attachment.bin>