[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

Re: [redhat-lspp] Re: cups userspace -- trusted programs?



Linda Knippers wrote:
Hi Mike,

Matt is away this week so he'll probably have a more detailed response
but in the meantime, I have a few comments/questions.

I'm wondering if the intent of the cups userspace tools are to be trusted programs? Specifically I'm curious about cupsaccept, cupsreject, cupsenable and cupsdisable. The reason I ask is because if they are supposed to be trusted programs, they don't generate unique audit messages like other programs.

I don't think these programs are trusted programs because all they do
is talk to the cupsd, which is a trusted program.  The cupsd makes
all the decisions and takes all the actions.  These programs (really
just 'accept' as the rest I believe are symlinks to it) are not setuid
and do not make any access or other decisions, at least that's my
understanding.

You are correct. accept, reject, cupsenable and cupsdisable are all done through the accept binary, and it does not responsible for decisions, it only facilitate actions. I learned this after reading some code :p

Personally, I think these tools should generate messages since they are a source for leaking information, and therefore should be restricted to administrators.

I think the real question is which actions should be audited.  Should
enabling/disabling a printer queue be audited?  I don't believe its
required to be and if its not security relevant, do we want it in the
audit logs?  Cups has a comprehensive logging facility so there is all
kinds of information about happening with the print subsystem that I
don't think we want to replicate in the audit logs, but perhaps there
are more actions that would make sense to audit than we currently are
auditing.

According to Klaus, this is not strictly speaking required for LSPP. Your point about cups logging such actions is well taken (and over looked by me initially).

Do you have specific examples of actions that you think should be
audited aside from what's required for LSPP?

Aside from what is *required*, I thought it would be a good thing to log the queue/printer enable/disable. However, if cups is logging that, I'm not sure it is worth being redundant in our logs.

Mike


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]