What does SELINUX got on CUPS/PRINTING? O_o

[skyxn3t]

I have a samsung ML2525W printer. I installed the printer driver. I added the printer, everything went fine.
But when I try to print. SELINUX prevents it from printing.

Here's the message:

Summary:

SELinux is preventing /usr/lib/cups/daemon/cups-deviced "execute" access on mfp.

Detailed Description:

SELinux denied access requested by cups-deviced. It is not expected that this
access is required by cups-deviced and this access may signal an intrusion
attempt. It is also possible that the specific version or configuration of the
application is causing it to require additional access.

Allowing Access:

You can generate a local policy module to allow this access - see FAQ
(http://docs.fedoraproject.org/selinux-faq-fc5/#id2961385) Please file a bug
report.

Additional Information:

Source Context                unconfined_u:system_r:cupsd_t:s0-s0:c0.c1023
Target Context                unconfined_u:object_r:user_home_t:s0
Target Objects                mfp [ file ]
Source                        cups-deviced
Source Path                   /usr/lib/cups/daemon/cups-deviced
Port                          <Unknown>
Host                          user
Source RPM Packages           cups-1.4.4-11.fc14
Target RPM Packages           
Policy RPM                    selinux-policy-3.9.7-16.fc14
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Plugin Name                   catchall
Host Name                     user
Platform                      Linux user 2.6.35.9-64.fc14.x86_64 #1 SMP Fri Dec
                              3 12:19:41 UTC 2010 x86_64 x86_64
Alert Count                   1
First Seen                    Fri 17 Dec 2010 05:46:02 PM EST
Last Seen                     Fri 17 Dec 2010 05:46:02 PM EST
Local ID                      bcd147da-4001-40a9-ad26-fb3d241de706
Line Numbers                  

Raw Audit Messages            

node=user type=AVC msg=audit(1292625962.425:288): avc:  denied  { execute } for  pid=7379 comm="cups-deviced" name="mfp" dev=sda3 ino=5774315 scontext=unconfined_u:system_r:cupsd_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file

node=user type=SYSCALL msg=audit(1292625962.425:288): arch=c000003e syscall=59 success=no exit=-13 a0=7fff65f538f0 a1=7fff65f530e0 a2=7fff65f54650 a3=7fff65f52ce0 items=0 ppid=7365 pid=7379 auid=500 uid=4 gid=7 euid=4 suid=4 fsuid=4 egid=7 sgid=7 fsgid=7 tty=(none) ses=1 comm="cups-deviced" exe="/usr/lib/cups/daemon/cups-deviced" subj=unconfined_u:system_r:cupsd_t:s0-s0:c0.c1023 key=(null)

I used to fix this problem using the following command:

restorecon -R -v /usr/lib/cups/filter

But it seems that SELinux keeps Fing up a new problem on each new installation of Fedora.

WHY DOESN'T"T REDHAT/FEDORA Fix the Printing problems with SELINUX?

[CSchwangler]

Did you notice this bug

https://bugzilla.redhat.com/show_bug.cgi?id=577890

and the suggested workaround?

[domg472]

The mfp file was moved (mv) from the user home directory to /usr/lib/cups/filter

When you move a file, its selinux attributes are moved with it.

That is how i can see that this file was moved from the user home space.

To avoid issues like this either:

restorecon the target of the moved file.

or:

use cp.

( but cp in this case would not have fixed this issue either i believe because the target would have inherited the type of the parent directory ( /usr/lib/cups/filter ) which is usr_t and i believe usr_t is not executable by cups.

So when you move or copy files around, then you *may* need to restore the context of the moved or copied file.

[goodricm]

Can anyone advise how I turn off SELinux. I don't need it and it's half arsed attempt at implementing a security model is getting on my tits. I mean if I'd wanted this much hassle getting CUPS to work I would have installed Microsoft right?

[Colors]

I had also headaches with SELinux and printing with Samsung ML2525W. You dont have to install the drivers from Samsung. Instead use Fedoras way (system-config-printer), select device AppSocket/HP JetDirect, complete with your printer IP (192.168....), port 9100, forward, pick Samsung from the list, Model 2550, driver Samsung ML-2550 Foomatic/ljet4 en, forward, apply. Print a test page.

I have selinux enabled, enforcing mode.

[goodricm]

Thanks for the heads up Colors. I don't have time to try out the solution right now but will have a go tonight when I get home. I'll let you knw how I get on.

Regds,
Martin