[cups-devel] Sharing printers ACLs with remote client (f.e. cups-browsed) - opinions?

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)

--Boundary_(ID_eyIjrW89n9smlN7uIrG46g)
Content-type: multipart/signed; micalg=pgp-sha256;
 protocol="application/pgp-signature";
 boundary=xHzZ5ERn1CS6CPX3Yf0co0QAkaoZx0rsK

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--xHzZ5ERn1CS6CPX3Yf0co0QAkaoZx0rsK
Content-Type: multipart/mixed; boundary="gfbNkjBAQQP2jc3qRmFxFWSJgU0wFDcYK";
 protected-headers="v1"
From: Zdenek Dohnal <[email protected]>
To: "The CUPS developer list." <[email protected]>
Message-ID: <26c1a67f-a6f8-bdd6-650a-334e5aa062ac-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
Subject: Sharing printers ACLs with remote client (f.e. cups-browsed) -
 opinions?

--gfbNkjBAQQP2jc3qRmFxFWSJgU0wFDcYK
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Content-Language: en-US

Hi everyone,

I'm currently working on feature for cups-browsed daemon, which would
ask cupsd in IPP request (with operation CUPS-Get-Printers, with all
necessary attributes and with requesting-user-name-allowed and
requesting-user-name-denied attributes in requested-attributes field)
and would create local print queue with ACL from remote CUPS -
basically, remote CUPS would share printer ACL with client
(cups-browsed) and client would issue print queue creation with ACL to
local CUPS daemon.

It seems a print queue on remote server needs to have allowed user
'remroot' in its ACL to get printer into the IPP response (because
cups-browsed runs as root, so there is user 'root' in the IPP request's
'requesting-user-name' attribute, which is later replaced by 'remroot'
in cups daemon). If remroot is not in allowed users, then the printer is
not added into IPP response.

I would like to ask for opinion on the feature:

1) Is it even reasonable to have such feature? Like will it bring
problems or security concerns? I can only think of some scenarios where
two users on different machines have the same names and the program will
not recognize the difference between them (if one has the right to print
and other does not), but IMHO it is more admin error...

2) Is it good to have 'remroot' user in printer's ACL?

3) Would the feature need a change in CUPS code? IMO the feature does
not need any change to CUPS code, but maybe I'm missing something...

4) Is it defined in RFC/PWG docs how many user names can be in
requesting-user-name-allowed/denied attributes? I only found definition
'1setOf name(127)', which IIUC means X number of usernames of max length
127.

5) Any other opinions/concerns?


Thank you for reading this far and thanks for answers in advance!

Have a nice day,

Zdenek

--=20
Zdenek Dohnal
Associate Software Engineer
Red Hat Czech - Brno TPB-C



--gfbNkjBAQQP2jc3qRmFxFWSJgU0wFDcYK--

--xHzZ5ERn1CS6CPX3Yf0co0QAkaoZx0rsK--

--Boundary_(ID_eyIjrW89n9smlN7uIrG46g)
MIME-version: 1.0
Content-type: text/plain; CHARSET=US-ASCII
Content-transfer-encoding: 7BIT
Content-disposition: inline

_______________________________________________
cups-devel mailing list
[email protected]
https://lists.cups.org/mailman/listinfo/cups-devel

--Boundary_(ID_eyIjrW89n9smlN7uIrG46g)--