diff -up cups-1.6.3/config.h.in.lspp cups-1.6.3/config.h.in

--- cups-1.6.3/config.h.in.lspp	2013-07-12 11:54:00.974623350 +0200

+++ cups-1.6.3/config.h.in	2013-07-12 11:54:01.013622809 +0200

@@ -747,6 +747,13 @@ static __inline int _cups_abs(int i) { r

 #  endif /* __GNUC__ || __STDC_VERSION__ */

 #endif /* !HAVE_ABS && !abs */

+/*

+ * Are we trying to meet LSPP requirements?

+ */

+

+#undef WITH_LSPP

+

+

 #endif /* !_CUPS_CONFIG_H_ */

 /*

diff -up cups-1.6.3/config-scripts/cups-lspp.m4.lspp cups-1.6.3/config-scripts/cups-lspp.m4

--- cups-1.6.3/config-scripts/cups-lspp.m4.lspp	2013-07-12 11:54:01.013622809 +0200

+++ cups-1.6.3/config-scripts/cups-lspp.m4	2013-07-12 11:54:01.013622809 +0200

@@ -0,0 +1,36 @@

+dnl

+dnl   LSPP code for the Common UNIX Printing System (CUPS).

+dnl

+dnl   Copyright 2005-2006 by Hewlett-Packard Development Company, L.P.

+dnl

+dnl   This program is free software; you can redistribute it and/or modify

+dnl   it under the terms of the GNU General Public License as published by

+dnl   the Free Software Foundation; version 2.

+dnl

+dnl   This program is distributed in the hope that it will be useful, but

+dnl   WITHOUT ANY WARRANTY; without even the implied warranty of

+dnl   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU

+dnl   General Public License for more details.

+dnl

+dnl   You should have received a copy of the GNU General Public License

+dnl   along with this program; if not, write to the Free Software Foundation,

+dnl   Inc., 51 Franklin Street, Fifth Floor Boston, MA 02110-1301 USA

+dnl

+

+dnl Are we trying to meet LSPP requirements

+AC_ARG_ENABLE(lspp, [  --enable-lspp           turn on auditing and label support, default=no])

+

+if test x"$enable_lspp" != xno; then

+    case "$uname" in

+        Linux)

+            AC_CHECK_LIB(audit,audit_log_user_message, [LIBAUDIT="-laudit" AC_SUBST(LIBAUDIT)])

+            AC_CHECK_HEADER(libaudit.h)

+            AC_CHECK_LIB(selinux,getpeercon, [LIBSELINUX="-lselinux" AC_SUBST(LIBSELINUX)])

+            AC_CHECK_HEADER(selinux/selinux.h)

+            AC_DEFINE(WITH_LSPP)

+            ;;

+        *)

+            # All others

+            ;;

+    esac

+fi

diff -up cups-1.6.3/configure.in.lspp cups-1.6.3/configure.in

--- cups-1.6.3/configure.in.lspp	2013-07-12 11:54:00.974623350 +0200

+++ cups-1.6.3/configure.in	2013-07-12 11:54:01.013622809 +0200

@@ -37,6 +37,8 @@ sinclude(config-scripts/cups-systemd.m4)

 sinclude(config-scripts/cups-defaults.m4)

 sinclude(config-scripts/cups-scripting.m4)

+sinclude(config-scripts/cups-lspp.m4)

+

 INSTALL_LANGUAGES=""

 UNINSTALL_LANGUAGES=""

 LANGFILES=""

diff -up cups-1.6.3/filter/common.c.lspp cups-1.6.3/filter/common.c

--- cups-1.6.3/filter/common.c.lspp	2013-06-07 03:12:52.000000000 +0200

+++ cups-1.6.3/filter/common.c	2013-07-12 11:54:01.014622795 +0200

@@ -30,6 +30,12 @@

  * Include necessary headers...

  */

+#include "config.h"

+#ifdef WITH_LSPP

+#define _GNU_SOURCE

+#include <string.h>

+#endif /* WITH_LSPP */

+

 #include "common.h"

 #include <locale.h>

@@ -312,6 +318,18 @@ WriteLabelProlog(const char *label,	/* I

 {

   const char	*classification;	/* CLASSIFICATION environment variable */

   const char	*ptr;			/* Temporary string pointer */

+#ifdef WITH_LSPP

+  int           i,                      /* counter */

+                n,                      /* counter */

+                lines,                  /* number of lines needed */

+                line_len,               /* index into tmp_label */

+                label_len,              /* length of the label in characters */

+                label_index,            /* index into the label */

+                longest,                /* length of the longest line */

+                longest_line,           /* index to the longest line */

+                max_width;              /* maximum width in characters */

+  char          **wrapped_label;        /* label with line breaks */

+#endif /* WITH_LSPP */

  /*

@@ -334,6 +352,124 @@ WriteLabelProlog(const char *label,	/* I

     return;

   }

+#ifdef WITH_LSPP

+  if (strncmp(classification, "LSPP:", 5) == 0 && label == NULL)

+  {

+   /*

+    * Based on the 12pt fixed width font below determine the max_width

+    */

+    max_width = width / 8;

+    longest_line = 0;

+    longest = 0;

+    classification += 5; // Skip the "LSPP:"

+    label_len = strlen(classification);

+

+    if (label_len > max_width)

+    {

+      lines = 1 + (int)(label_len / max_width);

+      line_len = (int)(label_len / lines);

+      wrapped_label = malloc(sizeof(*wrapped_label) * lines);

+      label_index = i = n = 0;

+      while (classification[label_index])

+      {

+        if ((label_index + line_len) > label_len)

+          break;

+        switch (classification[label_index + line_len + i])

+        {

+          case ':':

+          case ',':

+          case '-':

+            i++;

+            wrapped_label[n++] = strndup(&classification[label_index], (line_len + i));

+            label_index += line_len + i;

+            i = 0;

+            break;

+          default:

+            i++;

+            break;

+        }

+        if ((i + line_len) == max_width)

+        {

+          wrapped_label[n++] = strndup(&(classification[label_index]), (line_len + i));

+          label_index = label_index + line_len + i;

+          i = 0;

+        }

+      }

+      wrapped_label[n] = strndup(&classification[label_index], label_len - label_index);

+    }

+    else

+    {

+      lines = 1;

+      wrapped_label = malloc(sizeof(*wrapped_label));

+      wrapped_label[0] = (char*)classification;

+    }

+

+    for (n = 0; n < lines; n++ )

+    {

+      printf("userdict/ESPp%c(", ('a' + n));

+      for (ptr = wrapped_label[n], i = 0; *ptr; ptr ++, i++)

+        if (*ptr < 32 || *ptr > 126)

+          printf("\\%03o", *ptr);

+        else

+        {

+          if (*ptr == '(' || *ptr == ')' || *ptr == '\\')

+            putchar('\\');

+

+          printf("%c", *ptr);

+        }

+      if (i > longest)

+      {

+        longest = i;

+        longest_line = n;

+      }

+      printf(")put\n");

+    }

+

+   /*

+    * For LSPP use a fixed width font so that line wrapping can be calculated

+    */

+

+    puts("userdict/ESPlf /Nimbus-Mono findfont 12 scalefont put");

+

+   /*

+    * Finally, the procedure to write the labels on the page...

+    */

+

+    printf("userdict/ESPwl{\n"

+           "  ESPlf setfont\n");

+    printf("  ESPp%c stringwidth pop dup 12 add exch -0.5 mul %.0f add\n ",

+           'a' + longest_line, width * 0.5f);

+    for (n = 1; n < lines; n++)

+      printf(" dup");

+    printf("\n  1 setgray\n");

+    printf("  dup 6 sub %.0f %d index %.0f ESPrf\n",

+           (bottom - 2.0), (2 + lines), 6.0 + (16.0 * lines));

+    printf("  dup 6 sub %.0f %d index %.0f ESPrf\n",

+           (top - 6.0 - (16.0 * lines)), (2 + lines), 4.0 + (16.0 * lines));

+    printf("  0 setgray\n");

+    printf("  dup 6 sub %.0f %d index %.0f ESPrs\n",

+           (bottom - 2.0), (2 + lines), 6.0 + (16.0 * lines));

+    printf("  dup 6 sub %.0f %d index %.0f ESPrs\n",

+           (top - 6.0 - (16.0 * lines)), (2 + lines), 4.0 + (16.0 * lines));

+    for (n = 0; n < lines; n ++)

+    {

+      printf("  dup %.0f moveto ESPp%c show\n",

+             bottom + 6.0 + ((lines - (n+1)) * 16.0), 'a' + n);

+      printf("  %.0f moveto ESPp%c show\n", top + 2.0 - ((n + 1) * 16.0), 'a' + n);

+    }

+    printf("  pop\n"

+           "}bind put\n");

+

+   /*

+    * Do some clean up at the end of the LSPP special case

+    */

+    free(wrapped_label);

+

+  }

+  else

+  {

+#endif /* !WITH_LSPP */

+  

  /*

   * Set the classification + page label string...

   */

@@ -414,7 +550,10 @@ WriteLabelProlog(const char *label,	/* I

   printf("  %.0f moveto ESPpl show\n", top - 14.0);

   puts("pop");

   puts("}bind put");

+  }

+#ifdef WITH_LSPP

 }

+#endif /* WITH_LSPP */

 /*

diff -up cups-1.6.3/filter/pstops.c.lspp cups-1.6.3/filter/pstops.c

--- cups-1.6.3/filter/pstops.c.lspp	2013-06-07 03:12:52.000000000 +0200

+++ cups-1.6.3/filter/pstops.c	2013-07-12 11:54:01.015622781 +0200

@@ -3202,6 +3202,18 @@ write_label_prolog(pstops_doc_t *doc,	/*

 {

   const char	*classification;	/* CLASSIFICATION environment variable */

   const char	*ptr;			/* Temporary string pointer */

+#ifdef WITH_LSPP

+  int           i,                      /* counter */

+                n,                      /* counter */

+                lines,                  /* number of lines needed */

+                line_len,               /* index into tmp_label */

+                label_len,              /* length of the label in characters */

+                label_index,            /* index into the label */

+                longest,                /* length of the longest line */

+                longest_line,           /* index to the longest line */

+                max_width;              /* maximum width in characters */

+  char          **wrapped_label;        /* label with line breaks */

+#endif /* WITH_LSPP */

  /*

@@ -3224,6 +3236,124 @@ write_label_prolog(pstops_doc_t *doc,	/*

     return;

   }

+#ifdef WITH_LSPP

+  if (strncmp(classification, "LSPP:", 5) == 0 && label == NULL)

+  {

+   /*

+    * Based on the 12pt fixed width font below determine the max_width

+    */

+    max_width = width / 8;

+    longest_line = 0;

+    longest = 0;

+    classification += 5; // Skip the "LSPP:"

+    label_len = strlen(classification);

+

+    if (label_len > max_width)

+    {

+      lines = 1 + (int)(label_len / max_width);

+      line_len = (int)(label_len / lines);

+      wrapped_label = malloc(sizeof(*wrapped_label) * lines);

+      label_index = i = n = 0;

+      while (classification[label_index])

+      {

+        if ((label_index + line_len) > label_len)

+          break;

+        switch (classification[label_index + line_len + i])

+        {

+          case ':':

+          case ',':

+          case '-':

+            i++;

+            wrapped_label[n++] = strndup(&classification[label_index], (line_len + i));

+            label_index += line_len + i;

+            i = 0;

+            break;

+          default:

+            i++;

+            break;

+        }

+        if ((i + line_len) == max_width)

+        {

+          wrapped_label[n++] = strndup(&(classification[label_index]), (line_len + i));

+          label_index = label_index + line_len + i;

+          i = 0;

+        }

+      }

+      wrapped_label[n] = strndup(&classification[label_index], label_len - label_index);

+    }

+    else

+    {

+      lines = 1;

+      wrapped_label = malloc(sizeof(*wrapped_label));

+      wrapped_label[0] = (char*)classification;

+    }

+

+    for (n = 0; n < lines; n++ )

+    {

+      printf("userdict/ESPp%c(", ('a' + n));

+      for (ptr = wrapped_label[n], i = 0; *ptr; ptr ++, i++)

+        if (*ptr < 32 || *ptr > 126)

+          printf("\\%03o", *ptr);

+        else

+        {

+          if (*ptr == '(' || *ptr == ')' || *ptr == '\\')

+            putchar('\\');

+

+          printf("%c", *ptr);

+        }

+      if (i > longest)

+      {

+        longest = i;

+        longest_line = n;

+      }

+      printf(")put\n");

+    }

+

+   /*

+    * For LSPP use a fixed width font so that line wrapping can be calculated

+    */

+

+    puts("userdict/ESPlf /Nimbus-Mono findfont 12 scalefont put");

+

+   /*

+    * Finally, the procedure to write the labels on the page...

+    */

+

+    printf("userdict/ESPwl{\n"

+           "  ESPlf setfont\n");

+    printf("  ESPp%c stringwidth pop dup 12 add exch -0.5 mul %.0f add\n ",

+           'a' + longest_line, width * 0.5f);

+    for (n = 1; n < lines; n++)

+      printf(" dup");

+    printf("\n  1 setgray\n");

+    printf("  dup 6 sub %.0f %d index %.0f ESPrf\n",

+           (bottom - 2.0), (2 + lines), 6.0 + (16.0 * lines));

+    printf("  dup 6 sub %.0f %d index %.0f ESPrf\n",

+           (top - 6.0 - (16.0 * lines)), (2 + lines), 4.0 + (16.0 * lines));

+    printf("  0 setgray\n");

+    printf("  dup 6 sub %.0f %d index %.0f ESPrs\n",

+           (bottom - 2.0), (2 + lines), 6.0 + (16.0 * lines));

+    printf("  dup 6 sub %.0f %d index %.0f ESPrs\n",

+           (top - 6.0 - (16.0 * lines)), (2 + lines), 4.0 + (16.0 * lines));

+    for (n = 0; n < lines; n ++)

+    {

+      printf("  dup %.0f moveto ESPp%c show\n",

+             bottom + 6.0 + ((lines - (n+1)) * 16.0), 'a' + n);

+      printf("  %.0f moveto ESPp%c show\n", top + 2.0 - ((n + 1) * 16.0), 'a' + n);

+    }

+    printf("  pop\n"

+           "}bind put\n");

+

+   /*

+    * Do some clean up at the end of the LSPP special case

+    */

+    free(wrapped_label);

+

+  }

+  else

+  {

+#endif /* !WITH_LSPP */

+

  /*

   * Set the classification + page label string...

   */

@@ -3302,7 +3432,10 @@ write_label_prolog(pstops_doc_t *doc,	/*

   doc_printf(doc, "  %.0f moveto ESPpl show\n", top - 14.0);

   doc_puts(doc, "pop\n");

   doc_puts(doc, "}bind put\n");

+  }

+#ifdef WITH_LSPP

 }

+#endif /* WITH_LSPP */

 /*

diff -up cups-1.6.3/Makedefs.in.lspp cups-1.6.3/Makedefs.in

--- cups-1.6.3/Makedefs.in.lspp	2013-07-12 11:54:00.976623322 +0200

+++ cups-1.6.3/Makedefs.in	2013-07-12 11:54:01.015622781 +0200

@@ -146,7 +146,7 @@ LDFLAGS		=	-L../cgi-bin -L../cups -L../f

 			@LDFLAGS@ @RELROFLAGS@ @PIEFLAGS@ $(OPTIM)

 LINKCUPS	=	@LINKCUPS@ $(LIBGSSAPI) $(SSLLIBS) $(DNSSDLIBS) $(LIBZ)

 LINKCUPSIMAGE	=	@LINKCUPSIMAGE@

-LIBS		=	$(LINKCUPS) $(COMMONLIBS)

+LIBS		=	$(LINKCUPS) $(COMMONLIBS) @LIBAUDIT@ @LIBSELINUX@

 OPTIM		=	@OPTIM@

 OPTIONS		=

 PAMLIBS		=	@PAMLIBS@

diff -up cups-1.6.3/scheduler/client.c.lspp cups-1.6.3/scheduler/client.c

--- cups-1.6.3/scheduler/client.c.lspp	2013-06-07 03:12:52.000000000 +0200

+++ cups-1.6.3/scheduler/client.c	2013-07-12 11:54:01.017622754 +0200

@@ -41,6 +41,7 @@

  *   valid_host()	    - Is the Host: field valid?

  *   write_file()	    - Send a file via HTTP.

  *   write_pipe()	    - Flag that data is available on the CGI pipe.

+ *   client_pid_to_auid()   - Get the audit login uid of the client.

  */

 /*

@@ -49,10 +50,16 @@

 #include "cupsd.h"

+#define _GNU_SOURCE

 #ifdef HAVE_TCPD_H

 #  include <tcpd.h>

 #endif /* HAVE_TCPD_H */

+#ifdef WITH_LSPP

+#include <selinux/selinux.h>

+#include <selinux/context.h>

+#include <fcntl.h>

+#endif /* WITH_LSPP */

 /*

  * Local globals...

@@ -371,6 +378,57 @@ cupsdAcceptClient(cupsd_listener_t *lis)

   }

 #endif /* HAVE_TCPD_H */

+#ifdef WITH_LSPP

+  if (is_lspp_config())

+  {

+    struct ucred cr;

+    unsigned int cl=sizeof(cr);

+

+    if (getsockopt(con->http.fd, SOL_SOCKET, SO_PEERCRED, &cr, &cl) == 0)

+    {

+     /*

+      * client_pid_to_auid() can be racey

+      * In this case the pid is based on a socket connected to the client

+      */

+      if ((con->auid = client_pid_to_auid(cr.pid)) == -1)

+      {

+        close(con->http.fd);

+        cupsdLogMessage(CUPSD_LOG_ERROR, "cupsdAcceptClient: "

+                        "unable to determine client auid for client pid=%d", cr.pid);

+        free(con);

+        return;

+      }

+      cupsdLogMessage(CUPSD_LOG_INFO, "cupsdAcceptClient: peer's pid=%d, uid=%d, gid=%d, auid=%d",

+                      cr.pid, cr.uid, cr.gid, con->auid);

+    }

+    else

+    {

+      close(con->http.fd);

+      cupsdLogMessage(CUPSD_LOG_ERROR, "cupsdAcceptClient: getsockopt() failed");

+      free(con);

+      return; 

+    }

+

+   /*

+    * get the context of the peer connection

+    */

+    if (getpeercon(con->http.fd, &con->scon))

+    {

+      close(con->http.fd);

+      cupsdLogMessage(CUPSD_LOG_ERROR, "cupsdAcceptClient: getpeercon() failed");

+      free(con);

+      return; 

+    }

+

+    cupsdLogMessage(CUPSD_LOG_INFO, "cupsdAcceptClient: client context=%s", con->scon);

+  }

+  else

+  {

+    cupsdLogMessage(CUPSD_LOG_DEBUG, "cupsdAcceptClient: skipping getpeercon()");

+    cupsdSetString(&con->scon, UNKNOWN_SL);

+  }

+#endif /* WITH_LSPP */

+

 #ifdef AF_LOCAL

   if (con->http.hostaddr->addr.sa_family == AF_LOCAL)

     cupsdLogMessage(CUPSD_LOG_DEBUG, "[Client %d] Accepted from %s (Domain)",

@@ -678,6 +736,13 @@ cupsdReadClient(cupsd_client_t *con)	/*

   mime_type_t		*type;		/* MIME type of file */

   cupsd_printer_t	*p;		/* Printer */

   static unsigned	request_id = 0;	/* Request ID for temp files */

+#ifdef WITH_LSPP

+  security_context_t	spoolcon;	/* context of the job file */

+  context_t		clicon;		/* contex_t container for con->scon */

+  context_t		tmpcon;		/* temp context to swap the level */

+  char			*clirange;	/* SELinux sensitivity range */

+  char			*cliclearance;	/* SELinux low end clearance */

+#endif /* WITH_LSPP */

   status = HTTP_CONTINUE;

@@ -2134,6 +2199,67 @@ cupsdReadClient(cupsd_client_t *con)	/*

 	    fchmod(con->file, 0640);

 	    fchown(con->file, RunUser, Group);

             fcntl(con->file, F_SETFD, fcntl(con->file, F_GETFD) | FD_CLOEXEC);

+#ifdef WITH_LSPP

+	    if (strncmp(con->scon, UNKNOWN_SL, strlen(UNKNOWN_SL)) != 0)

+	    {

+	      if (getfilecon(con->filename, &spoolcon) == -1)

+	      {

+		cupsdSendError(con, HTTP_SERVER_ERROR, CUPSD_AUTH_NONE);

+		return (cupsdCloseClient(con));

+	      }

+	      clicon = context_new(con->scon);

+	      tmpcon = context_new(spoolcon);

+	      freecon(spoolcon);

+	      if (!clicon || !tmpcon)

+	      {

+		cupsdSendError(con, HTTP_SERVER_ERROR, CUPSD_AUTH_NONE);

+		if (clicon)

+		  context_free(clicon);

+		if (tmpcon)

+		  context_free(tmpcon);

+		return (cupsdCloseClient(con));

+	      }

+	      clirange = context_range_get(clicon);

+	      if (clirange)

+	      {

+		clirange = strdup(clirange);

+		if ((cliclearance = strtok(clirange, "-")) != NULL)

+		{

+		  if (context_range_set(tmpcon, cliclearance) == -1)

+		  {

+		    cupsdSendError(con, HTTP_SERVER_ERROR, CUPSD_AUTH_NONE);

+		    free(clirange);

+		    context_free(tmpcon);

+		    context_free(clicon);

+		    return (cupsdCloseClient(con));

+		  }

+		}

+		else

+		{

+		  if (context_range_set(tmpcon, (context_range_get(clicon))) == -1)

+		  {

+		    cupsdSendError(con, HTTP_SERVER_ERROR, CUPSD_AUTH_NONE);

+		    free(clirange);

+		    context_free(tmpcon);

+		    context_free(clicon);

+		    return (cupsdCloseClient(con));

+		  }

+		}

+		free(clirange);

+	      }

+	      if (setfilecon(con->filename, context_str(tmpcon)) == -1)

+	      {

+		cupsdSendError(con, HTTP_SERVER_ERROR, CUPSD_AUTH_NONE);

+		context_free(tmpcon);

+		context_free(clicon);

+		return (cupsdCloseClient(con));

+	      }

+	      cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdReadClient: %s set to %s", 

+			      con->filename, context_str(tmpcon));

+	      context_free(tmpcon);

+	      context_free(clicon);

+	    }

+#endif /* WITH_LSPP */

 	  }

 	  if (con->http.state != HTTP_POST_SEND)

@@ -3579,6 +3705,49 @@ is_path_absolute(const char *path)	/* I

   return (1);

 }

+#ifdef WITH_LSPP

+/*

+ * 'client_pid_to_auid()' - Using the client's pid, read /proc and determine the loginuid.

+ */

+

+uid_t client_pid_to_auid(pid_t clipid)

+{

+  uid_t uid;

+  int len, in;

+  char buf[16] = {0};

+  char fname[32] = {0};

+

+

+ /*

+  * Hopefully this pid is still the one we are interested in.

+  */

+  snprintf(fname, 32, "/proc/%d/loginuid", clipid);

+  in = open(fname, O_NOFOLLOW|O_RDONLY);

+

+  if (in < 0)

+    return -1;

+

+  errno = 0;

+

+  do {

+    len = read(in, buf, sizeof(buf));

+  } while (len < 0 && errno == EINTR);

+

+  close(in);

+

+  if (len < 0 || len >= sizeof(buf))

+    return -1;

+

+  errno = 0;

+  buf[len] = 0;

+  uid = strtol(buf, 0, 10);

+

+  if (errno != 0)

+    return -1;

+  else

+    return uid;

+}

+#endif /* WITH_LSPP */

 /*

  * 'pipe_command()' - Pipe the output of a command to the remote client.

diff -up cups-1.6.3/scheduler/client.h.lspp cups-1.6.3/scheduler/client.h

--- cups-1.6.3/scheduler/client.h.lspp	2013-07-12 11:54:00.976623322 +0200

+++ cups-1.6.3/scheduler/client.h	2013-07-12 11:54:01.017622754 +0200

@@ -18,6 +18,13 @@

 #endif /* HAVE_AUTHORIZATION_H */

+/* Copyright (C) 2005 Trusted Computer Solutions, Inc. */

+/* (c) Copyright 2005-2006 Hewlett-Packard Development Company, L.P. */

+

+#ifdef WITH_LSPP

+#include <selinux/selinux.h>

+#endif /* WITH_LSPP */

+

 /*

  * HTTP client structure...

  */

@@ -63,6 +70,10 @@ struct cupsd_client_s

 #ifdef HAVE_AUTHORIZATION_H

   AuthorizationRef	authref;	/* Authorization ref */

 #endif /* HAVE_AUTHORIZATION_H */

+#ifdef WITH_LSPP

+  security_context_t	scon;		/* Security context of connection */

+  uid_t			auid;		/* Audit loginuid of the client */

+#endif /* WITH_LSPP */

 };

 #define HTTP(con) &((con)->http)

@@ -135,6 +146,9 @@ extern void	cupsdStartListening(void);

 extern void	cupsdStopListening(void);

 extern void	cupsdUpdateCGI(void);

 extern void	cupsdWriteClient(cupsd_client_t *con);

+#ifdef WITH_LSPP

+extern uid_t	client_pid_to_auid(pid_t clipid);

+#endif /* WITH_LSPP */

 #ifdef HAVE_SSL

 extern int	cupsdEndTLS(cupsd_client_t *con);

diff -up cups-1.6.3/scheduler/conf.c.lspp cups-1.6.3/scheduler/conf.c

--- cups-1.6.3/scheduler/conf.c.lspp	2013-07-12 11:54:00.911624224 +0200

+++ cups-1.6.3/scheduler/conf.c	2013-07-12 11:54:01.018622740 +0200

@@ -34,6 +34,7 @@

  *   read_location()	      - Read a <Location path> definition.

  *   read_policy()	      - Read a <Policy name> definition.

  *   set_policy_defaults()    - Set default policy values as needed.

+ *   is_lspp_config()         - Is the system configured for LSPP

  */

 /*

@@ -59,6 +60,9 @@

 #  define INADDR_NONE	0xffffffff

 #endif /* !INADDR_NONE */

+#ifdef WITH_LSPP

+#  include <libaudit.h>

+#endif /* WITH_LSPP */

 /*

  * Configuration variable structure...

@@ -146,6 +150,10 @@ static const cupsd_var_t	cupsd_vars[] =

   { "ServerName",		&ServerName,		CUPSD_VARTYPE_STRING },

   { "StrictConformance",	&StrictConformance,	CUPSD_VARTYPE_BOOLEAN },

   { "Timeout",			&Timeout,		CUPSD_VARTYPE_TIME },

+#ifdef WITH_LSPP

+  { "AuditLog",			&AuditLog,		CUPSD_VARTYPE_INTEGER },

+  { "PerPageLabels",		&PerPageLabels,		CUPSD_VARTYPE_BOOLEAN },

+#endif /* WITH_LSPP */

   { "WebInterface",		&WebInterface,		CUPSD_VARTYPE_BOOLEAN }

 };

 static const cupsd_var_t	cupsfiles_vars[] =

@@ -545,6 +553,9 @@ cupsdReadConfiguration(void)

   const char	*tmpdir;		/* TMPDIR environment variable */

   struct stat	tmpinfo;		/* Temporary directory info */

   cupsd_policy_t *p;			/* Policy */

+#ifdef WITH_LSPP

+  char		*audit_message;		/* Audit message string */

+#endif /* WITH_LSPP */

  /*

@@ -851,6 +862,25 @@ cupsdReadConfiguration(void)

   RunUser = getuid();

+#ifdef WITH_LSPP

+  if (AuditLog != -1)

+  {

+   /*

+    * ClassifyOverride is set during read_configuration, if its ON, report it now

+    */

+    if (ClassifyOverride)

+      audit_log_user_message(AuditLog, AUDIT_USYS_CONFIG,

+                "[Config] ClassifyOverride=enabled Users can override print banners",

+                ServerName, NULL, NULL, 1);

+   /*

+    * PerPageLabel is set during read_configuration, if its OFF, report it now

+    */

+    if (!PerPageLabels)

+      audit_log_user_message(AuditLog, AUDIT_USYS_CONFIG,

+                "[Config] PerPageLabels=disabled", ServerName, NULL, NULL, 1);

+  }

+#endif /* WITH_LSPP */

+

   cupsdLogMessage(CUPSD_LOG_INFO, "Remote access is %s.",

                   RemotePort ? "enabled" : "disabled");

@@ -1253,7 +1283,19 @@ cupsdReadConfiguration(void)

     cupsdClearString(&Classification);

   if (Classification)

+  {

     cupsdLogMessage(CUPSD_LOG_INFO, "Security set to \"%s\"", Classification);

+#ifdef WITH_LSPP

+    if (AuditLog != -1)

+    {

+      audit_message = NULL;

+      cupsdSetStringf(&audit_message, "[Config] Classification=%s", Classification);

+      audit_log_user_message(AuditLog, AUDIT_LABEL_LEVEL_CHANGE, audit_message,

+                             ServerName, NULL, NULL, 1);

+      cupsdClearString(&audit_message);

+    }

+#endif /* WITH_LSPP */

+  }

  /*

   * Check the MaxClients setting, and then allocate memory for it...

@@ -3639,6 +3681,18 @@ read_location(cups_file_t *fp,		/* I - C

   return ((FatalErrors & CUPSD_FATAL_CONFIG) ? 0 : linenum);

 }

+#ifdef WITH_LSPP

+int is_lspp_config()

+{

+  if (Classification != NULL)

+    return ((_cups_strcasecmp(Classification, MLS_CONFIG) == 0) 

+            || (_cups_strcasecmp(Classification, TE_CONFIG) == 0)

+            || (_cups_strcasecmp(Classification, SELINUX_CONFIG) == 0));

+  else

+    return 0;

+}

+#endif /* WITH_LSPP */

+

 /*

  * 'read_policy()' - Read a <Policy name> definition.

diff -up cups-1.6.3/scheduler/conf.h.lspp cups-1.6.3/scheduler/conf.h

--- cups-1.6.3/scheduler/conf.h.lspp	2013-07-12 11:54:00.911624224 +0200

+++ cups-1.6.3/scheduler/conf.h	2013-07-12 11:54:01.019622726 +0200

@@ -249,6 +249,13 @@ VAR int			SSLOptions		VALUE(CUPSD_SSL_NO

 					/* SSL/TLS options */

 #endif /* HAVE_SSL */

+#ifdef WITH_LSPP

+VAR int			AuditLog		VALUE(-1),

+					/* File descriptor for audit */

+			PerPageLabels		VALUE(TRUE);

+					/* Put the label on each page */

+#endif /* WITH_LSPP */

+

 #ifdef HAVE_LAUNCHD

 VAR int			LaunchdTimeout		VALUE(10);

 					/* Time after which an idle cupsd will exit */

@@ -267,6 +274,9 @@ int			HaveServerCreds		VALUE(0);

 gss_cred_id_t		ServerCreds;	/* Server's GSS credentials */

 #endif /* HAVE_GSSAPI */

+#ifdef WITH_LSPP

+extern int		is_lspp_config(void);

+#endif /* WITH_LSPP */

 /*

  * Prototypes...

diff -up cups-1.6.3/scheduler/cupsd.h.lspp cups-1.6.3/scheduler/cupsd.h

--- cups-1.6.3/scheduler/cupsd.h.lspp	2013-07-12 11:54:01.005622920 +0200

+++ cups-1.6.3/scheduler/cupsd.h	2013-07-12 11:54:01.019622726 +0200

@@ -13,6 +13,8 @@

  *   file is missing or damaged, see the license at "http://www.cups.org/".

  */

+/* Copyright (C) 2005 Trusted Computer Solutions, Inc. */

+/* (c) Copyright 2005-2006 Hewlett-Packard Development Company, L.P. */

 /*

  * Include necessary headers.

@@ -37,13 +39,20 @@

 #  include <unistd.h>

 #endif /* WIN32 */

+#include "config.h"

+#ifdef WITH_LSPP

+#  define MLS_CONFIG "mls"

+#  define TE_CONFIG "te"

+#  define SELINUX_CONFIG "SELinux"

+#  define UNKNOWN_SL "UNKNOWN SL"

+#endif /* WITH_LSPP */

+

 #include "mime.h"

 #if defined(HAVE_CDSASSL)

 #  include <CoreFoundation/CoreFoundation.h>

 #endif /* HAVE_CDSASSL */

-

 /*

  * Some OS's don't have hstrerror(), most notably Solaris...

  */

diff -up cups-1.6.3/scheduler/ipp.c.lspp cups-1.6.3/scheduler/ipp.c

--- cups-1.6.3/scheduler/ipp.c.lspp	2013-07-12 11:54:00.940623822 +0200

+++ cups-1.6.3/scheduler/ipp.c	2013-07-12 11:54:01.022622684 +0200

@@ -35,6 +35,7 @@

  *   cancel_all_jobs()           - Cancel all or selected print jobs.

  *   cancel_job()                - Cancel a print job.

  *   cancel_subscription()       - Cancel a subscription.

+ *   check_context()             - Check the SELinux context for a user and job

  *   check_rss_recipient()       - Check that we do not have a duplicate RSS

  *                                 feed URI.

  *   check_quotas()              - Check quotas for a printer and user.

@@ -99,6 +100,9 @@

  *   validate_user()             - Validate the user for the request.

  */