Klaus Heinrich Kiwi wrote: > Klaus, > > I think we have a confusion in the ConfigureCups() function, that may be > partly my fault :) > > Seems that 'ClassifyOverride' doesn't affect if the the classification > override will be allowed of not. In both cases, you can only override one > banner (leading or trailing), but not both. > > The difference is that with 'ClassifyOverride' disabled, if we try to > suppress both banners, an audit record is generated and overriding is > ignoring. Cups ends printing both banners: > LABEL_OVERRIDE: user pid=25164 uid=0 auid=503 > subj=system_u:system_r:cupsd_t:s15:c0.c1023 msg=job=61 user supplied > job-sheets=none,none ignored banners=mls,mls: exe=/usr/sbin/cupsd hostx > addr=x terminal=? res=failed > > > When it's enabled, overriding both banners will also fail, but cups then > ends printing just the first mls banner: > LABEL_OVERRIDE: user pid=22117 uid=0 auid=503 > subj=system_u:system_r:cupsd_t:s15:c0.c1023 msg=job=51 user supplied > job-sheets=none,none ignored banners=mls,none: exe=/usr/sbin/cupsd host=x > addr=x terminal=? res=failed > > I think the current configuration is fine, since either will be able to > attend lspp requirement (imo), but you might want to change the comments. > > Maybe Matt has a better understanding of this than me.
When I first found this behavior I thought it was very odd as well. I even went so far as to mail the maintainers asking if I found a bug. Its not quite as bad as its written up above. When ClassifyOverride is enabled and Classification is set you cannot disable both banners, but you can specify a different banner. For example: ClassifyOverride yes Classification mls lpr -o job-sheets=none,none # generates a job with mls,none lpr -o job-sheets=te,none # now the job prints with te,none Its also worth noting that in that last case the per page label is now the TE label instead of the MLS label. What ever ends up being the leading banner ends up as the label on each page. With ClassifyOverride you can change which banner is chosen, but since Classification is set you can't disable all banners. Its odd, and not well documented, but thats how it works. -matt -- redhat-lspp mailing list [email protected] https://www.redhat.com/mailman/listinfo/redhat-lspp
