--- nsaserefpolicy/policy/modules/services/cups.fc	2008-08-07 11:15:11.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/services/cups.fc	2008-08-14 13:53:54.000000000 -0400
@@ -8,6 +8,7 @@
 /etc/cups/ppd/.*	--	gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
 /etc/cups/ppds\.dat	--	gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
 /etc/cups/printers\.conf.* --	gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
+/etc/cups/subscriptions.*  --	gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
 /etc/cups/certs		-d	gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
 /etc/cups/certs/.*	--	gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
 
@@ -16,16 +17,21 @@
 /etc/printcap.* 	--	gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
 
 /usr/bin/cups-config-daemon --	gen_context(system_u:object_r:cupsd_config_exec_t,s0)
+/usr/bin/hpijs		--	gen_context(system_u:object_r:hplip_exec_t,s0)
 
-/usr/lib(64)?/cups/backend/.* -- gen_context(system_u:object_r:cupsd_exec_t,s0)
-/usr/lib(64)?/cups/daemon/.*	-- gen_context(system_u:object_r:cupsd_exec_t,s0)
-/usr/lib(64)?/cups/daemon/cups-lpd -- gen_context(system_u:object_r:cupsd_lpd_exec_t,s0)
+/usr/lib/cups/daemon/cups-lpd -- gen_context(system_u:object_r:cupsd_lpd_exec_t,s0)
+/usr/lib64/cups/daemon/cups-lpd -- gen_context(system_u:object_r:cupsd_lpd_exec_t,s0)
 
 /usr/libexec/hal_lpadmin --	gen_context(system_u:object_r:cupsd_config_exec_t,s0)
 
 /usr/sbin/cupsd		--	gen_context(system_u:object_r:cupsd_exec_t,s0)
 /usr/sbin/hal_lpadmin --	gen_context(system_u:object_r:cupsd_config_exec_t,s0)
 /usr/sbin/hpiod		--	gen_context(system_u:object_r:hplip_exec_t,s0)
+/usr/sbin/hp-[^/]+	--	gen_context(system_u:object_r:hplip_exec_t,s0)
+# keep as separate lines to ensure proper sorting
+/usr/lib/cups/backend/hp.* -- gen_context(system_u:object_r:hplip_exec_t,s0)
+/usr/lib64/cups/backend/hp.* -- gen_context(system_u:object_r:hplip_exec_t,s0)
+
 /usr/sbin/printconf-backend --	gen_context(system_u:object_r:cupsd_config_exec_t,s0)
 /usr/sbin/ptal-printd	--	gen_context(system_u:object_r:ptal_exec_t,s0)
 /usr/sbin/ptal-mlcd	--	gen_context(system_u:object_r:ptal_exec_t,s0)
@@ -33,7 +39,7 @@
 
 /usr/share/cups(/.*)?		gen_context(system_u:object_r:cupsd_etc_t,s0)
 /usr/share/foomatic/db/oldprinterids --	gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
-/usr/share/hplip/hpssd\.py --	gen_context(system_u:object_r:hplip_exec_t,s0)
+/usr/share/hplip/.*\.py --	gen_context(system_u:object_r:hplip_exec_t,s0)
 
 /var/cache/alchemist/printconf.* gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
 /var/cache/foomatic(/.*)? 	gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
@@ -50,3 +56,13 @@
 /var/run/hp.*\.port	--	gen_context(system_u:object_r:hplip_var_run_t,s0)
 /var/run/ptal-printd(/.*)?	gen_context(system_u:object_r:ptal_var_run_t,s0)
 /var/run/ptal-mlcd(/.*)?	gen_context(system_u:object_r:ptal_var_run_t,s0)
+
+/usr/local/Brother/inf(/.*)?	gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
+/usr/local/Brother/[^/]*/inf(/.*)?      gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
+/usr/local/Printer/[^/]*/inf(/.*)?      gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
+
+/etc/rc.d/init.d/cups	--	gen_context(system_u:object_r:cups_script_exec_t,s0)
+
+/usr/local/linuxprinter/ppd(/.*)?      gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
+
+/usr/lib/cups/backend/cups-pdf	--	gen_context(system_u:object_r:cups_pdf_exec_t,s0)
--- nsaserefpolicy/policy/modules/services/cups.if	2008-08-07 11:15:11.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/services/cups.if	2008-08-14 13:53:54.000000000 -0400
@@ -20,6 +20,30 @@
 
 ########################################
 ## <summary>
+##	Setup cups to transtion to the cups backend domain
+## </summary>
+## <param name="domain">
+##	<summary>
+##	The type of the process performing this action.
+##	</summary>
+## </param>
+#
+interface(`cups_backend',`
+	gen_require(`
+		type cupsd_t;
+	')
+
+	domtrans_pattern(cupsd_t, $2, $1)
+
+	allow cupsd_t $1:process signal;
+	allow $1 cupsd_t:unix_stream_socket connected_stream_socket_perms;
+
+	cups_read_config($1)
+	cups_append_log($1)
+')
+
+########################################
+## <summary>
 ##	Connect to cupsd over an unix domain stream socket.
 ## </summary>
 ## <param name="domain">
@@ -212,6 +236,25 @@
 
 ########################################
 ## <summary>
+##	Append cups log files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`cups_append_log',`
+	gen_require(`
+		type cupsd_log_t;
+	')
+
+	logging_search_logs($1)
+	append_files_pattern($1, cupsd_log_t, cupsd_log_t)
+')
+
+########################################
+## <summary>
 ##	Write cups log files.
 ## </summary>
 ## <param name="domain">
@@ -247,3 +290,99 @@
 	files_search_pids($1)
 	stream_connect_pattern($1, ptal_var_run_t, ptal_var_run_t, ptal_t)
 ')
+
+########################################
+## <summary>
+##	Execute cups server in the cups domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	The type of the process performing this action.
+##	</summary>
+## </param>
+#
+#
+interface(`cups_script_domtrans',`
+	gen_require(`
+		type cups_script_exec_t;
+	')
+
+	init_script_domtrans_spec($1, cups_script_exec_t)
+')
+
+########################################
+## <summary>
+##	All of the rules required to administrate 
+##	an cups environment
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <param name="role">
+##	<summary>
+##	The role to be allowed to manage the cups domain.
+##	</summary>
+## </param>
+## <param name="terminal">
+##	<summary>
+##	The type of the user terminal.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`cups_admin',`
+	gen_require(`
+		type cups_t;
+		type cups_script_exec_t;
+		type cups_tmp_t;
+		type cups_lpd_tmp_t;
+		type cups_etc_t;
+		type cups_log_t;
+		type cups_spool_t;
+		type cups_config_var_run_t;
+		type cups_lpd_var_run_t;
+		type cups_var_run_t;
+		type ptal_etc_t;
+		type ptal_var_run_t;
+		type hplip_var_run_t;
+	')
+
+	allow $1 cups_t:process { ptrace signal_perms getattr };
+	read_files_pattern($1, cups_t, cups_t)
+	        
+	# Allow cups_t to restart the apache service
+	cups_script_domtrans($1)
+	domain_system_change_exemption($1)
+	role_transition $2 cups_script_exec_t system_r;
+	allow $2 system_r;
+
+	files_list_tmp($1)
+        admin_pattern($1, cups_tmp_t)
+
+        admin_pattern($1, cups_lpd_tmp_t)
+
+	files_list_etc($1)
+        admin_pattern($1, cups_etc_t)
+
+        admin_pattern($1, ptal_etc_t)
+
+	files_list_spool($1)
+	admin_pattern($1, cups_spool_t)
+
+	logging_list_logs($1)
+        admin_pattern($1, cups_log_t)
+
+	files_list_pids($1)
+        admin_pattern($1, cups_var_run_t)
+
+        admin_pattern($1, ptal_var_run_t)
+
+        admin_pattern($1, cups_config_var_run_t)
+
+        admin_pattern($1, cups_lpd_var_run_t)
+
+        admin_pattern($1, hplip_var_run_t)
+')
+
--- nsaserefpolicy/policy/modules/services/cups.te	2008-08-07 11:15:11.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/services/cups.te	2008-08-14 13:53:54.000000000 -0400
@@ -48,6 +48,9 @@
 type hplip_t;
 type hplip_exec_t;
 init_daemon_domain(hplip_t, hplip_exec_t)
+# For CUPS to run as a backend
+cups_backend(hplip_t, hplip_exec_t)
+domtrans_pattern(cupsd_config_t, hplip_exec_t, hplip_t)
 
 type hplip_etc_t;
 files_config_file(hplip_etc_t)
@@ -65,6 +68,19 @@
 type ptal_var_run_t;
 files_pid_file(ptal_var_run_t)
 
+type cups_script_exec_t;
+init_script_type(cups_script_exec_t)
+
+type cups_pdf_t;
+type cups_pdf_exec_t;
+domain_type(cups_pdf_t)
+domain_entry_file(cups_pdf_t, cups_pdf_exec_t)
+cups_backend(cups_pdf_t, cups_pdf_exec_t)
+role system_r types cups_pdf_t;
+
+type cups_pdf_tmp_t;
+files_tmp_file(cups_pdf_tmp_t)
+
 ifdef(`enable_mcs',`
 	init_ranged_daemon_domain(cupsd_t,cupsd_exec_t,s0 - mcs_systemhigh)
 ')
@@ -79,13 +95,14 @@
 #
 
 # /usr/lib/cups/backend/serial needs sys_admin(?!)
-allow cupsd_t self:capability { sys_admin dac_override dac_read_search kill setgid setuid fsetid net_bind_service fowner chown dac_override sys_resource sys_tty_config };
+allow cupsd_t self:capability { sys_admin dac_override dac_read_search kill setgid setuid fsetid net_bind_service fowner chown dac_override sys_rawio sys_resource sys_tty_config };
 dontaudit cupsd_t self:capability { sys_tty_config net_admin };
-allow cupsd_t self:process { setsched signal_perms };
-allow cupsd_t self:fifo_file rw_file_perms;
+allow cupsd_t self:process { setpgid setsched signal_perms };
+allow cupsd_t self:fifo_file rw_fifo_file_perms;
 allow cupsd_t self:unix_stream_socket { create_stream_socket_perms connectto };
 allow cupsd_t self:unix_dgram_socket create_socket_perms;
 allow cupsd_t self:netlink_selinux_socket create_socket_perms;
+allow cupsd_t self:shm create_shm_perms;
 allow cupsd_t self:tcp_socket create_stream_socket_perms;
 allow cupsd_t self:udp_socket create_socket_perms;
 allow cupsd_t self:appletalk_socket create_socket_perms;
@@ -104,7 +121,7 @@
 
 # allow cups to execute its backend scripts
 can_exec(cupsd_t, cupsd_exec_t)
-allow cupsd_t cupsd_exec_t:dir search;
+allow cupsd_t cupsd_exec_t:dir search_dir_perms;
 allow cupsd_t cupsd_exec_t:lnk_file read;
 
 manage_files_pattern(cupsd_t, cupsd_log_t, cupsd_log_t)
@@ -116,13 +133,19 @@
 manage_fifo_files_pattern(cupsd_t, cupsd_tmp_t, cupsd_tmp_t)
 files_tmp_filetrans(cupsd_t, cupsd_tmp_t, { file dir fifo_file })
 
+# This whole section needs to be moved to a smbspool policy
+# smbspool seems to be iterating through all existing tmp files.
+# Looking for kerberos files
+files_getattr_all_tmp_files(cupsd_t)
+userdom_read_unpriv_users_tmp_files(cupsd_t)
+files_dontaudit_getattr_all_tmp_sockets(cupsd_t)
+
 allow cupsd_t cupsd_var_run_t:dir setattr;
 manage_files_pattern(cupsd_t, cupsd_var_run_t, cupsd_var_run_t)
 manage_sock_files_pattern(cupsd_t, cupsd_var_run_t, cupsd_var_run_t)
 files_pid_filetrans(cupsd_t, cupsd_var_run_t, file)
 
-read_files_pattern(cupsd_t, hplip_etc_t, hplip_etc_t)
-
+allow cupsd_t hplip_t:process sigkill;
 allow cupsd_t hplip_var_run_t:file { read getattr };
 
 stream_connect_pattern(cupsd_t, ptal_var_run_t, ptal_var_run_t, ptal_t)
@@ -149,32 +172,35 @@
 corenet_tcp_bind_reserved_port(cupsd_t)
 corenet_dontaudit_tcp_bind_all_reserved_ports(cupsd_t)
 corenet_tcp_connect_all_ports(cupsd_t)
+corenet_tcp_connect_smbd_port(cupsd_t)
 corenet_sendrecv_hplip_client_packets(cupsd_t)
 corenet_sendrecv_ipp_client_packets(cupsd_t)
 corenet_sendrecv_ipp_server_packets(cupsd_t)
+corenet_tcp_bind_all_rpc_ports(cupsd_t)
 
 dev_rw_printer(cupsd_t)
 dev_read_urand(cupsd_t)
 dev_read_sysfs(cupsd_t)
-dev_read_usbfs(cupsd_t)
+dev_rw_generic_usb_dev(cupsd_t)
+dev_rw_usbfs(cupsd_t)
 dev_getattr_printer_dev(cupsd_t)
 
 domain_read_all_domains_state(cupsd_t)
 
 fs_getattr_all_fs(cupsd_t)
 fs_search_auto_mountpoints(cupsd_t)
+fs_read_anon_inodefs_files(cupsd_t)
 
+mls_fd_use_all_levels(cupsd_t)
 mls_file_downgrade(cupsd_t)
 mls_file_write_all_levels(cupsd_t)
 mls_file_read_all_levels(cupsd_t)
+mls_rangetrans_target(cupsd_t)
 mls_socket_write_all_levels(cupsd_t)
 
 term_use_unallocated_ttys(cupsd_t)
 term_search_ptys(cupsd_t)
 
-auth_domtrans_chk_passwd(cupsd_t)
-auth_dontaudit_read_pam_pid(cupsd_t)
-
 # Filter scripts may be shell scripts, and may invoke progs like /bin/mktemp
 corecmd_exec_shell(cupsd_t)
 corecmd_exec_bin(cupsd_t)
@@ -186,7 +212,7 @@
 # read python modules
 files_read_usr_files(cupsd_t)
 # for /var/lib/defoma
-files_search_var_lib(cupsd_t)
+files_read_var_lib_files(cupsd_t)
 files_list_world_readable(cupsd_t)
 files_read_world_readable_files(cupsd_t)
 files_read_world_readable_symlinks(cupsd_t)
@@ -195,15 +221,16 @@
 files_read_var_symlinks(cupsd_t)
 # for /etc/printcap
 files_dontaudit_write_etc_files(cupsd_t)
-# smbspool seems to be iterating through all existing tmp files.
-# redhat bug #214953
-# cjp: this might be a broken behavior
-files_dontaudit_getattr_all_tmp_files(cupsd_t)
 
 selinux_compute_access_vector(cupsd_t)
+selinux_validate_context(cupsd_t)
 
 init_exec_script_files(cupsd_t)
+init_read_utmp(cupsd_t)
 
+auth_domtrans_chk_passwd(cupsd_t)
+auth_dontaudit_read_pam_pid(cupsd_t)
+auth_rw_faillog(cupsd_t)
 auth_use_nsswitch(cupsd_t)
 
 libs_use_ld_so(cupsd_t)
@@ -219,17 +246,22 @@
 miscfiles_read_fonts(cupsd_t)
 
 seutil_read_config(cupsd_t)
+sysnet_exec_ifconfig(cupsd_t)
 
-sysnet_read_config(cupsd_t)
-
+files_dontaudit_list_home(cupsd_t)
 userdom_dontaudit_use_unpriv_user_fds(cupsd_t)
 userdom_dontaudit_search_all_users_home_content(cupsd_t)
 
 # Write to /var/spool/cups.
 lpd_manage_spool(cupsd_t)
+lpd_read_config(cupsd_t)
+lpd_exec_lpr(cupsd_t)
 
 ifdef(`enable_mls',`
 	lpd_relabel_spool(cupsd_t)
+
+	mls_trusted_object(cupsd_var_run_t)
+	init_ranged_daemon_domain(cupsd_t, cupsd_exec_t,mls_systemhigh)
 ')
 
 optional_policy(`
@@ -242,12 +274,21 @@
 
 optional_policy(`
 	dbus_system_bus_client_template(cupsd, cupsd_t)
+	dbus_send_system_bus(cupsd_t)
 
 	userdom_dbus_send_all_users(cupsd_t)
 
 	optional_policy(`
+		avahi_dbus_chat(cupsd_t)
+	')
+
+	optional_policy(`
 		hal_dbus_chat(cupsd_t)
 	')
+
+	optional_policy(`
+		unconfined_dbus_chat(cupsd_t)
+	')
 ')
 
 optional_policy(`
@@ -263,6 +304,10 @@
 ')
 
 optional_policy(`
+	mta_send_mail(cupsd_t)
+')
+
+optional_policy(`
 	# cups execs smbtool which reads samba_etc_t files
 	samba_read_config(cupsd_t)
 	samba_rw_var_files(cupsd_t)
@@ -326,6 +371,7 @@
 dev_read_sysfs(cupsd_config_t)
 dev_read_urand(cupsd_config_t)
 dev_read_rand(cupsd_config_t)
+dev_rw_generic_usb_dev(cupsd_config_t)
 
 fs_getattr_all_fs(cupsd_config_t)
 fs_search_auto_mountpoints(cupsd_config_t)
@@ -353,6 +399,7 @@
 logging_send_syslog_msg(cupsd_config_t)
 
 miscfiles_read_localization(cupsd_config_t)
+miscfiles_read_hwdata(cupsd_config_t)
 
 seutil_dontaudit_search_config(cupsd_config_t)
 
@@ -373,6 +420,10 @@
 ')
 
 optional_policy(`
+	term_use_generic_ptys(cupsd_config_t)
+')
+
+optional_policy(`
 	cron_system_entry(cupsd_config_t, cupsd_config_exec_t)
 ')
 
@@ -388,6 +439,7 @@
 optional_policy(`
 	hal_domtrans(cupsd_config_t)
 	hal_read_tmp_files(cupsd_config_t)
+	hal_dontaudit_use_fds(hplip_t)
 ')
 
 optional_policy(`
@@ -500,7 +552,7 @@
 allow hplip_t self:udp_socket create_socket_perms;
 allow hplip_t self:rawip_socket create_socket_perms;
 
-allow hplip_t cupsd_etc_t:dir search;
+allow hplip_t cupsd_etc_t:dir search_dir_perms;
 
 cups_stream_connect(hplip_t)
 
@@ -509,6 +561,8 @@
 read_lnk_files_pattern(hplip_t, hplip_etc_t, hplip_etc_t)
 files_search_etc(hplip_t)
 
+read_files_pattern(cupsd_t, hplip_etc_t, hplip_etc_t)
+
 manage_files_pattern(hplip_t, hplip_var_run_t, hplip_var_run_t)
 files_pid_filetrans(hplip_t, hplip_var_run_t, file)
 
@@ -538,7 +592,8 @@
 dev_read_urand(hplip_t)
 dev_read_rand(hplip_t)
 dev_rw_generic_usb_dev(hplip_t)
-dev_read_usbfs(hplip_t)
+dev_rw_usbfs(hplip_t)
+
 
 fs_getattr_all_fs(hplip_t)
 fs_search_auto_mountpoints(hplip_t)
@@ -564,11 +619,17 @@
 userdom_dontaudit_use_unpriv_user_fds(hplip_t)
 userdom_dontaudit_search_all_users_home_content(hplip_t)
 
-lpd_read_config(cupsd_t)
+lpd_read_config(hplip_t)
+lpd_manage_spool(hplip_t)
 
 sysadm_dontaudit_search_home_dirs(hplip_t)
 
 optional_policy(`
+	dbus_system_bus_client_template(hplip, hplip_t)
+	dbus_connect_system_bus(hplip_t)
+')
+
+optional_policy(`
 	seutil_sigchld_newrole(hplip_t)
 ')
 
@@ -647,3 +708,45 @@
 optional_policy(`
 	udev_read_db(ptal_t)
 ')
+
+########################################
+#
+# cups_pdf local policy
+#
+
+allow cups_pdf_t self:capability { chown fsetid setuid setgid dac_override };
+
+## internal communication is often done using fifo and unix sockets.
+allow cups_pdf_t self:fifo_file rw_file_perms;
+allow cups_pdf_t self:unix_stream_socket create_stream_socket_perms;
+
+files_read_etc_files(cups_pdf_t)
+files_read_usr_files(cups_pdf_t)
+
+kernel_read_system_state(cups_pdf_t)
+
+auth_use_nsswitch(cups_pdf_t)
+
+libs_use_ld_so(cups_pdf_t)
+libs_use_shared_libs(cups_pdf_t)
+
+corecmd_exec_shell(cups_pdf_t)
+corecmd_exec_bin(cups_pdf_t)
+
+miscfiles_read_localization(cups_pdf_t)
+
+manage_files_pattern(cups_pdf_t, cups_pdf_tmp_t, cups_pdf_tmp_t)
+manage_dirs_pattern(cups_pdf_t, cups_pdf_tmp_t, cups_pdf_tmp_t)
+files_tmp_filetrans(cups_pdf_t, cups_pdf_tmp_t, { file dir })
+
+unprivuser_home_filetrans_home_dir(cups_pdf_t)
+unprivuser_manage_home_content_dirs(cups_pdf_t)
+unprivuser_manage_home_content_files(cups_pdf_t)
+
+lpd_manage_spool(cups_pdf_t)
+
+manage_files_pattern(cups_pdf_t, cupsd_log_t, cupsd_log_t)
+miscfiles_read_fonts(cups_pdf_t)
+
+sysadm_dontaudit_read_home_content_files(cups_pdf_t)
+
