Re: [HPLIP-Devel] HP Linux Imaging and Printing System (HPLIP) 2.7.10 Release

[Suffield, D. <dav...@hp...>]

Hi Johannes,

> > HPLIP 2.7.10 - This release has the following changes:
> >=20
> >    1. Made a change to 55-hpmud.rules ...
>=20
> I do not understand why there is OWNER=3D"lp" in 55-hpmud.rules.
>=20
> When the owner is lp, then any CUPS filter script or backend=20
> can change the permissions as it likes, for example via=20
> http://www.cups.org/str.php?L790
>=20
> With the default MODE=3D"0666" there is not much to change for=20
> a possible attacker but think about that the admin may have=20
> specified a more restrictive mode but forgot to also change=20
> the owner to root.
>=20
> To be more on the safe side, I would like to have=20
> OWNER=3D"root", GROUP=3D"lp", MODE=3D"0666" by default for openSUSE.
>=20
> Is there any functionality which does no longer work out of=20
> the box if OWNER=3D"root"?

Actually I made the OWNER=3D"lp" change in 2.7.9 not 2.7.10.=20

Changing OWNER=3D"lp" to OWNER=3D"root" is a valid change. The only =
reason I
changed it was I thought OWNER=3D"lp" would be more secure than
OWNER=3D"root" with MODE=3D"0666".   =20

I don't claim to be a security expert, but if OWNER=3D"root" is not a
problem I would be happy to change it.

> For MODE=3D"0666" the crucial question is whether or not it is=20
> possible that another user (e.g. someone who is logged in=20
> from remote) can somehow eavesdrop when a (confidental)=20
> document is printed or scanned.
>=20
> Is eavesdropping somehow possible with MODE=3D"0666"?

Given only one process can claim the USB interface for reading or
writing, and claiming the interface is arbitrated by the kernel, I would
say no other process could snoop the print job or scan job.

Setting the permissions to MODE=3D"0666" is strictly the default for =
hplip
tar ball install. We have a lot of customers performing the tar ball
install so this makes it much easer from a customer support standpoint
with all the different distributions.=20

I would be glad to support a less permissive user policy with "resmgr"
or "ConsoleKit", but these are Suse and Fedora specific solutions
(right?). So for now I'm happy to let you set your own user policies in
your binary packages.

I will let Raghu answer your hpijs ZJStream questions.

-dave
=20
> >   17. Added support for the following new printer(s):
> ...
> > - HP LaserJet 1018 (LJZjsMono w/plug-in)
> > - HP LaserJet 1020 (LJZjsMono w/plug-in)
> > - HP LaserJet 1022 (LJZjsMono w/plug-in)
> > - HP LaserJet 1022n (LJZjsMono w/plug-in)
> > - HP LaserJet 1022nw (LJZjsMono w/plug-in)
>=20
> For openSUSE I provide only HPIJS as package hpijs-standalone.
> Currently this package contains only /usr/bin/hpijs and some=20
> documentation.
>=20
> I build it via
> ------------------------------------------------------------
> ./configure --prefix=3D/usr \
>             --libdir=3D%_libdir \
>             --disable-foomatic-xml-install \
>             --disable-foomatic-ppd-install \
>             --disable-doc-build \
>             --enable-hpijs-only-build
> make
> ------------------------------------------------------------
>=20
> Assume the user has a ZJStream printer and he has somehow=20
> manually downloaded the necessary plug-in.
>=20
> Would then the plain /usr/bin/hpijs work for his ZJStream printer?
>=20
> I.e. would the plain /usr/bin/hpijs autmatically find his=20
> plug-in and use it or is additional software needed and in=20
> case of the latter which additional software from HPLIP is needed?
>=20
>=20
> By the way:
> There is nothing about the new LJZjsMono device class at=20
> http://hplip.sourceforge.net/tech_docs/device_classes.html
> or about the new plug-in mechanism at
> http://hplip.sourceforge.net/tech_docs/hpijs.html
>=20
>=20
> Kind Regards
> Johannes Meixner