Printer Access

[Madanagopalan S]

Is it possible to restrict the printing
of documents to number of pages or size
of documents. For example, restrict the
user to print only 10 pages or 1mb size
of docs in HPUX 11.

[Steven Sim Kok Leong]

Hi,

You can write a wrapper script for lp. I did this once for SAP print jobs so that if they exceed a certain size, they are not printed.

I don't have it with my off-hand but it is something like this (simplied version assuming straightforward lp with only filename as parameter):

# mv /usr/bin/lp /usr/bin/lp.bin
# vi /usr/bin/lp

#!/sbin/sh
size=`ll $1|awk '{print $5}`
if [ "$size" -gt "2048" ]
then
echo $1 is too large for printing
exit 1
else
/usr/bin/lp.bin $*
fi

You can modify this wrapper script to suit your needs.

Hope this helps. Regards.

Steven Sim Kok Leong

[Madanagopalan S]

Hi steven (May I call u so),
lp command is suid program. If I write
some shell script for this lp, is there
any security issue other than binary.

[Steven Sim Kok Leong · Accepted solution]

Hi,

The /usr/bin/lp script should be 0755 and owned by root since it must be an executable script.

The /usr/bin/lp.bin script should retain its permissions and be 4555 (4 for setuid) and owned by root.

There is no security implications (ie. security level will be same as before the change) because you are not modifying the binary (known now as /usr/bin/lp.bin and previously as /usr/bin/lp) or its permissions. In addition, the shell script has no setuid/setgid bits on (thus not subjected to buffer overflow vulnerability issues which cause root compromises).

Hope this helps. Regards.

Steven Sim Kok Leong

[Madanagopalan S]

Hi Steven,
Thanks for your idea.

I have developed the script and its working
fine with notification also..

Thanks .