Set ACL for doing the print queue restriction

[Gary L]

Hi

Last week, I posted a thread that asking how to setup print queue restriction, named "setup Print Queue and do the Security aspects restrict access" oldSchool, A.Clay Stephenson, Bill Hassell and Dennis Handly gave me a lots of suggestions and recommendations, thanks!
But their way was modify /usr/lib/lp command script, use a new one replace it. I think, there will be some risks on changing OS command and probably, I could not got the approval of our Change Management Team. So, I post this new thread asking whether I could use ACL to do the print queue restiction?
My plan is:
# chmod 444 newlpqueue /set u g o "read"
# setacl -m u:allow1:rwx newlpqueue
# setacl -m u:allow2:rwx newlpqueue /allow user allow1 and allow2 rwx this print queue, viz. doing the print queue "newlpqueue" access control, only the guies who be allow and setacl could use "lp" print job to this queue.

above just my images, whether it works?
if no, how to achieve?
if yes, as you know, I found lots of "newlpqueu" filesystem after I created the new print queue via SAM, such as /etc/lp/cinterface/, /etc/lp/interface,/etc/lp/member, /etc/lp/sinterface. which filesystem of "newlpqueue" should be setted or all of them.

any helps will be appreciated!!!
thanks a lot

[OldSchool · Accepted solution]

you need to look closer at A. Clay's first response to your other thread, where he speaks of modifying the interface script.

that is your best bet and the least intrusive method. the interface file is a script specific to the printer in question and really isn't "part of the O/S" (at least not as far as I'm concerned). People modify these all the time to alter the default behaviour to better suit their needs.

the acl method might work, but you may have unexpected side effects. if you *must* pursue this, then look at putting acls on

/var/spool/lp/request/newlpqueue.

LP attempts to write data here when a print request is given. No write, no request. BEWARE: this will cause errors to generated from the script, and may cause other issues.

Again, I DON'T endorse / recommend / warrantee this method. USE AT YOUR OWN PERIL

[Gary L]

Hi OldSchool

thank you very much for your suggestions.

I think, I should go back to the A.Clay's interface file method.
Through test on ACL, it doesn't work or doen't work well as lp is more sensitive to file mode and ownership, if I change the print queue to 444 and did setacl u:, the printer became "down" when I sent a print job in it.

I'm gonna close this thread as ACL method doen't fit for print

happy weekend

-Gary

[Gary L]

Through Test, I think "ACL" method doesn't work or could not work well on print fielsystem. It isn't fit for print. SO I will close this thread and link back to my previous thread, if someone wanna got some helps please check below link:

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=1132237&admit=-682735245+1181570798188+28353475