CentOS - Sep 2017 - selinux prevents lighttpd from printing

Hi,

how do I allow CGI programs to print (using 'lpr -P some-printer
some-file.pdf') when
lighttpd is being used for a web server?

When selinux is permissive, the printer prints; when it?s enforcing, the printer
does not print, and I?m getting the log message '/bin/lpr: Permission
denied'.

'getsebool -a | grep http' doesn?t show any boolean I could make out to
be responsible
for this.

Any idea what I need to do/change to allow printing without disabling selinux?

hw wrote:
>
> Hi,
>
> how do I allow CGI programs to print (using 'lpr -P some-printer
some-file.pdf') when
> lighttpd is being used for a web server?
>
> When selinux is permissive, the printer prints; when it?s enforcing, the
printer
> does not print, and I?m getting the log message '/bin/lpr: Permission
denied'.
>
> 'getsebool -a | grep http' doesn?t show any boolean I could make
out to be responsible
> for this.
>
> Any idea what I need to do/change to allow printing without disabling
selinux?
> _______________________________________________
> CentOS mailing list
> CentOS at centos.org
> https://lists.centos.org/mailman/listinfo/centos
Nobody knows?

On 09/20/2017 07:19 AM, hw wrote:
> hw wrote:
>>
>> Hi,
>>
>> how do I allow CGI programs to print (using 'lpr -P some-printer
>> some-file.pdf') when
>> lighttpd is being used for a web server?
>>
>> When selinux is permissive, the printer prints; when it?s enforcing,
>> the printer
>> does not print, and I?m getting the log message '/bin/lpr:
Permission
>> denied'.
>>
>> 'getsebool -a | grep http' doesn?t show any boolean I could
make out
>> to be responsible
>> for this.
>>
>> Any idea what I need to do/change to allow printing without disabling
>> selinux?
>> _______________________________________________
>> CentOS mailing list
>> CentOS at centos.org
>> https://lists.centos.org/mailman/listinfo/centos
> 
> Nobody knows?

Look in your audit logs while in permissive mode and you should see the
issue in there, the wiki has details:

https://wiki.centos.org/HowTos/SELinux#head-798c98ef37cb8a00425a048152113b7a7dc14f1b

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: OpenPGP digital signature
URL:
<http://lists.centos.org/pipermail/centos/attachments/20170920/c8626f80/attachment-0001.sig>