{"id":785,"date":"2009-08-11T11:59:34","date_gmt":"2009-08-11T10:59:34","guid":{"rendered":"http:\/\/cyberelk.net\/tim\/?p=785"},"modified":"2014-05-20T09:07:28","modified_gmt":"2014-05-20T08:07:28","slug":"policykit-and-printing","status":"publish","type":"post","link":"https:\/\/cyberelk.net\/tim\/2009\/08\/11\/policykit-and-printing\/","title":{"rendered":"PolicyKit and printing"},"content":{"rendered":"

\"gtk-dialog-authentication-100\"<\/a>The latest release of Fedora<\/a> allows more flexibility with configuring print queues and managing print jobs. This is because it is now able to use PolicyKit<\/a> to do these things, which means you get to choose when and whether users should be prompted for authentication when performing administration tasks on printers or jobs. The implementation is slightly tricky, so I’ll explain the details.<\/p>\n

<\/p>\n

Before PolicyKit awareness was added there was already adjustable policy controlling IPP operations.\u00a0 This ‘CUPS policy’ mechanism is provided by the CUPS scheduler, cupsd<\/code>, and its configuration is in the file \/etc\/cups\/cupsd.conf<\/code>.\u00a0 This controls which IP addresses are allowed to access various HTTP locations corresponding to the CUPS configuration actions (such as http:\/\/cups-server:631\/admin<\/code>), and which IP address, users, groups, and classes of users can carry out the various IPP operations such as cancelling jobs.\u00a0 It also specifies whether and how users must authenticate themselves.<\/p>\n

This CUPS policy is great for managing CUPS servers remotely but is not consistent with the method used by the rest of the desktop environment, PolicyKit.\u00a0 Although the CUPS policy can be adjusted using a fairly easy to use list of check-boxes (available in both the CUPS web interface and via System\u2192Administration\u2192Printing<\/a>), it is not fine-grained enough to be as useful as PolicyKit can be.\u00a0 The CUPS policy itself is very fine-grained, but this power is only unleashed by editing configuration files.<\/p>\n

With PolicyKit the policy can be adjusted easily using a graphical tool, to make it easier to perform certain tasks for those needing to do so.\u00a0 The intention is for Fedora “spins”<\/a> to have appropriate default policies depending on their target audience, so that a desktop spin might allow the active console user to perform all administration tasks without asking for authentication for example.<\/p>\n

We have two types of policy then, CUPS policy and PolicyKit policy, for controlling print administration tasks.\u00a0 The CUPS policy in Fedora is unmodified from the upstream CUPS releases, and is fairly restrictive.\u00a0 The default PolicyKit policy for printing administration in Fedora is also fairly restrictive, and the overall policy is only as restrictive as the most relaxed of the two.<\/p>\n

The implementation consists of a package called cups-pk-helper<\/code> (created by Vincent Untz<\/a>) which provides the D-Bus system service which is the mechanism for the policy — it performs the administration tasks on behalf of its clients by talking to the CUPS scheduler using IPP.\u00a0 It runs as root so the default CUPS policy allows it to perform all administration tasks.\u00a0 It can authenticate itself as root by connecting over a UNIX domain socket (CUPS will use peer credentials<\/a> to discover the requesting user) or, if that is not possible, by proving that it can read a certificate file only readable by root.<\/p>\n

At present the only client for this system service is the printer configuration tool accessible from System\u2192Administration\u2192Printing.\u00a0 The CUPS web interface and command line tools only use IPP directly.<\/p>\n

How fine-grained is the policy?\u00a0 Here are the defined operations:<\/p>\n