Return to 3.t CVS log

Up to [CSRG BSD Unix] / 43BSDReno / share / doc / smm / 06.lpd

Annotation of 43BSDReno/share/doc/smm/06.lpd/3.t, revision 1.1.1.1

1.1       root        1: .\" Copyright (c) 1983 The Regents of the University of California.
                      2: .\" All rights reserved.
                      3: .\"
                      4: .\" Redistribution and use in source and binary forms are permitted
                      5: .\" provided that the above copyright notice and this paragraph are
                      6: .\" duplicated in all such forms and that any documentation,
                      7: .\" advertising materials, and other materials related to such
                      8: .\" distribution and use acknowledge that the software was developed
                      9: .\" by the University of California, Berkeley.  The name of the
                     10: .\" University may not be used to endorse or promote products derived
                     11: .\" from this software without specific prior written permission.
                     12: .\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR
                     13: .\" IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
                     14: .\" WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
                     15: .\"
                     16: .\"    @(#)3.t 6.5 (Berkeley) 3/7/89
                     17: .\"
                     18: .NH 1
                     19: Access control
                     20: .PP
                     21: The printer system maintains protected spooling areas so that
                     22: users cannot circumvent printer accounting or
                     23: remove files other than their own.
                     24: The strategy used to maintain protected
                     25: spooling areas is as follows:
                     26: .IP \(bu 3
                     27: The spooling area is writable only by a \fIdaemon\fP user
                     28: and \fIdaemon\fP group.
                     29: .IP \(bu 3
                     30: The \fIlpr\fP program runs set-user-id to \fIroot\fP and
                     31: set-group-id to group \fIdaemon\fP.  The \fIroot\fP access permits
                     32: reading any file required. Accessibility is verified
                     33: with an \fIaccess\fP\|(2) call.  The group ID
                     34: is used in setting up proper ownership of files
                     35: in the spooling area for \fIlprm\fP.
                     36: .IP \(bu 3
                     37: Control files in a spooling area are made with \fIdaemon\fP
                     38: ownership and group ownership \fIdaemon\fP.  Their mode is 0660.
                     39: This insures control files are not modified by a user
                     40: and that no user can remove files except through \fIlprm\fP.
                     41: .IP \(bu 3
                     42: The spooling programs,
                     43: \fIlpd\fP, \fIlpq\fP, and \fIlprm\fP run set-user-id to \fIroot\fP
                     44: and set-group-id to group \fIdaemon\fP to access spool files and printers.
                     45: .IP \(bu 3
                     46: The printer server, \fIlpd\fP,
                     47: uses the same verification procedures as \fIrshd\fP\|(8C)
                     48: in authenticating remote clients.  The host on which a client
                     49: resides must be present in the file /etc/hosts.equiv or /etc/hosts.lpd and
                     50: the request message must come from a reserved port number.
                     51: .PP
                     52: In practice, none of \fIlpd\fP, \fIlpq\fP, or
                     53: \fIlprm\fP would have to run as user \fIroot\fP if remote
                     54: spooling were not supported.  In previous incarnations of
                     55: the printer system \fIlpd\fP ran set-user-id to \fIdaemon\fP,
                     56: set-group-id to group \fIspooling\fP, and \fIlpq\fP and \fIlprm\fP ran
                     57: set-group-id to group \fIspooling\fP.

This archive runs on limited infrastructure. Preserving old code on modern bandwidth. Automated agents are requested to crawl responsibly.