I recently noted that print jobs from my FC6 machine sent to my remote lpd print server take over five minutes to actually be spooled to print server. When I strace the cups process that connects to the remote lpd, I see repeated attempts to bind() to port numbers below 1024. Each attempt fails with EACCES even though the process is running as root. After each failure, the lpd client waits for one second, then decrements the port number and tries again. This sequence repeats until port number 631 is tried. That succeeds and the client calls connect() and the print job is sent to the remote printer. My theory (based on suggestions from the fedora-user mailing list) is that there is a new selinux policy that restricts the cupsd process and its children to only be able to bind to port 631. If this is true, I believe it is incorrect. I think that there are some older lpd servers that insist on validating clients based on their source port numbers, refusing to allow connections from clients using ports over 1024. This behavior will probably be judged silly (at best) these days, but there seems to be a need to support it even today. Consequently, the default behavior of cups-lpd seems to insist on a low port number before calling connect(). I got around the problem by specifying a printer URI that suppresses that behavior. (That wasn't obvious to me -- I got there from a suggestion from David Hull, replying to my question on the fedora-user list.) But the cups developers think this is OK behavior for their client when it needs to talk to some servers. I think the new policy is wrong. Regardless, why don't I see avc log messages on this? -- Garry T. Williams --- +1 678 656-4579 -- fedora-selinux-list mailing list fedora-selinux-list@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/fedora-selinux-list
