--- configure.in	Thu Jan  3 02:44:26 2013

+++ configure.in	Wed Jan  2 21:45:05 2013

@@ -42,6 +42,7 @@

 sinclude(config-scripts/cups-pdf.m4)

 sinclude(config-scripts/cups-scripting.m4)

 sinclude(config-scripts/cups-labeling.m4)

+sinclude(config-scripts/cups-auditing.m4)

 INSTALL_LANGUAGES=""

 UNINSTALL_LANGUAGES=""

--- config-scripts/cups-auditing.m4	Wed Jan  2 23:23:52 2013

+++ config-scripts/cups-auditing.m4	Wed Jan  2 21:45:18 2013

@@ -0,0 +1,35 @@

+dnl

+dnl    Auditing support for the Common UNIX Printing System (CUPS).

+dnl

+dnl    Copyright (c) 2013, Oracle and/or its affiliates. All rights reserved.

+dnl

+dnl   This program is free software; you can redistribute it and/or modify

+dnl   it under the terms of the GNU General Public License as published by

+dnl   the Free Software Foundation; version 2.

+dnl

+dnl   This program is distributed in the hope that it will be useful, but

+dnl   WITHOUT ANY WARRANTY; without even the implied warranty of

+dnl   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU

+dnl   General Public License for more details.

+dnl

+dnl   You should have received a copy of the GNU General Public License

+dnl   along with this program; if not, write to the Free Software Foundation,

+dnl   Inc., 51 Franklin Street, Fifth Floor Boston, MA 02110-1301 USA

+dnl

+

+AC_ARG_ENABLE(auditing, [ --enable-auditing enable support for auditing, default=auto])

+

+if test x"$enable_auditing" != xno; then

+    case "$uname" in

+        SunOS)

+		AC_CHECK_LIB(bsm, adt_start_session,

+		    [AUDITING_LIBS="-lbsm" AC_SUBST(AUDITING_LIBS)

+		    AC_CHECK_HEADER(bsm/adt.h)

+		    AC_CHECK_HEADER(bsm/adt_event.h)

+		    AC_DEFINE(HAVE_ADT)])

+            ;;

+        *)

+            # All others

+            ;;

+    esac

+fi

--- config.h.in	Wed Jan  2 23:21:36 2013

+++ config.h.in	Wed Jan  2 21:44:45 2013

@@ -672,6 +672,11 @@

 #undef HAVE_TSOL

 /*

+ * Do we have Auditing support ?

+ */

+#undef HAVE_ADT

+

+/*

  * Do we have SELinux support?

  */

 #undef HAVE_SELINUX

--- Makedefs.in	Wed Jan  2 23:21:36 2013

+++ Makedefs.in	Wed Jan  2 21:46:40 2013

@@ -125,7 +125,7 @@

 BANNERTOPS	=	@BANNERTOPS@

 CFLAGS		=	@CPPFLAGS@ @CFLAGS@

 COMMONLIBS	=	@LIBS@

-CUPSDLIBS	=	@CUPSDLIBS@ @LABELING_LIBS@

+CUPSDLIBS	=	@CUPSDLIBS@ @LABELING_LIBS@ @AUDITING_LIBS@

 CXXFLAGS	=	@CPPFLAGS@ @CXXFLAGS@

 CXXLIBS		=	@CXXLIBS@

 DBUS_NOTIFIER	=	@DBUS_NOTIFIER@

--- scheduler/client.h	Wed Jan  2 23:21:36 2013

+++ scheduler/client.h	Wed Jan  2 21:44:36 2013

@@ -17,6 +17,9 @@

 #  include <Security/Authorization.h>

 #endif /* HAVE_AUTHORIZATION_H */

+#ifdef HAVE_ADT

+#include <bsm/adt.h>

+#endif /* HAVE_ADT */

 /*

  * HTTP client structure...

@@ -64,8 +67,13 @@

 #ifdef HAVE_AUTHORIZATION_H

   AuthorizationRef	authref;	/* Authorization ref */

 #endif /* HAVE_AUTHORIZATION_H */

-  char                  *slabel;		/* security context for security

+#ifdef HAVE_TSOL

+  char                  *slabel;	/* security context for security

 					   labeled environments */

+#endif /* HAVE_TSOL */

+#ifdef HAVE_ADT

+  adt_session_data_t	*ah		/* audit handle for print requests */

+#endif /* HAVE_ADT */

 };

 #define HTTP(con) &((con)->http)

--- scheduler/job.h	Wed Jan  2 23:21:36 2013

+++ scheduler/job.h	Wed Jan  2 21:46:16 2013

@@ -13,6 +13,10 @@

  *   file is missing or damaged, see the license at "http://www.cups.org/".

  */

+#ifdef HAVE_ADT

+#include <bsm/adt.h>

+#endif /* HAVE_ADT */

+

 /*

  * Constants...

  */

@@ -83,8 +87,13 @@

   krb5_ccache		ccache;		/* Kerberos credential cache */

   char			*ccname;	/* KRB5CCNAME environment variable */

 #endif /* HAVE_GSSAPI */

-  char                  *slabel;		/* security context for security

+#ifdef HAVE_TSOL

+  char                  *slabel;	/* security context for security

 					   labeled environments */

+#endif /* HAVE_TSOL */

+#ifdef HAVE_ADT

+  adt_session_data_t	*ah;		/* audit handle for print requests */

+#endif /* HAVE_ADT */

 };

 typedef struct cupsd_joblog_s		/**** Job log message ****/

--- scheduler/ipp.c	Wed Jan  2 23:21:36 2013

+++ scheduler/ipp.c	Wed Jan  2 23:25:46 2013

@@ -1425,12 +1425,20 @@

 		*media_margin;		/* media-*-margin attribute */

   ipp_t		*unsup_col;		/* media-col in unsupported response */

-

   cupsdLogMessage(CUPSD_LOG_DEBUG2, "add_job(%p[%d], %p(%s), %p(%s/%s))",

                   con, con->http.fd, printer, printer->name,

 		  filetype, filetype ? filetype->super : "none",

 		  filetype ? filetype->type : "none");

+#if defined(HAVE_TSOL)

+  /* Start audit session to audit CUPS print requests */

+  if (is_system_labeled() != 0) {

+    cupsdLogMessage(CUPSD_LOG_DEBUG, "add_job: Start CUPS audit session"

+		    " for connection");

+    cups_audit_start_session(con);

+  }

+#endif /* HAVE_TSOL */

+

   /*

    * Validate that the label associated with the connection is acceptable for

    * printing on the printer.

@@ -1437,6 +1445,11 @@

    */

   if (cupsdInPrinterLabelRange(con->slabel, printer) == 0)

   {

+#if defined(HAVE_TSOL)

+    /* Audit the print request */

+    if (is_system_labeled() != 0)

+      cups_audit_print_request_denial(con, NULL, printer, -1, EACCES);

+#endif /* HAVE_TSOL */

     send_ipp_status(con, IPP_NOT_AUTHORIZED, _("label violation."));

     return (NULL);

   }

@@ -1450,6 +1463,12 @@

       strcasecmp(con->http.hostname, "localhost") &&

       strcasecmp(con->http.hostname, ServerName))

   {

+#if defined(HAVE_TSOL)

+    /* Audit the print request */

+    if (is_system_labeled() != 0)

+      cups_audit_print_request_denial(con, NULL, printer, -1, EPERM);

+#endif /* HAVE_TSOL */

+

     send_ipp_status(con, IPP_NOT_AUTHORIZED,

                     _("The printer or class is not shared!"));

     return (NULL);

@@ -1463,6 +1482,11 @@

   if ((status = cupsdCheckPolicy(printer->op_policy_ptr, con, NULL)) != HTTP_OK)

   {

+#if defined(HAVE_TSOL)

+    /* Audit the print request */

+    if (is_system_labeled() != 0)

+      cups_audit_print_request_denial(con, NULL, printer, -1, EPERM);

+#endif /* HAVE_TSOL */

     send_http_error(con, status, printer);

     return (NULL);

   }

@@ -1714,6 +1738,21 @@

 		 NULL, label_to_page_top_bottom_string(job->slabel));

   }

+#if defined(HAVE_TSOL)

+  /*

+   * Initialize audit handle for job.

+   * Audit handle for job is same as that for connection.

+   * Connection handle is not available in job.c where job requests

+   * are processed so the same is copied to job handle so that

+   * job requests can be audited.

+   * Here just the handle pointer is being copied. It will stay valid

+   * throughout the processing of a print request.

+   */

+  if (is_system_labeled() != 0)

+    job->ah = con->ah;

+

+#endif /* HAVE_TSOL */

+

   job->dtype   = printer->type & (CUPS_PRINTER_CLASS | CUPS_PRINTER_IMPLICIT |

                                   CUPS_PRINTER_REMOTE);

   job->attrs   = con->request;

@@ -1851,6 +1890,7 @@

   */

   ippAddInteger(job->attrs, IPP_TAG_JOB, IPP_TAG_INTEGER, "job-id", job->id);

+

   job->state = ippAddInteger(job->attrs, IPP_TAG_JOB, IPP_TAG_ENUM,

                              "job-state", IPP_JOB_STOPPED);

   job->state_value = (ipp_jstate_t)job->state->values[0].integer;

@@ -4081,6 +4121,11 @@

     if ((status = cupsdCheckPolicy(printer->op_policy_ptr, con,

                                    NULL)) != HTTP_OK)

     {

+#if defined(HAVE_TSOL)

+      /* Audit the print request */

+      if (is_system_labeled() != 0)

+        cups_audit_print_request_denial(con, NULL, printer, -1, EPERM);

+#endif /* HAVE_TSOL */

       send_http_error(con, status, printer);

       return;

     }

--- scheduler/job.c	Wed Jan  2 23:21:36 2013

+++ scheduler/job.c	Wed Jan  2 21:46:11 2013

@@ -75,6 +75,9 @@

 #include <cups/backend.h>

 #include <cups/dir.h>

+#if defined(HAVE_TSOL)

+#include <bsm/adt_event.h>

+#endif /* HAVE_TSOL */

 /*

  * Design Notes for Job Management

@@ -2712,6 +2715,9 @@

   const char		*message;	/* Message for job state */

   char			buffer[1024];	/* Buffer for formatted messages */

+#if defined(HAVE_TSOL)

+  ipp_attribute_t	*attr;		/* Current attributes */

+#endif /* HAVE_TSOL */

   cupsdLogMessage(CUPSD_LOG_DEBUG2, "finalize_job(job=%p(%d))", job, job->id);

@@ -2986,6 +2992,13 @@

 		  "error_log file for details.";

     }

   }

+#if defined(HAVE_TSOL)

+  /* Audit the print request. */

+  if (is_system_labeled() != 0) {

+    cupsdLogMessage(CUPSD_LOG_DEBUG, "finalize_job(cups_audit_print_request)");

+    cups_audit_print_request(job, job_state);

+  }

+#endif /* HAVE_TSOL */

  /*

   * Update the printer and job state.

@@ -4037,6 +4050,12 @@

                     "start_job(): job label outside of printer label range");

     cupsdSetJobState(job, IPP_JOB_CANCELED, CUPSD_JOB_DEFAULT,

                      "job label is outside of printer label range");

+#if defined(HAVE_TSOL)

+    if (is_system_labeled() != 0)

+	cups_audit_print_request_denial(NULL, job, printer,

+				    job->state_value, EACCES);

+#endif /*HAVE_TSOL */

+

     cupsdCheckJobs();

     return;

   }

@@ -4586,7 +4605,6 @@

    /*

     * Handle the end of job stuff...

     */

-

     finalize_job(job, 1);

    /*

--- scheduler/cups-lpd.c	Wed Sep  3 05:57:17 2008

+++ scheduler/cups-lpd.c	Wed Jan  2 21:45:33 2013

@@ -348,8 +348,11 @@

   ipp_attribute_t *attr;		/* IPP attribute */

   char		uri[HTTP_MAX_URI];	/* Printer URI */

   int		id;			/* Job ID */

+#if defined(HAVE_TSOL)

+  char		*hostname;

+  const char    uid[11], gid[11];	/* user id and group id */

+#endif /* HAVE_TSOL */

-

  /*

   * Setup the Create-Job request...

   */

@@ -373,6 +376,29 @@

     ippAddString(request, IPP_TAG_OPERATION, IPP_TAG_NAME, "document-name", 

                  NULL, docname);

+#if defined(HAVE_TSOL)

+  if (is_system_labeled() != 0) {

+    /* Add job-originating-host-name to the request */

+    if ((hostname = cupsGetOption("job-originating-host-name", num_options,

+	options)) != NULL)

+      ippAddString(request, IPP_TAG_OPERATION, IPP_TAG_NAME,

+		   "job-originating-host-name", NULL, hostname);

+

+    /* Add userID and groupID of the user who submitted the request */

+

+    /*

+     * When uid and gid are added to the attributes using ippAddInteger,

+     * ippFindAttribute from the scheduler is not able to read the attribute,

+     * so using ippAddString to add uid and gid.

+     */

+    snprintf(uid, sizeof(uid), "%d", getuid());

+    ippAddString(request, IPP_TAG_OPERATION, IPP_TAG_NAME, "userID", NULL, uid);

+

+    snprintf(gid, sizeof(gid), "%d", getgid());

+    ippAddString(request, IPP_TAG_OPERATION, IPP_TAG_NAME, "groupID", NULL, gid);

+  }

+#endif /* HAVE_TSOL */

+

   cupsEncodeOptions(request, num_options, options);

  /*

--- scheduler/audit.c	Wed Jan  2 23:26:12 2013

+++ scheduler/audit.c	Wed Jan  2 21:44:22 2013

@@ -0,0 +1,781 @@

+/*

+ * Copyright (c) 2013, Oracle and/or its affiliates. All rights reserved.

+ */

+/*

+ * This program is free software; you can redistribute it and/or modify

+ * it under the terms of the GNU General Public License as published by

+ * the Free Software Foundation; version 2.

+ *

+ * This program is distributed in the hope that it will be useful, but

+ * WITHOUT ANY WARRANTY; without even the implied warranty of

+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU

+ * General Public License for more details.

+ *

+ * You should have received a copy of the GNU General Public License

+ * along with this program; if not, write to the Free Software Foundation,

+ * Inc., 51 Franklin Street, Fifth Floor Boston, MA 02110-1301 USA

+ */

+#include <syslog.h>

+#include "cupsd.h"

+#include <bsm/adt.h>

+#include <bsm/adt_event.h>

+#include <auth_attr.h>

+

+#define	PRINT_UNLABELED_AUTH	"solaris.print.unlabeled"

+#define	PRINT_NOBANNER_AUTH	"solaris.print.nobanner"

+

+/*

+ * Maximum length of string to hold requested job id:

+ * <printer-name>-<job-id>

+ * IPP_MAX_NAME+1+10+1

+ */

+#define	REQ_MAX_NAME		IPP_MAX_NAME+1+10+1

+

+uid_t	uid = ADT_NO_ATTRIB;

+gid_t	gid = ADT_NO_ATTRIB;

+

+void cups_audit_start_session(cupsd_client_t *con);

+void cups_audit_print_request_denial(cupsd_client_t *con, cupsd_job_t *job,

+     cupsd_printer_t *printer, ipp_jstate_t job_state, int fail_reason);

+void cups_audit_print_request(cupsd_job_t *job, ipp_jstate_t job_state);

+

+/*

+ * Set up an audit session for auditing the current print request.

+ */

+void

+cups_audit_start_session(cupsd_client_t *con)

+{

+

+	if (adt_start_session(&con->ah, NULL, 0) != 0) {

+		cupsdLogMessage(CUPSD_LOG_EMERG, "cups_audit_start_session(): "

+		    "adt_start_session(): %d", errno);

+		con->ah = NULL;

+		return;

+	}

+

+	if (strcasecmp(con->http.hostname, "localhost") == 0) {

+		/* Local Request */

+		ucred_t *cred = NULL;

+

+		if (getpeerucred(con->http.fd, &cred) == -1) {

+			cupsdLogMessage(CUPSD_LOG_EMERG,

+			    "cups_audit_start_session(): "

+			    "getpeerucred(): %d", errno);

+			(void) adt_end_session(con->ah);

+			con->ah = NULL;

+			return;

+		}

+

+		if (adt_set_from_ucred(con->ah, cred, ADT_NEW) != 0) {

+			cupsdLogMessage(CUPSD_LOG_EMERG,

+			    "cups_audit_start_session(): "

+			    "adt_set_from_ucred(): %d", errno);

+			(void) adt_end_session(con->ah);

+			con->ah = NULL;

+			return;

+		}

+	} else {

+		/* Remote Request */

+		ipp_attribute_t	*userID = NULL, *grpID = NULL;

+		adt_termid_t	*termid = NULL;

+

+		if ((userID = ippFindAttribute(con->request, "userID",

+		    IPP_TAG_NAME)) != NULL) {

+			cupsdLogMessage(CUPSD_LOG_DEBUG,

+			    "cups_audit_start_session():"

+			    "userID = %s", userID->values[0].string.text);

+			uid = atoi(userID->values[0].string.text);

+		} else {

+			cupsdLogMessage(CUPSD_LOG_DEBUG,

+			    "cups_audit_start_session():"

+			    "userID = NULL");

+		}

+

+		if ((grpID = ippFindAttribute(con->request, "groupID",

+		    IPP_TAG_NAME)) != NULL) {

+			cupsdLogMessage(CUPSD_LOG_DEBUG,

+			    "cups_audit_start_session():"

+			    "grpID = %s", grpID->values[0].string.text);

+			gid = atoi(grpID->values[0].string.text);

+		} else {

+			cupsdLogMessage(CUPSD_LOG_DEBUG,

+			    "cups_audit_start_session():"

+			    "grpID = NULL");

+		}

+

+		if (adt_load_termid(con->http.fd, &termid) != 0) {

+			cupsdLogMessage(CUPSD_LOG_ERROR,

+			    "cups_audit_start_session(): "

+			    "adt_load_termid(): %d", errno);

+		}

+		if (adt_set_user(con->ah, uid, gid, uid, gid, termid,

+		    ADT_NEW) != 0) {

+			cupsdLogMessage(CUPSD_LOG_EMERG,

+			    "cups_audit_start_session(): "

+			    "adt_set_user(): %d", errno);

+			(void) adt_end_session(con->ah);

+			con->ah = NULL;

+			free(termid);

+			return;

+		}

+		free(termid);

+	}

+}

+

+/*

+ * Routine for filling in the audit event details for each of the

+ * three types of TX-related printing audit records:

+ *    AUE_print_request - audit each file in print request

+ *    AUE_print_request_unlabeled - audit use of the solaris.print.nolabels auth

+ *    AUE_print_request_nobanner - audit use of the solaris.print.nobanner auth

+ * One AUE_print_request audit record is written for each text file in the

+ * print request. The '-o nolabels' and '-o nobanner' options apply to the

+ * entire print request so one AUE_print_request_unlabeled audit record and one

+ * AUE_print_request_nobanner audit record is written, respectively, for each

+ * file in the print request when these options are supplied.

+ * 

+ * event_ID		= type of TX-related printing audit record

+ * event		= audit event structure

+ * printer		= printer name

+ * slabel		= Sensitivity Label

+ * job_ID		= request_ID; <printe-name>-<job-id>

+ * job_ID_remote	= remote request_ID; <printe-name>-<remote-job_id>

+ *			job id for the same request differ on client and server

+ * filelist		= file to be printed;

+ *			 In case 'filelist' is 'stdin', temporary filename

+ *			 created in /var/spool/cups/ is read 

+ * ai			= struct addrinfo; 

+ * status 		= audit request status;

+ *			 ADT_FAILURE, ADT_SUCCESS

+ * return_val		= return value of audit request;

+ *			 If user is not authorized then ADT_FAIL_VALUE_AUTH

+ *			 If print job is successfully completed then ADT_SUCCESS

+ *			 If job is cancelled then

+ *			 ADT_FAIL_VALUE_PRINT_JOB_CANCELLED

+ *			MAC failures it is EACESS

+ *			DAC failures it is EPERM

+ * i = which of the job files is this 000-999 for the CUPS max of 

+ *	1000 jobs.  See util.c

+ * job_id 		= print request job id; this is used to get the location

+ *			 of the temporary file in spool directory which is of the format:

+ *			 /var/spool/cups/d00550-001

+ *			where 550 is the job-id.

+ * remote		= true: remote request

+ *			 false: local request

+ */

+static void

+cups_audit_print_request_data(au_event_t event_ID,

+    adt_event_data_t *event, char *printer, char *slabel,

+    char *job_ID, char *job_ID_remote, char *filelist,

+    struct addrinfo *ai, int status, int return_val, int i,

+    int job_id, boolean_t remote)

+{

+	char		tmpfile[IPP_MAX_NAME];

+	char		tfile[IPP_MAX_NAME];

+	char		r_job_ID[IPP_MAX_NAME];

+	char		*file, *f_job_ID = NULL;

+	struct stat	attributes;

+	m_label_t	*file_label = NULL;

+

+	/*

+	 * If 'filelist' is 'stdin', read the temporary filename

+	 * created for the file contents in /var/spool/cups/

+	 * This will be useful to audit the files printed

+	 * via standard input.

+	 * Scheduler can't discern the difference between a

+	 * file printed via stdin and one printed normally so

+	 * the file attributes and label are always included

+	 * even though they refer to the temporary file created

+	 * in the case of stdin.

+	 * The label is going to be the same regardless of wheather

+	 * it is of the tmp file that was used for stdin or the real file.

+	 */

+	if (remote) {