#
# CDDL HEADER START
#
# The contents of this file are subject to the terms of the
# Common Development and Distribution License (the "License").
# You may not use this file except in compliance with the License.
#
# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
# or http://www.opensolaris.org/os/licensing.
# See the License for the specific language governing permissions
# and limitations under the License.
#
# When distributing Covered Code, include this CDDL HEADER in each
# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
# If applicable, add the following below this CDDL HEADER, with the
# fields enclosed by brackets "[]" replaced with your own identifying
# information: Portions Copyright [yyyy] [name of copyright owner]
#
# CDDL HEADER END
#
# Copyright (c) 2012, Oracle and/or its affiliates. All rights reserved.
#
SETTING UP TEST ENVIRONMENT
---------------------------
The following steps should be followed for setting up the test environment
for Trusted Solaris:
1. Install trusted packages
# pkg install system/trusted
# pkg install system/trusted/trusted-global-zone
# pkg install trusted-extensions
2. Enable labeld service
# svcadm enable -s labeld
3. Verify that the service is enabled.
# svcs -x labeld
svc:/system/labeld:default (Trusted Extensions)
State: online since weekday month date hour:minute:second year
See: labeld(1M)
Impact: None.
4. This step is required in case you want to install your own
label_encodings file.
To test labels greater than 80 characters, you will have to use
large labels_encodings file.
i) Copy the label_encodings file to the disk.
ii) Check the syntax of the file and make it the active
label_encodings file.
a) Run the chk_encodings command.
# /usr/sbin/chk_encodings /full-pathname-of-label-encodings-file
b) Make the file the active label_encodings file.
# cp /full-pathname-of-label-encodings-file \
/etc/security/tsol/label.encodings.site
# cd /etc/security/tsol
# cp label_encodings label_encodings.tx.orig
# cp label.encodings.site label_encodings
Your label_encodings file must pass the Check Encodings test before
you continue.
5. Reboot the system.
6. Once the system is up after reboot, create labeled zones.
Labeled zones can be created using '/usr/sbin/txzonemgr' command.
For details refer to 'txzonemgr(1M)' manpage.
Documentation on 'Printing in Trusted extensions environment' can be found at:
http://docs.oracle.com/cd/E23824_01/html/821-1482/manageprint-1.html#scrolltoc
--------------------------------------------------------------------------------------------
TEST CASES
----------
All the following test cases should be run in Trusted Solaris environment.
1. Run printing test suite for CUPS.
Details on printing test-suite can be found at:
https://stbeehive.oracle.com/teamcollab/wiki/Solaris+Printing:CUPS+Printing+Test+Suite
2. Printing from labeled zones to network printer directly.
3. Printing from labeled zones to network printer via Global zone.
4. Printing from global zone to directly attached USB printer.
5. Printing from global zone to network printer.
6. Print in different orientations. (Should be tested for both Image & Text files)
The -o landscape option will rotate the page 90 degrees to print in landscape
orientation:
lp -o landscape filename
lpr -o landscape filename
The -o orientation-requested=N option rotates the page depending on the value of N:
-o orientation-requested=3 - portrait orientation (no rotation)
-o orientation-requested=4 - landscape orientation (90 degrees)
-o orientation-requested=5 - reverse landscape or seascape orientation (270 degrees)
-o orientation-requested=6 - reverse portrait or upside-down orientation
(180 degrees)
-o number-up=2
-o number-up=6
this should be landscape by default
rest number-up should be portrait
Mix -o number-up & orientation-requested.
7. Printing On Both Sides of the Paper
-o sides=two-sided-short-edge
-o sides=two-sided-long-edge
These options will enable two-sided printing on the printer if the printer supports it.
'-o sides=two-sided-short-edge' option is suitable for landscape pages,
while '-o sides=two-sided-long-edge' option is suitable for portrait pages:
lp -o sides=two-sided-short-edge filename
lp -o sides=two-sided-long-edge filename
lpr -o sides=two-sided-long-edge filename
The default is to print single-sided:
lp -o sides=one-sided filename
lpr -o sides=one-sided filename
8. Labels greater than 80 characters.
Labels greater than 80 characters would be truncated at the right by '->'
9. Printing to a printer in same subnet.
If the printer is in the same subnet, then add it using cups web interface
at localhost:631
10. Printing to a printer in different subnet.
You should be able to ping the printer ip address.
Adding the printer:
lpadmin -p printer_name -E -v socket://<ip-addr-of-printer> -m <model>
You can find your printer model using
lpinfo -m | grep -i <model name>
model example: "foomatic-db-ppds/Ricoh/PS/Ricoh-Aficio_MP_5000_PS.ppd.gz"
e.g:
lpadmin -p printer -E -v socket://10.163.198.77 -m foomatic-db-ppds/Ricoh/PS/Ricoh-Aficio_MP_5000_PS.ppd.gz
11. Printing without banner and trailer pages and also without page-labels.
-o nolabels
Does not print job labels
-o job-sheets=none
-o job-sheets=none, none
-o job-sheets=none,<any-label>
The above three work same. No banner and trailer pages get printed.
-o job-sheets=<any-label>,none
-o job-sheets=<any-label>,<any-label>
The above two work same. Both banner and trailer pages get printed.
-o job-sheets=none -o nolabels
No banner and trailer page and no job-labels
12. Test following authorizations:
solaris.print.admin
solaris.print.unlabeled
solaris.print.nobanner
solaris.print.list
Following command can be used to list the user authorizations:
$ auths <user>
For eg:
Printing from a labeled zone as root.
$ lp -d public -o job-sheets=none,none /etc/release
request id is public-19 (1 file(s))
This request is submitted to the server as 'remroot'. In this case both
banner and trailer pages get printed, as 'remroot' does not have the
solaris.print.nobanner authorization.
solaris.print.list
# lp -d test /etc/release
request id is test-313 (1 file(s))
# lpstat test
test-313 root 3072 Fri Mar 30 07:42:58 2012
---> Login as 'remroot' <---
# su - remroot
Oracle Corporation SunOS 5.11 11.0 November 2011
---> 'remroot' doesn't have solaris.print.list authorization so it cannot list
the jobs for printer test <---
$ lpstat test
$ lp -d test /etc/release
request id is test-314 (1 file(s))
---> For 'remroot', 'lpstat' lists only the jobs requested by 'remroot' <---
$ lpstat test
test-314 remroot 3072 Fri Mar 30 07:43:44 2012
$ logout
---> For 'root', 'lpstat' lists all the jobs <---
# lpstat test
test-313 root 3072 Fri Mar 30 07:42:58 2012
test-314 remroot 3072 Fri Mar 30 07:43:44 2012
---> Give remroot solaris.print.list authorization <---
# usermod -A solaris.print.list remroot
Found user in files repository.
---> Login as 'remroot'
root@txx2270-05:/var/log/cups# su - remroot
Oracle Corporation SunOS 5.11 11.0 November 2011
---> Now for 'root', 'lpstat' lists all the jobs <---
-bash-4.1$ lpstat test
test-313 root 3072 Fri Mar 30 07:42:58 2012
test-314 remroot 3072 Fri Mar 30 07:43:44 2012
13. Printing to a printer which is outside the labeled range.
E.g: Printing from a 'Public Zone' to a printer labeled 'Confidential'
$ lp -d hp /etc/release
lp: label violation.
14. Cascade printing
Print from a system which is accessible from local zone, to a printer which
is accessible to the GZ only.
Print request goes from the system to LZ to GZ to Printer.
Note: For cascading to work printer must be shared on both LZ and GZ.
Printer can be shared from command line as:
$ lpadmin -p <printer> -o printer-is-shared=true