Home_greyopenFATE - openSUSE feature tracking > #313287
Dashboard | Search | Sign up | Login

Please login or register to be able to edit or vote this feature.

Allow printer add and modification to users

Feature state

openSUSE Distribution
New

Description

This had been part of the discussion in this thread http://lists.openSUSE.org/opensuse/2012-02/msg01443.html

At the moment you need to be root to add a printer. It would be of huge benefit to corporate, soho, and home users if there is an easy way from inside YaST or while the initial install to allow a non root user to add a printer.

Discussion


icons/user_comment.png J. M. wrote: (6 years ago)

As far as I understand it, the request is to have a dialog in YaST to set up what is described at "Allow printer admin tasks for a normal user" in
http://en.opensuse.org/SDB:CUPS_in_a_Nutshell

icons/user_comment.png M. S. wrote: (6 years ago)

A feature like described by Johannes I would vote up (vote with pro). Eventually a possibility to choose this easily would be able to add alternatively/cumulatively in the Security Center of YaST2.

But I do not see the sense in giving a user account by default this might. As far as I know printers could be used to harm for example a network. And in addition for many users it is often not an easy and every day task to add a printer to a linux based system.
If an administrator does not trust a user - for example his daughter - to know the root password because he do not trust her honesty or her ability to use this might (and to rate her own ability) then I see no probability why the user/daughter should be able and allowed to add a printer.
Because of this I vote against this feature described as it is in the moment.

Regards
Martin

icons/user_comment.png M. S. wrote: (6 years ago)

I have read the description of the feature/proposal again - especially "if there is an easy way from inside YaST or while the initial install to allow a non root user to add a printer."
So this seem to be a proposal to add a easier to realize option to switch the needed privileges of adding a printer to normal user accounts (and not to change the default security settings).
I would like if an option like this would be added. I will change my voting in pro/up.
I think an good place would be ether YaST>Security_Center or YaST>Printer or to both if it would be only two GuIs that would effect the same settings (and the change of one would also change the status you see on the other one).
So please pardon me about my misunderstanding the meaning of the description.

Regards
Martin

icons/user_comment.png J. M. wrote: (6 years ago)

An "add a easier to realize option to switch the needed privileges of adding a printer to normal user accounts (and not to change the default security settings)" is what I like to implement (and what I can implement) in yast2-printer.

I don't know about YaST-Security_Center.

We should discuss the pros and cons of having option settings available for the user at serveral places (e.g. yast2-printer and YaST-Security_Center). This would mean that also several programmers would have to maintain the feature in several separated sources so that sooner or later the different sources will become out of sync.

icons/user_comment.png M. S. wrote: (6 years ago)

Marcus has written something about [predefined] security profiles:
http://lists.opensuse.org/opensuse-security/2012-02/msg00008.html Skeptical as I am I doubt that even such profiles will satisfy everybody - (including a special choleric kernel developer or his daughter)
even if you define very special profiles.

But I also think that there is already a central place in each openSUSE installation to get an overview about the actual security related settings:
YaST2 > Security Center and Hardening > Security Overview ;
compare for example the
Documentation and the Package
yast2-security .
The yast2-security package seems to get still
commitments .

As much as I - with my amateurish knowledge in informatics - could follow the several discussions initiated by that disgusting G+ ranting - the 'problem' seems to me not to be that is were not possible to define the wished policies/settings but that it was not easy to find them - or one step before that to know that there are (by default/actually) defined other policies on the actual installed system than 'someone' would have wished for.

If not adding an other switch for that settings in the Security Center - would it be practical to ad least a short description and a link to the place of the settings for printer security policies?

Regards

Martin

icons/user_comment.png S. G. wrote: (6 years ago)

humm, I would say having an special group with privileges to add printers. Don't like the idea to let all non-root users to do this.

icons/user_comment.png J. M. wrote: (6 years ago)

The idea - as far as I understand it - is not to to allow all non-root users to do this. The idea is what is described at "Allow printer admin tasks for a normal user" in
http://en.opensuse.org/SDB:CUPS_in_a_Nutshell
which means to allow one or more particular normal users to do this.

FYI:
Currently in the yast2-printer "Policies" dialog you can already set the CUPS operation policy "allowallforanybody" which allows any user to do anything, see the comment in /etc/cups/cupsd.conf regarding "Policy allowallforanybody". Of course this policy is not the out-of-the-box-default CUPS operation policy. When I implement this feature for the yast2-printer "Policies" dialog I will also enhance the CUPS operation policy part and show a descriptive information text to the user what each CUPS operation policy means (I can only show an information text for those CUPS operation policies where I know the policy name in advance - i.e. I cannot show an information text in yast2-printer for CUPS operation policies which have been manually added or changed by the admin). For details regarding CUPS operation policies see http://www.cups.org/documentation.php/doc-1.5/policies.html

icons/user_comment.png P. B. wrote: (5 years ago)

That's a pretty good idea. There's a cdrom group, a floppy group, a modem group, a video group… somehow no printer group in the list. That would be more useful than a floppy group these days.

Last change: 4 years ago
Voting
Score: 17
  • Negative: 3
  • Neutral: 2
  • Positive: 20
Feature Export
Application-xmlXML   Text-x-logPlaintext   PrinterPrint