X-Git-Url: http://andersk.mit.edu/gitweb/moira.git/blobdiff_plain/883e2e2b60e615d3d4e6c64f94ed05c7dc9504d7..8544c150ea51efff4c1c9c13f6eb71a64c7e0435:/gen/print.pc

diff --git a/gen/print.pc b/gen/print.pc
index 80519544..6399b6fc 100644
--- a/gen/print.pc
+++ b/gen/print.pc
@@ -39,6 +39,8 @@ int main(int argc, char **argv)
   char name[MACHINE_NAME_SIZE];
   EXEC SQL END DECLARE SECTION;
 
+  init_acls();
+
   EXEC SQL CONNECT :db;
 
   EXEC SQL WHENEVER SQLERROR DO sqlerr();
@@ -155,13 +157,40 @@ void do_host(char *host)
 		      "daemon", "daemon", now);
   fprintf(out, "# Allow anybody to connect, get status, list queue, or "
 	  "print (once a\n# job is spooled)\n");
-  fprintf(out, "ACCEPT SERVICE=X,S,Q,P\nACCEPT LPC=status,lpq\n\n");
+  fprintf(out, "ACCEPT SERVICE=X,S,Q,P\nACCEPT LPC=status,lpq,printcap\n\n");
 
   fprintf(out, "# Only trust certain host keys to forward jobs/commands\n");
-  fprintf(out, "REJECT AUTHFROM=?* PRINTER=</var/spool/printer/queues.secure "
-	  "NOT AUTHFROM=</var/spool/printer/hostkeys.allow\n");
-  fprintf(out, "REJECT AUTHFROM=?* AUTHJOB "
-	  "NOT AUTHFROM=</var/spool/printer/hostkeys.allow\n\n");
+  fprintf(out, "REJECT SERVICE=R AUTHFROM=?* "
+	  "PRINTER=</var/spool/printer/queues.secure "
+	  "NOT AUTHFROM=</var/spool/printer/hostkeys.allow FORWARD\n");
+  fprintf(out, "REJECT SERVICE=R AUTHFROM=?* AUTHJOB "
+	  "NOT AUTHFROM=</var/spool/printer/hostkeys.allow FORWARD\n\n");
+
+  fprintf(out, "# Allow root to control and remove jobs\n");
+  fprintf(out, "ACCEPT SERVICE=C,R SERVER REMOTEUSER=root\n\n");
+
+  fprintf(out, "# Allow admins to control and remove jobs\n");
+  fprintf(out, "ACCEPT SERVICE=C,R AUTH=USER AUTHUSER=</var/spool/printer/lpcaccess.top\n\n");
+
+  fprintf(out, "# Printer-specific LPC ACLs\n");
+  EXEC SQL DECLARE csr_lpc CURSOR FOR
+    SELECT rp, duplexname FROM printers
+    WHERE rm = :rm AND lpc_acl != 0;
+  EXEC SQL OPEN csr_lpc;
+  while (1)
+    {
+      EXEC SQL FETCH csr_lpc INTO :name, :duplexname;
+      if (sqlca.sqlcode)
+	break;
+
+      strtrim(name);
+      strtrim(duplexname);
+      fprintf(out, "ACCEPT SERVICE=C,R PRINTER=%s%s%s AUTH=USER "
+	      "AUTHUSER=</var/spool/printer/%s/lpcaccess\n",
+	      name, *duplexname ? "," : "", duplexname, name);
+    }
+  EXEC SQL CLOSE csr_lpc;
+  fprintf(out, "\n");
 
   fprintf(out, "# Reject jobs from unauthorized users to restricted queues\n");
   EXEC SQL DECLARE csr_ac CURSOR FOR
@@ -184,13 +213,15 @@ void do_host(char *host)
   EXEC SQL CLOSE csr_ac;
   fprintf(out, "\n");
 
+  fprintf(out, "# Allow us to lock out users\n");
+  fprintf(out, "REJECT SERVICE=R USER=</var/spool/printer/users.deny\n");
   fprintf(out, "# Accept authenticated jobs to all other printers\n");
   fprintf(out, "ACCEPT SERVICE=R AUTH=USER,FWD\n");
   fprintf(out, "# Allow authenticated users to lprm their jobs\n");
   fprintf(out, "ACCEPT SERVICE=M AUTH=USER,FWD AUTHJOB AUTHSAMEUSER\n\n");
 
   fprintf(out, "# Reject unauthentic print/lprm requests to authenticated queues\n");
-  fprintf(out, "REJECT SERVICE=R,M "
+  fprintf(out, "REJECT SERVICE=R,M NOT AUTH "
 	  "PRINTER=</var/spool/printer/queues.secure\n\n");
 
   fprintf(out, "# Reject unauthentic print requests from off MITnet\n");
@@ -199,35 +230,9 @@ void do_host(char *host)
   fprintf(out, "# Accept unauthentic print requests if same user and on MITnet\n");
   fprintf(out, "ACCEPT SERVICE=M NOT AUTHJOB SAMEUSER REMOTEIP=</var/spool/printer/masks.allow\n\n");
   
-  fprintf(out, "# Allow root to control and remove jobs\n");
-  fprintf(out, "ACCEPT SERVICE=C SERVER REMOTEUSER=root\n\n");
-
-  fprintf(out, "# Allow admins to control and remove jobs\n");
-  fprintf(out, "ACCEPT SERVICE=C AUTH=USER AUTHUSER=</var/spool/printer/lpcaccess.top\n\n");
-
-  fprintf(out, "# Printer-specific LPC ACLs\n");
-  EXEC SQL DECLARE csr_lpc CURSOR FOR
-    SELECT rp, duplexname FROM printers
-    WHERE rm = :rm AND lpc_acl != 0;
-  EXEC SQL OPEN csr_lpc;
-  while (1)
-    {
-      EXEC SQL FETCH csr_lpc INTO :name, :duplexname;
-      if (sqlca.sqlcode)
-	break;
-
-      strtrim(name);
-      strtrim(duplexname);
-      fprintf(out, "ACCEPT SERVICE=C PRINTER=%s%s%s AUTH=USER "
-	      "AUTHUSER=</var/spool/printer/%s/lpcaccess\n",
-	      name, *duplexname ? "," : "", duplexname, name);
-    }
-  EXEC SQL CLOSE csr_lpc;
-  fprintf(out, "\n");
-
   fprintf(out, "# Reject any other lpc, or lprm. Accept all else\n");
   fprintf(out, "REJECT SERVICE=C,M\n");
-  fprintf(out, "DEFAULT ACCEPT");
+  fprintf(out, "DEFAULT ACCEPT\n");
   tarfile_end(tf);
 
   /* list of kerberized queues */