File cups-1.7-additional_policies.patch of Package cups.6717
--- conf/cupsd.conf.in.orig 2013-06-07 03:00:33.000000000 +0200 +++ conf/cupsd.conf.in 2014-02-26 15:14:35.000000000 +0100 @@ -129,6 +129,39 @@ WebInterface @CUPS_WEBIF@ </Limit> </Policy> +# The policy below is added by SUSE during build of our cups package. +# The policy 'allowallforanybody' is totally open and insecure and therefore +# it can only be used within an internal network where only trused users exist +# and where the cupsd is not accessible at all from any external host, see +# http://en.opensuse.org/SDB:CUPS_and_SANE_Firewall_settings +# Have in mind that any user who is allowed to do printer admin tasks +# can change the print queues as he likes - e.g. send copies of confidental +# print jobs from an internal network to any external destination, see +# http://en.opensuse.org/SDB:CUPS_in_a_Nutshell +# For documentation regarding 'Managing Operation Policies' see +# http://www.cups.org/documentation.php/doc-1.7/policies.html +<Policy allowallforanybody> + # Allow anybody to access job's private values: + JobPrivateAccess all + # Make none of the job values to be private: + JobPrivateValues none + # Allow anybody to access subscription's private values: + SubscriptionPrivateAccess all + # Make none of the subscription values to be private: + SubscriptionPrivateValues none + # Allow anybody to do all IPP operations: + # Currently the IPP operations Validate-Job Cancel-Jobs Cancel-My-Jobs Close-Job CUPS-Get-Document + # must be additionally exlicitly specified because those IPP operations are not included + # in the "All" wildcard value - otherwise cupsd prints error messages of the form + # "No limit for Validate-Job defined in policy allowallforanybody and no suitable template found." + <Limit All Validate-Job Cancel-Jobs Cancel-My-Jobs Close-Job CUPS-Get-Document> + Order deny,allow + Allow from all + </Limit> +</Policy> +# Explicitly set the CUPS 'default' policy to be used by default: +DefaultPolicy default + # # End of "$Id: cupsd.conf.in 11025 2013-06-07 01:00:33Z msweet $". #
