I recently noted that print jobs from my FC6 machine sent to my remote
lpd print server take over five minutes to actually be spooled to
print server. When I strace the cups process that connects to the
remote lpd, I see repeated attempts to bind() to port numbers below
1024. Each attempt fails with EACCES even though the process is
running as root. After each failure, the lpd client waits for one
second, then decrements the port number and tries again. This
sequence repeats until port number 631 is tried. That succeeds and
the client calls connect() and the print job is sent to the remote
printer.
My theory (based on suggestions from the fedora-user mailing list) is
that there is a new selinux policy that restricts the cupsd process
and its children to only be able to bind to port 631. If this is
true, I believe it is incorrect.
I think that there are some older lpd servers that insist on
validating clients based on their source port numbers, refusing to
allow connections from clients using ports over 1024. This behavior
will probably be judged silly (at best) these days, but there seems to
be a need to support it even today. Consequently, the default
behavior of cups-lpd seems to insist on a low port number before
calling connect().
I got around the problem by specifying a printer URI that suppresses
that behavior. (That wasn't obvious to me -- I got there from a
suggestion from David Hull, replying to my question on the fedora-user
list.) But the cups developers think this is OK behavior for their
client when it needs to talk to some servers.
I think the new policy is wrong. Regardless, why don't I see avc log
messages on this?
--
Garry T. Williams --- +1 678 656-4579
