Feature changed by: Andreas Jaeger (a_jaeger) Feature #313287, revision 2 Title: Allow printer add and modification to users - openSUSE Distribution: Unconfirmed + openSUSE Distribution: New Priority Requester: Important Requested by: Lars Müller (lmuelle) Partner organization: openSUSE.org Description: This had been part of the discussion in this thread http://lists.openSUSE.org/opensuse/2012-02/msg01443.html At the moment you need to be root to add a printer. It would be of huge benefit to corporate, soho, and home users if there is an easy way from inside YaST or while the initial install to allow a non root user to add a printer. -- openSUSE Feature: https://features.opensuse.org/313287

Feature changed by: Martin Seidler (pistazienfresser) Feature #313287, revision 4 Title: Allow printer add and modification to users openSUSE Distribution: New Priority Requester: Important Requested by: Lars Müller (lmuelle) Partner organization: openSUSE.org Description: This had been part of the discussion in this thread http://lists.openSUSE.org/opensuse/2012-02/msg01443.html At the moment you need to be root to add a printer. It would be of huge benefit to corporate, soho, and home users if there is an easy way from inside YaST or while the initial install to allow a non root user to add a printer. Discussion: #1: Johannes Meixner (jsmeix) (2012-03-02 16:04:47) As far as I understand it, the request is to have a dialog in YaST to set up what is described at "Allow printer admin tasks for a normal user" in http://en.opensuse.org/SDB:CUPS_in_a_Nutshell + #2: Martin Seidler (pistazienfresser) (2012-03-17 17:12:34) (reply to + #1) + A feature like described by Johannes I would vote up (vote with pro). + Eventually a possibility to choose this easily would be able to add + alternatively/cumulatively in the Security Center of YaST2. + But I do not see the sense in giving a user account by default this + might. As far as I know printers could be used to harm for example a + network. And in addition for many users it is often not an easy and + every day task to add a printer to a linux based system. If an + administrator does not trust a user - for example his daughter - to + know the root password because he do not trust her honesty or her + ability to use this might (and to rate her own ability) then I see no + probability why the user/daughter should be able and allowed to add a + printer. Because of this I vote against this feature described as it is + in the moment. + Regards Martin -- openSUSE Feature: https://features.opensuse.org/313287

Feature changed by: Martin Seidler (pistazienfresser) Feature #313287, revision 7 Title: Allow printer add and modification to users openSUSE Distribution: New Priority Requester: Important Requested by: Lars Müller (lmuelle) Partner organization: openSUSE.org Description: This had been part of the discussion in this thread http://lists.openSUSE.org/opensuse/2012-02/msg01443.html At the moment you need to be root to add a printer. It would be of huge benefit to corporate, soho, and home users if there is an easy way from inside YaST or while the initial install to allow a non root user to add a printer. Discussion: #1: Johannes Meixner (jsmeix) (2012-03-02 16:04:47) As far as I understand it, the request is to have a dialog in YaST to set up what is described at "Allow printer admin tasks for a normal user" in http://en.opensuse.org/SDB:CUPS_in_a_Nutshell #2: Martin Seidler (pistazienfresser) (2012-03-17 17:12:34) (reply to #1) A feature like described by Johannes I would vote up (vote with pro). Eventually a possibility to choose this easily would be able to add alternatively/cumulatively in the Security Center of YaST2. But I do not see the sense in giving a user account by default this might. As far as I know printers could be used to harm for example a network. And in addition for many users it is often not an easy and every day task to add a printer to a linux based system. If an administrator does not trust a user - for example his daughter - to know the root password because he do not trust her honesty or her ability to use this might (and to rate her own ability) then I see no probability why the user/daughter should be able and allowed to add a printer. Because of this I vote against this feature described as it is in the moment. Regards Martin + #4: Martin Seidler (pistazienfresser) (2012-03-19 09:31:32) (reply to + #2) + I have read the description of the feature/proposal again - especially + "if there is an easy way from inside YaST or while the initial install + to allow a non root user to add a printer." So this seem to be a + proposal to add a easier to realize option to switch the needed + privileges of adding a printer to normal user accounts (and not to + change the default security settings). I would like if an option like + this would be added. I will change my voting in pro/up. I think an good + place would be ether YaST>Security_Center or YaST>Printer or to both if + it would be only two GuIs that would effect the same settings (and the + change of one would also change the status you see on the other one). + So please pardon me about my misunderstanding the meaning of the + description. + Regards Martin #3: Sergio Gabriel (dahool) (2012-03-18 15:28:58) humm, I would say having an special group with privileges to add printers. Don't like the idea to let all non-root users to do this. -- openSUSE Feature: https://features.opensuse.org/313287

Feature changed by: Johannes Meixner (jsmeix) Feature #313287, revision 9 Title: Allow printer add and modification to users openSUSE Distribution: New Priority Requester: Important Requested by: Lars Müller (lmuelle) Partner organization: openSUSE.org Description: This had been part of the discussion in this thread http://lists.openSUSE.org/opensuse/2012-02/msg01443.html At the moment you need to be root to add a printer. It would be of huge benefit to corporate, soho, and home users if there is an easy way from inside YaST or while the initial install to allow a non root user to add a printer. Discussion: #1: Johannes Meixner (jsmeix) (2012-03-02 16:04:47) As far as I understand it, the request is to have a dialog in YaST to set up what is described at "Allow printer admin tasks for a normal user" in http://en.opensuse.org/SDB:CUPS_in_a_Nutshell #2: Martin Seidler (pistazienfresser) (2012-03-17 17:12:34) (reply to #1) A feature like described by Johannes I would vote up (vote with pro). Eventually a possibility to choose this easily would be able to add alternatively/cumulatively in the Security Center of YaST2. But I do not see the sense in giving a user account by default this might. As far as I know printers could be used to harm for example a network. And in addition for many users it is often not an easy and every day task to add a printer to a linux based system. If an administrator does not trust a user - for example his daughter - to know the root password because he do not trust her honesty or her ability to use this might (and to rate her own ability) then I see no probability why the user/daughter should be able and allowed to add a printer. Because of this I vote against this feature described as it is in the moment. Regards Martin #4: Martin Seidler (pistazienfresser) (2012-03-19 09:31:32) (reply to #2) I have read the description of the feature/proposal again - especially "if there is an easy way from inside YaST or while the initial install to allow a non root user to add a printer." So this seem to be a proposal to add a easier to realize option to switch the needed privileges of adding a printer to normal user accounts (and not to change the default security settings). I would like if an option like this would be added. I will change my voting in pro/up. I think an good place would be ether YaST>Security_Center or YaST>Printer or to both if it would be only two GuIs that would effect the same settings (and the change of one would also change the status you see on the other one). So please pardon me about my misunderstanding the meaning of the description. Regards Martin #5: Johannes Meixner (jsmeix) (2012-03-20 09:36:24) (reply to #4) An "add a easier to realize option to switch the needed privileges of adding a printer to normal user accounts (and not to change the default security settings)" is what I like to implement (and what I can implement) in yast2-printer. I don't know about YaST-Security_Center. We should discuss the pros and cons of having option settings available for the user at serveral places (e.g. yast2-printer and YaST- Security_Center). This would mean that also several programmers would have to maintain the feature in several separated sources so that sooner or later the different sources will become out of sync. #3: Sergio Gabriel (dahool) (2012-03-18 15:28:58) humm, I would say having an special group with privileges to add printers. Don't like the idea to let all non-root users to do this. + #6: Johannes Meixner (jsmeix) (2012-03-20 09:49:08) (reply to #3) + The idea - as far as I understand it - is not to to allow all non-root + users to do this. The idea is what is described at "Allow printer admin + tasks for a normal user" in + http://en.opensuse.org/SDB:CUPS_in_a_Nutshell which means to allow one + or more particular normal users to do this. + FYI: Currently in the yast2-printer "Policies" dialog you can already + set the CUPS operation policy "allowallforanybody" which allows any + user to do anything, see the comment in /etc/cups/cupsd.conf regarding + "Policy allowallforanybody". Of course this policy is not the out-of- + the-box-default CUPS operation policy. When I implement this feature + for the yast2-printer "Policies" dialog I will also enhance the CUPS + operation policy part and show a descriptive information text to the + user what each CUPS operation policy means (I can only show an + information text for those CUPS operation policies where I know the + policy name in advance - i.e. I cannot show an information text in + yast2-printer for CUPS operation policies which have been manually + added or changed by the admin). For details regarding CUPS operation + policies see http://www.cups.org/documentation.php/doc-1.5/policies. + html -- openSUSE Feature: https://features.opensuse.org/313287

Feature changed by: Philippe Baril Lecavalier (p_barill) Feature #313287, revision 11 Title: Allow printer add and modification to users openSUSE Distribution: New Priority Requester: Important Requested by: Lars Müller (lmuelle) Partner organization: openSUSE.org Description: This had been part of the discussion in this thread http://lists.openSUSE.org/opensuse/2012-02/msg01443.html At the moment you need to be root to add a printer. It would be of huge benefit to corporate, soho, and home users if there is an easy way from inside YaST or while the initial install to allow a non root user to add a printer. Discussion: #1: Johannes Meixner (jsmeix) (2012-03-02 16:04:47) As far as I understand it, the request is to have a dialog in YaST to set up what is described at "Allow printer admin tasks for a normal user" in http://en.opensuse.org/SDB:CUPS_in_a_Nutshell #2: Martin Seidler (pistazienfresser) (2012-03-17 17:12:34) (reply to #1) A feature like described by Johannes I would vote up (vote with pro). Eventually a possibility to choose this easily would be able to add alternatively/cumulatively in the Security Center of YaST2. But I do not see the sense in giving a user account by default this might. As far as I know printers could be used to harm for example a network. And in addition for many users it is often not an easy and every day task to add a printer to a linux based system. If an administrator does not trust a user - for example his daughter - to know the root password because he do not trust her honesty or her ability to use this might (and to rate her own ability) then I see no probability why the user/daughter should be able and allowed to add a printer. Because of this I vote against this feature described as it is in the moment. Regards Martin #4: Martin Seidler (pistazienfresser) (2012-03-19 09:31:32) (reply to #2) I have read the description of the feature/proposal again - especially "if there is an easy way from inside YaST or while the initial install to allow a non root user to add a printer." So this seem to be a proposal to add a easier to realize option to switch the needed privileges of adding a printer to normal user accounts (and not to change the default security settings). I would like if an option like this would be added. I will change my voting in pro/up. I think an good place would be ether YaST>Security_Center or YaST>Printer or to both if it would be only two GuIs that would effect the same settings (and the change of one would also change the status you see on the other one). So please pardon me about my misunderstanding the meaning of the description. Regards Martin #5: Johannes Meixner (jsmeix) (2012-03-20 09:36:24) (reply to #4) An "add a easier to realize option to switch the needed privileges of adding a printer to normal user accounts (and not to change the default security settings)" is what I like to implement (and what I can implement) in yast2-printer. I don't know about YaST-Security_Center. We should discuss the pros and cons of having option settings available for the user at serveral places (e.g. yast2-printer and YaST- Security_Center). This would mean that also several programmers would have to maintain the feature in several separated sources so that sooner or later the different sources will become out of sync. #7: Martin Seidler (pistazienfresser) (2012-03-21 11:37:38) (reply to #5) Marcus has written something about [predefined] security profiles: http://lists.opensuse.org/opensuse-security/2012-02/msg00008.html (http://lists.opensuse.org/opensuse-security/2012-02/msg00008.html) Skeptical as I am I doubt that even such profiles will satisfy everybody - (including a special choleric kernel developer or his daughter) even if you define very special profiles. But I also think that there is already a central place in each openSUSE installation to get an overview about the actual security related settings: YaST2 > Security Center and Hardening > Security Overview ; compare for example the Documentation (http://doc.opensuse.org/documentation/html/openSUSE/opensuse-security/cha.se...) and the Package yast2-security (http://software.opensuse.org/package/yast2-security) . The yast2- security package seems to get still commitments (http://lists.opensuse.org/opensuse-commit/2012-01/msg01951.html) . As much as I - with my amateurish knowledge in informatics - could follow the several discussions initiated by that disgusting G+ ranting - the 'problem' seems to me not to be that is were not possible to define the wished policies/settings but that it was not easy to find them - or one step before that to know that there are (by default/actually) defined other policies on the actual installed system than 'someone' would have wished for. If not adding an other switch for that settings in the Security Center - would it be practical to ad least a short description and a link to the place of the settings for printer security policies? Regards Martin #3: Sergio Gabriel (dahool) (2012-03-18 15:28:58) humm, I would say having an special group with privileges to add printers. Don't like the idea to let all non-root users to do this. #6: Johannes Meixner (jsmeix) (2012-03-20 09:49:08) (reply to #3) The idea - as far as I understand it - is not to to allow all non-root users to do this. The idea is what is described at "Allow printer admin tasks for a normal user" in http://en.opensuse.org/SDB:CUPS_in_a_Nutshell which means to allow one or more particular normal users to do this. FYI: Currently in the yast2-printer "Policies" dialog you can already set the CUPS operation policy "allowallforanybody" which allows any user to do anything, see the comment in /etc/cups/cupsd.conf regarding "Policy allowallforanybody". Of course this policy is not the out-of- the-box-default CUPS operation policy. When I implement this feature for the yast2-printer "Policies" dialog I will also enhance the CUPS operation policy part and show a descriptive information text to the user what each CUPS operation policy means (I can only show an information text for those CUPS operation policies where I know the policy name in advance - i.e. I cannot show an information text in yast2-printer for CUPS operation policies which have been manually added or changed by the admin). For details regarding CUPS operation policies see http://www.cups.org/documentation.php/doc-1.5/policies. html + #8: Philippe Baril Lecavalier (p_barill) (2012-07-30 03:29:29) (reply + to #3) + That's a pretty good idea. There's a cdrom group, a floppy group, a + modem group, a video group… somehow no printer group in the list. That + would be more useful than a floppy group these days. -- openSUSE Feature: https://features.opensuse.org/313287