Re: Haven't seen this lp problem before

On Aug 16, 9:17 am, Tony Lawrence <pcu...@xxxxxxxxx> wrote:
On Aug 15, 6:19 pm, Tony  Lawrence <pcu...@xxxxxxxxx> wrote:



On Aug 15, 1:17 pm, Jean-Pierre Radley <j...@xxxxxxx> wrote:

Bill Campbell typed (on Fri, Aug 15, 2008 at 09:45:52AM -0700):
| On Fri, Aug 15, 2008, Tony Lawrence wrote:
| >I'm baffled at the moment.
| >
| >Symptoms are that root can print, other users cannot.   That's usually
| >perms , and sure enough, it looked like someone had done a chmod 777
| >where they shouldn't have, but I fixed all that and lp etc all have
| >setuid where they should now.
| >
| >I've run custom for strict database compliance, integrity, and double
| >checked everything I can think of but still get
| >
| >UX:lp: ERROR: Can't establish contact with the LP print service.
| >      TO FIX: Either the LP print service has stopped,
| >              or all message channels are busy. If the
| >              problem continues, get help from your
| >              system administrator.
| >
| >
| >It's not rlp either..  don't have "trace" on this box so can't see
| >where it really dies, nothing in logs..  I'm brain stopped right now..
|
| Is /usr/lib/lpsched running?

If it weren't, then root couldn't print either.

--
JP

Correct.  And root can print.

Perms all seem fine for /usr/spool/lp and below..  very puzzling..

OK, I turned on auditing for the user I'm testing with.

It is perms, and it is failing to write the FIFO

But..   it should be setgid lp when it doers that, and that shouldn't
fail (FIFO is correct p-w--w--  bin lp )

It's been a long time since I looked at an audit report, but shouldn't
the egid have changed after the exec here??

Process ID: 873         Date/Time: Sat Aug 16 08:33:47 2008
Luid: tonylaw  Euid: tonylaw  Ruid: tonylaw  Egid: group  Rgid: group
Supp groups: (*NONE*)
Event type: Map object to subject
System call: Exece
Object: /usr/lpd/local/lp
Result: Successful

.. (library reads deleted)

lp is:
---x--s--x   1 bin      lp          2600 Aug  5 10:12 /var/opt/K/SCO/
Unix/5.0.5Eb/usr/bin/lp

Luid: tonylaw  Euid: tonylaw  Ruid: tonylaw  Egid: group  Rgid: group
Supp groups: (*NONE*)
Event type: Modify process
System call: Proctl
Pid: 51 Commands: PRNORMEX
Result: Successful

Process ID: 873         Date/Time: Sat Aug 16 08:33:47 2008
Luid: tonylaw  Euid: tonylaw  Ruid: tonylaw  Egid: group  Rgid: group
Supp groups: (*NONE*)
Event type: Modify process
System call: Setgid
Result: Successful

Process ID: 873         Date/Time: Sat Aug 16 08:33:47 2008
Luid: tonylaw  Euid: tonylaw  Ruid: tonylaw  Egid: group  Rgid: group
Supp groups: (*NONE*)
Event type: Modify process
System call: Setgid
Result: Successful

Process ID: 873         Date/Time: Sat Aug 16 08:33:47 2008
Luid: tonylaw  Euid: tonylaw  Ruid: tonylaw  Egid: group  Rgid: group
Supp groups: (*NONE*)
Event type: Make object unavailable
System call: Close
File Access-Read: No   Written: No
Object: /usr/spool/lp/SCHEDLOCK
Result: Successful

Process ID: 873         Date/Time: Sat Aug 16 08:33:47 2008
Luid: tonylaw  Euid: tonylaw  Ruid: tonylaw  Egid: group  Rgid: group
Supp groups: (*NONE*)
Event type: Access denial
System call: Open       Mode: Write
Object: /usr/spool/lp/fifos/FIFO
Result: Failed-EACCES (Permission denied): 13
Security policy: discretionary

drwxrwx---   4 bin      lp           512 Aug 16 08:52 fifos
p-w--w----   1 root     lp             0 Aug 16 08:27 FIFO

So it looks like the setgid is not taking..   but it didn't fail, so
that makes no sense..

Still baffled..

And just for grins, I set the FIFO o+w and it still failed.. that
makes no sense to me either..

It seemed to me that somehow setgid must be broken, but "at" works, so
does "su"..

Then I though maybe lp itself is in trouble so I "su lp" and lp itself
can print..

Have to be missing something very basic..

Customer had said this:

"It seemed that issue 2 was a permission issue so I changed some
folders
which had no read perimision to write and seems like almost right away
it
failed the printers. "

I asked WHICH folders - of course he doesn't remember :-)

But I've compared /usr/spool/lp to a working system, noticed nothing
out of place at all..

total 52
-rw-rw-r-- 1 lp lp 0 Aug 16 08:52 SCHEDLOCK
drwxrwxr-x 3 bin lp 512 Feb 20 1999 admins
drwxrwxr-x 2 bin lp 512 Feb 20 1999 bin
lrwxrwxrwx 1 root root 48 Feb 20 1999 default -> /var/
opt/K/SCO/Unix/5.0.5Eb/usr/spool/lp/default
drwxrwx--- 4 bin lp 512 Aug 16 08:52 fifos
lrwxrwxrwx 1 root root 53 Feb 20 1999 forms.readme -> /
var/opt/K/SCO/Unix/5.0.5Eb/usr/spool/lp/forms.readme
drwxrwx--- 2 bin lp 512 Feb 25 1999 logs
drwxrwx--- 2 bin lp 1024 Apr 2 2004 model
lrwxrwxrwx 1 root root 53 Feb 20 1999 options_list -> /
var/opt/K/SCO/Unix/5.0.5Eb/usr/spool/lp/options_list
drwxrwx--- 2 bin lp 5632 Aug 16 09:06 requests
drwxrwx--- 2 bin lp 512 Feb 25 1999 system
drwxrwxr-x 2 bin lp 10752 Aug 16 09:06 temp

./admins:
total 2
drwxrwxr-x 8 bin lp 512 Feb 20 1999 lp

./admins/lp:
total 14
drwxrwx--- 2 bin lp 512 Feb 20 1999 classes
lrwxrwxrwx 1 root root 63 Feb 20 1999 filter.table -> /
var/opt/K/SCO/Unix/5.0.5Eb/usr/spool/lp/admins/lp/filter.table
drwxrwx--- 2 bin lp 512 Feb 20 1999 forms
drwxrwxr-x 4 bin lp 512 Aug 5 10:24 interfaces
drwxrwx--- 2 bin lp 512 Feb 20 1999 logs
drwxrwxr-x 16 bin lp 512 Aug 5 10:24 printers
drwxrwx--- 2 bin lp 512 Feb 20 1999 pwheels

./admins/lp/classes:
total 0

./admins/lp/forms:
total 0

./admins/lp/interfaces:
total 138
drwxrwxr-x 2 bin lp 512 Mar 6 1999 .SysInterfaces
-rwxrwxr-x 1 lp lp 4562 Jul 9 2001 david
-rwxrwxr-x 1 lp lp 6730 Feb 26 1999 deskjet
-rwxrwxr-x 1 lp lp 4683 Mar 8 1999 dmp300
-rwxrwxr-x 1 lp lp 3070 Sep 9 2005 fl3410
-rwxrwxr-x 1 lp lp 3070 Apr 2 2004 hp4000t
-rwxrwxr-x 1 lp lp 3070 Apr 9 2004 hp4000t.o
-rwxrwxr-x 1 lp lp 4683 Mar 6 1999 lexmark
drwxrwxr-x 2 bin lp 512 Sep 9 2005 model.orig
-rwxrwxr-x 1 lp lp 4562 Aug 5 10:24 muratec
-rwxrwxr-x 1 lp lp 4562 Dec 8 2001 norm
-rwxrwxr-x 1 lp lp 4297 Aug 5 09:28 oki393
-rwxrwxr-x 1 lp lp 4297 Aug 5 09:55 okia03
-rwxrwxr-x 1 lp lp 921 Mar 6 1999 printer
-rwxrwxr-x 1 lp lp 4683 Mar 6 1999 printer2
-rwxrwxr-x 1 lp lp 4272 Jun 16 1999 printernf
-rwxrwxr-x 1 lp lp 4683 Mar 6 1999 serial3o

./admins/lp/interfaces/.SysInterfaces:
total 10
-rwxrwxr-x 1 lp lp 4683 Mar 6 1999 printer

./admins/lp/interfaces/model.orig:
total 72
-rwxrwxr-x 1 bin lp 4683 Sep 9 2005 fl3410
-rwxrwxr-x 1 bin lp 30189 Apr 2 2004 hp4000t

./admins/lp/logs:
total 0

./admins/lp/printers:
total 28
drwxrwx--- 2 lp lp 512 Jul 9 2001 david
drwxrwx--- 2 lp lp 512 Feb 26 1999 deskjet
drwxrwx--- 2 lp lp 512 Mar 8 1999 dmp300
drwxrwx--- 2 lp lp 512 Sep 9 2005 fl3410
drwxrwx--- 2 lp lp 512 Apr 2 2004 hp4000t
drwxrwx--- 2 lp lp 512 Mar 6 1999 lexmark
drwxrwx--- 2 lp lp 512 Aug 5 10:24 muratec
drwxrwx--- 2 lp lp 512 Dec 8 2001 norm
drwxrwx--- 2 lp lp 512 Jul 15 2005 oki393
drwxrwx--- 2 lp lp 512 May 11 2005 okia03
drwxrwx--- 2 lp lp 512 Jul 16 2002 printer
drwxrwx--- 2 lp lp 512 Mar 6 1999 printer2
drwxrwx--- 2 lp lp 512 Jun 16 1999 printernf
drwxrwx--- 2 lp lp 512 Mar 6 1999 serial3o

./admins/lp/printers/david:
total 10
-rwxrwx--- 1 lp lp 2240 Jul 9 2001 alert.sh
-rw-rw---- 1 lp lp 4 Jul 9 2001 alert.vars
-rw-rw-r-- 1 lp lp 119 Jul 9 2001 configuration
-rw-rw-r-- 1 lp lp 0 Jul 9 2001 users.deny

./admins/lp/printers/deskjet:
total 14
-rwxrwx--- 1 lp lp 4858 Feb 26 1999 alert.sh
-rw-rw---- 1 lp lp 4 Feb 26 1999 alert.vars
-rw-rw-r-- 1 lp lp 161 Feb 26 1999 configuration
-rw-rw-r-- 1 lp lp 0 Feb 26 1999 users.deny

./admins/lp/printers/dmp300:
total 8
-rwxrwx--- 1 lp lp 1608 Mar 8 1999 alert.sh
-rw-rw---- 1 lp lp 4 Mar 8 1999 alert.vars
-rw-rw-r-- 1 lp lp 123 Mar 8 1999 configuration
-rw-rw-r-- 1 lp lp 0 Mar 8 1999 users.deny

./admins/lp/printers/fl3410:
total 14
-rwxrwx--- 1 lp lp 4870 Sep 9 2005 alert.sh
-rw-rw---- 1 lp lp 4 Sep 9 2005 alert.vars
-rw-rw-r-- 1 lp lp 143 Sep 9 2005 configuration
-rw-rw-r-- 1 lp lp 0 Sep 9 2005 users.deny

./admins/lp/printers/hp4000t:
total 14
-rwxrwx--- 1 lp lp 4870 Apr 2 2004 alert.sh
-rw-rw---- 1 lp lp 4 Apr 2 2004 alert.vars
-rw-rw-r-- 1 lp lp 145 Apr 2 2004 configuration
-rw-rw-r-- 1 lp lp 0 Apr 2 2004 users.deny

./admins/lp/printers/lexmark:
total 14
-rwxrwx--- 1 lp lp 4858 Mar 6 1999 alert.sh
-rw-rw---- 1 lp lp 4 Mar 6 1999 alert.vars
-rw-rw-r-- 1 lp lp 145 Mar 6 1999 configuration
-rw-rw-r-- 1 lp lp 0 Mar 6 1999 users.deny

./admins/lp/printers/muratec:
total 10
-rwxrwx--- 1 lp lp 2335 Aug 5 10:24 alert.sh
-rw-rw---- 1 lp lp 4 Aug 5 10:24 alert.vars
-rw-rw-r-- 1 lp lp 119 Aug 5 10:24 configuration
-rw-rw-r-- 1 lp lp 0 Aug 5 10:24 users.deny

./admins/lp/printers/norm:
total 10
-rwxrwx--- 1 lp lp 2240 Dec 8 2001 alert.sh
-rw-rw---- 1 lp lp 4 Dec 8 2001 alert.vars
-rw-rw-r-- 1 lp lp 119 Dec 8 2001 configuration
-rw-rw-r-- 1 lp lp 0 Dec 8 2001 users.deny

./admins/lp/printers/oki393:
total 14
-rwxrwx--- 1 lp lp 4870 Jul 15 2005 alert.sh
-rw-rw---- 1 lp lp 4 Jul 15 2005 alert.vars
-rw-rw-r-- 1 lp lp 141 Jul 15 2005 configuration
-rw-rw-r-- 1 lp lp 0 Jul 15 2005 users.deny

./admins/lp/printers/okia03:
total 10
-rwxrwx--- 1 lp lp 2240 May 11 2005 alert.sh
-rw-rw---- 1 lp lp 4 May 11 2005 alert.vars
-rw-rw-r-- 1 lp lp 119 May 11 2005 configuration
-rw-rw-r-- 1 lp lp 0 May 11 2005 users.deny

./admins/lp/printers/printer:
total 16
-rwxrwx--- 1 lp lp 4858 Mar 6 1999 alert.sh
-rw-rw---- 1 lp lp 4 Mar 6 1999 alert.vars
-rw-rw-r-- 1 lp lp 158 Mar 6 1999 configuration
-rw-rw-r-- 1 lp lp 54 Jul 16 2002 users.deny

./admins/lp/printers/printer2:
total 16
-rwxrwx--- 1 lp lp 4858 Mar 6 1999 alert.sh
-rw-rw---- 1 lp lp 4 Mar 6 1999 alert.vars
-rw-rw-r-- 1 lp lp 158 Mar 6 1999 configuration
-rw-rw-r-- 1 lp lp 394 Mar 6 1999 users.allow
-rw-rw-r-- 1 lp lp 0 Mar 6 1999 users.deny

./admins/lp/printers/printernf:
total 16
-rwxrwx--- 1 lp lp 4858 Jun 16 1999 alert.sh
-rw-rw---- 1 lp lp 4 Jun 16 1999 alert.vars
-rw-rw-r-- 1 lp lp 16 Jun 16 1999 comment
-rw-rw-r-- 1 lp lp 156 Jun 16 1999 configuration
-rw-rw-r-- 1 lp lp 0 Jun 16 1999 users.deny

./admins/lp/printers/serial3o:
total 14
-rwxrwx--- 1 lp lp 4858 Mar 10 1999 alert.sh
-rw-rw---- 1 lp lp 4 Mar 10 1999 alert.vars
-rw-rw-r-- 1 lp lp 156 Mar 10 1999 configuration
-rw-rw-r-- 1 lp lp 0 Mar 6 1999 users.deny

./admins/lp/pwheels:
total 0

./bin:
total 2
lrwxrwxrwx 1 root root 52 Feb 20 1999 alert.proto -> /
opt/K/SCO/Unix/5.0.5Eb/usr/spool/lp/bin/alert.proto
lrwxrwxrwx 1 root root 53 Feb 20 1999 drain.output -> /
opt/K/SCO/Unix/5.0.5Eb/usr/spool/lp/bin/drain.output
lrwxrwxrwx 1 root root 46 Feb 20 1999 escps -> /opt/K/
SCO/Unix/5.0.5Eb/usr/spool/lp/bin/escps
lrwxrwxrwx 1 root root 51 Feb 20 1999 iso8859.ps -> /
opt/K/SCO/Unix/5.0.5Eb/usr/spool/lp/bin/iso8859.ps
lrwxrwxrwx 1 root root 47 Feb 20 1999 lp.cat -> /opt/K/
SCO/Unix/5.0.5Eb/usr/spool/lp/bin/lp.cat
lrwxrwxrwx 1 root root 48 Feb 20 1999 lp.page -> /opt/
K/SCO/Unix/5.0.5Eb/usr/spool/lp/bin/lp.page
lrwxrwxrwx 1 root root 47 Feb 20 1999 lp.set -> /opt/K/
SCO/Unix/5.0.5Eb/usr/spool/lp/bin/lp.set
lrwxrwxrwx 1 root root 48 Feb 20 1999 lp.tell -> /opt/
K/SCO/Unix/5.0.5Eb/usr/spool/lp/bin/lp.tell
lrwxrwxrwx 1 root root 51 Feb 20 1999 lpsched.jr -> /
opt/K/SCO/Unix/5.0.5Eb/usr/spool/lp/bin/lpsched.jr
lrwxrwxrwx 1 root root 47 Feb 20 1999 rlpcmd -> /opt/K/
SCO/Unix/5.0.5Eb/usr/spool/lp/bin/rlpcmd
lrwxrwxrwx 1 root root 52 Feb 20 1999 slow.filter -> /
opt/K/SCO/Unix/5.0.5Eb/usr/spool/lp/bin/slow.filter
lrwxrwxrwx 1 root root 50 Feb 20 1999 text2post -> /
opt/K/SCO/Unix/5.0.5Eb/usr/spool/lp/bin/text2post

./fifos:
total 4
p-w--w---- 1 root lp 0 Aug 16 09:06 FIFO
drwxrwx--- 2 bin lp 512 Aug 16 09:06 private
drwxrwx--- 2 bin lp 512 Aug 16 09:06 public

./fifos/private:
total 0

./fifos/public:
total 0

./logs:
total 316
-rw-rw---- 1 root lp 57050 Aug 16 08:52 lpsched
-rw-rw---- 1 lp lp 102030 Aug 16 09:07 requests

./model:
total 174
lrwxrwxrwx 1 root root 47 Feb 20 1999 1640 -> /opt/K/
SCO/Unix/5.0.5Eb/usr/spool/lp/model/1640
lrwxrwxrwx 1 root root 47 Feb 20 1999 5310 -> /opt/K/
SCO/Unix/5.0.5Eb/usr/spool/lp/model/5310
lrwxrwxrwx 1 root root 57 Feb 20 1999 DECColormatePS -
/opt/K/SCO/Unix/5.0.5Eb/usr/spool/lp/model/DECColormatePS
lrwxrwxrwx 1 root root 55 Feb 20 1999 DEClaser1150 -> /
opt/K/SCO/Unix/5.0.5Eb/usr/spool/lp/model/DEClaser1150
lrwxrwxrwx 1 root root 55 Feb 20 1999 DEClaser2150 -> /
opt/K/SCO/Unix/5.0.5Eb/usr/spool/lp/model/DEClaser1150
lrwxrwxrwx 1 root root 55 Feb 20 1999 DEClaser2250 -> /
opt/K/SCO/Unix/5.0.5Eb/usr/spool/lp/model/DEClaser2250
lrwxrwxrwx 1 root root 55 Feb 20 1999 DEClaser3250 -> /
opt/K/SCO/Unix/5.0.5Eb/usr/spool/lp/model/DEClaser3250
lrwxrwxrwx 1 root root 55 Feb 20 1999 HPDeskJet500 -> /
opt/K/SCO/Unix/5.0.5Eb/usr/spool/lp/model/HPDeskJet500
lrwxrwxrwx 1 root root 55 Feb 20 1999 HPDeskJetPlus -
/opt/K/SCO/Unix/5.0.5Eb/usr/spool/lp/model/HPDeskJet500
lrwxrwxrwx 1 root root 53 Feb 20 1999 HPLaserJet -> /
opt/K/SCO/Unix/5.0.5Eb/usr/spool/lp/model/HPLaserJet
lrwxrwxrwx 1 root root 50 Feb 20 1999 crnlmap -> /opt/
K/SCO/Unix/5.0.5Eb/usr/spool/lp/model/crnlmap
lrwxrwxrwx 1 root root 48 Feb 20 1999 dqp10 -> /opt/K/
SCO/Unix/5.0.5Eb/usr/spool/lp/model/dqp10
lrwxrwxrwx 1 root root 47 Feb 20 1999 dumb -> /opt/K/
SCO/Unix/5.0.5Eb/usr/spool/lp/model/dumb
lrwxrwxrwx 1 root root 51 Feb 20 1999 emulator -> /opt/
K/SCO/Unix/5.0.5Eb/usr/spool/lp/model/emulator
lrwxrwxrwx 1 root root 48 Feb 20 1999 epson -> /opt/K/
SCO/Unix/5.0.5Eb/usr/spool/lp/model/epson
lrwxrwxrwx 1 root root 47 Feb 20 1999 f450 -> /opt/K/
SCO/Unix/5.0.5Eb/usr/spool/lp/model/f450
lrwxrwxrwx 1 root root 45 Feb 20 1999 hp -> /opt/K/SCO/
Unix/5.0.5Eb/usr/spool/lp/model/hp
-r-xr-x--- 1 bin lp 1613 Apr 2 2004 hpplotter
-r-xr-x--- 1 bin lp 37038 Apr 2 2004 laserjetIIIsi
-r-xr-x--- 1 bin lp 30189 Apr 2 2004 laserjethpnp
lrwxrwxrwx 1 root root 48 Feb 20 1999 lqp40 -> /opt/K/
SCO/Unix/5.0.5Eb/usr/spool/lp/model/lqp40
lrwxrwxrwx 1 root root 50 Feb 20 1999 network -> /opt/
K/SCO/Unix/5.0.5Eb/usr/spool/lp/model/network
lrwxrwxrwx 1 root root 53 Feb 20 1999 network.ps -> /
opt/K/SCO/Unix/5.0.5Eb/usr/spool/lp/model/network.ps
lrwxrwxrwx 1 root root 50 Feb 20 1999 ph.daps -> /opt/
K/SCO/Unix/5.0.5Eb/usr/spool/lp/model/ph.daps
lrwxrwxrwx 1 root root 53 Feb 20 1999 postscript -> /
opt/K/SCO/Unix/5.0.5Eb/usr/spool/lp/model/postscript
lrwxrwxrwx 1 root root 47 Feb 20 1999 pprx -> /opt/K/
SCO/Unix/5.0.5Eb/usr/spool/lp/model/pprx
lrwxrwxrwx 1 root root 53 Feb 20 1999 proprinter -> /
opt/K/SCO/Unix/5.0.5Eb/usr/spool/lp/model/proprinter
lrwxrwxrwx 1 root root 46 Feb 20 1999 prx -> /opt/K/
SCO/Unix/5.0.5Eb/usr/spool/lp/model/prx
lrwxrwxrwx 1 root root 51 Feb 20 1999 qume1155 -> /opt/
K/SCO/Unix/5.0.5Eb/usr/spool/lp/model/qume1155
lrwxrwxrwx 1 root root 51 Feb 20 1999 standard -> /opt/
K/SCO/Unix/5.0.5Eb/usr/spool/lp/model/standard
lrwxrwxrwx 1 root root 48 Feb 20 1999 ti800 -> /opt/K/
SCO/Unix/5.0.5Eb/usr/spool/lp/model/ti800
-r-xr-x--- 1 bin lp 4562 Jul 9 2001 visionfs

./requests:
total 2
-rw-rw---- 1 lp lp 47 Aug 5 09:55 139342-0

./system:
total 4
-rw-rw-r-- 1 lp lp 1274 Aug 11 14:43 pstatus

./temp:
total 12
-rw-rw---- 1 root lp 18 Aug 16 09:06 .SEQF
lrwxrwxrwx 1 root root 55 Feb 20 1999 435_table -> /
var/opt/K/SCO/Unix/5.0.5Eb/usr/spool/lp/temp/435_table
lrwxrwxrwx 1 root root 55 Feb 20 1999 455_table -> /
var/opt/K/SCO/Unix/5.0.5Eb/usr/spool/lp/temp/455_table
lrwxrwxrwx 1 root root 55 Feb 20 1999 473_table -> /
var/opt/K/SCO/Unix/5.0.5Eb/usr/spool/lp/temp/473_table
lrwxrwxrwx 1 root root 55 Feb 20 1999 475_table -> /
var/opt/K/SCO/Unix/5.0.5Eb/usr/spool/lp/temp/475_table
lrwxrwxrwx 1 root root 54 Feb 20 1999 HP_table -> /var/
opt/K/SCO/Unix/5.0.5Eb/usr/spool/lp/temp/HP_table


.

Relevant Pages