Auditing printing

[Steve Grubb]

On Tuesday, May 1, 2018 2:29:56 PM EDT warron.french wrote:
> OK, so that will cover from CLI as well as something in the gui like
> Firefox?
> 
> For both printing to a print device as well as to a file?

I haven't looked at this code in a very long time. So, I don't remember how 
to enable it to test it. But it should have full coverage to meet export 
requirements for LSPP way back on RHEL 5. The code has been ported all these 
years and is supposed to still work.

-Steve

> On Tue, May 1, 2018 at 2:20 PM, Steve Grubb <sgrubb at redhat.com> wrote:
> > On Tuesday, May 1, 2018 2:05:36 PM EDT warron.french wrote:
> > > I have a requirement to monitor two (2) things:
> > > 
> > > 1. Print to file
> > > 
> > > 2. Print to (printer) device
> > > 
> > > 
> > > What is the best approach for this?
> > 
> > Cups should be hardwired to audit.
> > 
> > # ldd /usr/sbin/cupsd | grep audit
> > 
> >         libaudit.so.1 => /lib64/libaudit.so.1 (0x00007f04f1cfa000)
> > 
> > It's been a long time since I looked at this.
> > 
> > -Steve
> > 
> > > I don't see a syscall that looks
> > > appropriate - but that doesn't mean there is not one.
> > > 
> > > Would I simply do an audit on the *lpr* command?  Or is it another
> > 
> > command?
> > 
> > > I need the ability to monitor printing to both file and device, *FROM*,
> > > linux shell as well as console or GUI.
> > > 
> > > Can someone advise me on how to accomplish this please?
> > > 
> > > 
> > > Thanks in advance,
> > > --------------------------
> > > Warron French