Skip to content

Commit e5079cd

Browse files
coreonecoreone
committed
Allow for customization of policies
1 parent 2cd9025 commit e5079cd

5 files changed

Lines changed: 231 additions & 61 deletions

File tree

‎.github/README.md‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -542,6 +542,46 @@ Installs, configures, and manages the CUPS service.
542542

543543
* `papersize`: Sets the system's default `/etc/papersize`. See `man papersize` for supported values.
544544

545+
* `policies`: Sets the printing policies (`default` and `authenticated`) for CUPS. By default,
546+
it enables the default CUPS settings. You can override those settings by setting all the options
547+
you want set in a policy or setting all the directives in one of the limits under the policy.
548+
You can, of course, also add more policies and other limits under the default policies as needed.
549+
550+
```puppet
551+
class { '::cups':
552+
policies => {
553+
'default' => {
554+
'options' => [
555+
'JobPrivateAccess default',
556+
'JobPrivateValues default',
557+
'SubscriptionPrivateAccess default',
558+
],
559+
'limits' => {
560+
'Create-Job Print-Job Print-URI Validate-Job' => [
561+
'Require user @OWNER @SYSTEM',
562+
'Order deny,allow',
563+
],
564+
},
565+
}
566+
}
567+
}
568+
```
569+
570+
You can also do the same using hiera:
571+
572+
```yaml
573+
cups::policies:
574+
default:
575+
options:
576+
- 'JobPrivateAccess default'
577+
- 'JobPrivateValues default'
578+
- 'SubscriptionPrivateAccess default'
579+
limits:
580+
'Create-Job Print-Job Print-URI Validate-Job':
581+
- 'Require user @OWNER @SYSTEM'
582+
- 'Order deny,allow'
583+
```
584+
545585
* `purge_unmanaged_queues`: Setting `true` will remove all queues from the node
546586
which do not match a `cups_queue` resource in the current catalog. Defaults to `false`.
547587

‎README.md.erb‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -544,6 +544,46 @@ Installs, configures, and manages the CUPS service.
544544

545545
* `papersize`: Sets the system's default `/etc/papersize`. See `man papersize` for supported values.
546546

547+
* `policies`: Sets the printing policies (`default` and `authenticated`) for CUPS. By default,
548+
it enables the default CUPS settings. You can override those settings by setting all the options
549+
you want set in a policy or setting all the directives in one of the limits under the policy.
550+
You can, of course, also add more policies and other limits under the default policies as needed.
551+
552+
```puppet
553+
class { '::cups':
554+
policies => {
555+
'default' => {
556+
'options' => [
557+
'JobPrivateAccess default',
558+
'JobPrivateValues default',
559+
'SubscriptionPrivateAccess default',
560+
],
561+
'limits' => {
562+
'Create-Job Print-Job Print-URI Validate-Job' => [
563+
'Require user @OWNER @SYSTEM',
564+
'Order deny,allow',
565+
],
566+
},
567+
}
568+
}
569+
}
570+
```
571+
572+
You can also do the same using hiera:
573+
574+
```yaml
575+
cups::policies:
576+
default:
577+
options:
578+
- 'JobPrivateAccess default'
579+
- 'JobPrivateValues default'
580+
- 'SubscriptionPrivateAccess default'
581+
limits:
582+
'Create-Job Print-Job Print-URI Validate-Job':
583+
- 'Require user @OWNER @SYSTEM'
584+
- 'Order deny,allow'
585+
```
586+
547587
* `purge_unmanaged_queues`: Setting `true` will remove all queues from the node
548588
which do not match a `cups_queue` resource in the current catalog. Defaults to `false`.
549589

‎manifests/init.pp‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,7 @@
5050
# in order to run CUPS and provide `ipptool`. OS dependent defaults apply.
5151
# @param page_log_format Sets the `PageLogFormat` directive of the CUPS server.
5252
# @param papersize Sets the system's default `/etc/papersize`. See `man papersize` for supported values.
53+
# @param policies Sets the access policies for the CUPS server to use.
5354
# @param purge_unmanaged_queues Setting `true` will remove all queues from the node
5455
# which do not match a `cups_queue` resource in the current catalog.
5556
# @param resources This attribute is intended for use with Hiera or any other ENC.
@@ -82,6 +83,7 @@
8283
Variant[String, Array[String]] $package_names = $::cups::params::package_names,
8384
Optional[String] $page_log_format = undef,
8485
Optional[String] $papersize = undef,
86+
Optional[Hash] $policies = undef,
8587
Boolean $purge_unmanaged_queues = false,
8688
Optional[Hash] $resources = undef,
8789
Optional[Variant[String, Array[String]]] $server_alias = undef,

‎spec/classes/init_spec.rb‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -293,6 +293,54 @@
293293
end
294294
end
295295

296+
describe 'policies' do
297+
let(:facts) { any_supported_os }
298+
299+
describe 'by default' do
300+
it { is_expected.to contain_file('/etc/cups/cupsd.conf').with(content: %r{<Policy default>\s*JobPrivateAccess default\s*JobPrivateValues default\s*SubscriptionPrivateAccess default\s*SubscriptionPrivateValues default\s*<Limit}) }
301+
it { is_expected.to contain_file('/etc/cups/cupsd.conf').with(content: %r{<Policy authenticated>\s*JobPrivateAccess default\s*JobPrivateValues default\s*SubscriptionPrivateAccess default\s*SubscriptionPrivateValues default\s*<Limit}) }
302+
end
303+
304+
context 'when policy options are overridden' do
305+
let(:params) { {
306+
'policies' => {
307+
'default' => {
308+
'options' => [
309+
'JobPrivateAccess default',
310+
'JobPrivateValues default',
311+
],
312+
},
313+
'authenticated' => {
314+
'options' => [
315+
'SubscriptionPrivateAccess default',
316+
'SubscriptionPrivateValues default',
317+
],
318+
}
319+
}
320+
} }
321+
322+
it { is_expected.to contain_file('/etc/cups/cupsd.conf').with(content: %r{<Policy default>\s*JobPrivateAccess default\s*JobPrivateValues default\s*<Limit}) }
323+
it { is_expected.to contain_file('/etc/cups/cupsd.conf').with(content: %r{<Policy authenticated>\s*SubscriptionPrivateAccess default\s*SubscriptionPrivateValues default\s*<Limit}) }
324+
end
325+
326+
context 'when policy options are overridden' do
327+
let(:params) { {
328+
'policies' => {
329+
'default' => {
330+
'limits' => {
331+
'Create-Job Print-Job Print-URI Validate-Job' => [
332+
'Require user @OWNER @SYSTEM',
333+
'Order deny,allow'
334+
],
335+
}
336+
}
337+
}
338+
} }
339+
340+
it { is_expected.to contain_file('/etc/cups/cupsd.conf').with(content: %r{<Limit\s*Create-Job\s*Print-Job\s*Print-URI\s*Validate-Job>\s*Require\s*user\s*@OWNER\s*@SYSTEM\s*Order\s*deny,allow\s*</Limit>}) }
341+
end
342+
end
343+
296344
describe 'log_debug_history' do
297345
let(:facts) { any_supported_os }
298346

‎templates/cupsd/_policies.erb‎

Lines changed: 101 additions & 61 deletions
Original file line numberDiff line numberDiff line change
@@ -1,63 +1,103 @@
1-
<Policy default>
2-
JobPrivateAccess default
3-
JobPrivateValues default
4-
SubscriptionPrivateAccess default
5-
SubscriptionPrivateValues default
6-
<Limit Create-Job Print-Job Print-URI Validate-Job>
7-
Order deny,allow
8-
</Limit>
9-
<Limit Send-Document Send-URI Hold-Job Release-Job Restart-Job Purge-Jobs Set-Job-Attributes Create-Job-Subscription Renew-Subscription Cancel-Subscription Get-Notifications Reprocess-Job Cancel-Current-Job Suspend-Current-Job Resume-Job Cancel-My-Jobs Close-Job CUPS-Move-Job CUPS-Get-Document>
10-
Require user @OWNER @SYSTEM
11-
Order deny,allow
12-
</Limit>
13-
<Limit CUPS-Add-Modify-Printer CUPS-Delete-Printer CUPS-Add-Modify-Class CUPS-Delete-Class CUPS-Set-Default CUPS-Get-Devices>
14-
AuthType Default
15-
Require user @SYSTEM
16-
Order deny,allow
17-
</Limit>
18-
<Limit Pause-Printer Resume-Printer Enable-Printer Disable-Printer Pause-Printer-After-Current-Job Hold-New-Jobs Release-Held-New-Jobs Deactivate-Printer Activate-Printer Restart-Printer Shutdown-Printer Startup-Printer Promote-Job Schedule-Job-After Cancel-Jobs CUPS-Accept-Jobs CUPS-Reject-Jobs>
19-
AuthType Default
20-
Require user @SYSTEM
21-
Order deny,allow
22-
</Limit>
23-
<Limit Cancel-Job CUPS-Authenticate-Job>
24-
Require user @OWNER @SYSTEM
25-
Order deny,allow
26-
</Limit>
27-
<Limit All>
28-
Order deny,allow
29-
</Limit>
30-
</Policy>
31-
<Policy authenticated>
32-
JobPrivateAccess default
33-
JobPrivateValues default
34-
SubscriptionPrivateAccess default
35-
SubscriptionPrivateValues default
36-
<Limit Create-Job Print-Job Print-URI Validate-Job>
37-
AuthType Default
38-
Order deny,allow
39-
</Limit>
40-
<Limit Send-Document Send-URI Hold-Job Release-Job Restart-Job Purge-Jobs Set-Job-Attributes Create-Job-Subscription Renew-Subscription Cancel-Subscription Get-Notifications Reprocess-Job Cancel-Current-Job Suspend-Current-Job Resume-Job Cancel-My-Jobs Close-Job CUPS-Move-Job CUPS-Get-Document>
41-
AuthType Default
42-
Require user @OWNER @SYSTEM
43-
Order deny,allow
44-
</Limit>
45-
<Limit CUPS-Add-Modify-Printer CUPS-Delete-Printer CUPS-Add-Modify-Class CUPS-Delete-Class CUPS-Set-Default>
46-
AuthType Default
47-
Require user @SYSTEM
48-
Order deny,allow
49-
</Limit>
50-
<Limit Pause-Printer Resume-Printer Enable-Printer Disable-Printer Pause-Printer-After-Current-Job Hold-New-Jobs Release-Held-New-Jobs Deactivate-Printer Activate-Printer Restart-Printer Shutdown-Printer Startup-Printer Promote-Job Schedule-Job-After Cancel-Jobs CUPS-Accept-Jobs CUPS-Reject-Jobs>
51-
AuthType Default
52-
Require user @SYSTEM
53-
Order deny,allow
54-
</Limit>
55-
<Limit Cancel-Job CUPS-Authenticate-Job>
56-
AuthType Default
57-
Require user @OWNER @SYSTEM
58-
Order deny,allow
59-
</Limit>
60-
<Limit All>
61-
Order deny,allow
1+
<%
2+
cups_policies_defaults = {
3+
'default' => {
4+
'options' => [
5+
'JobPrivateAccess default', 'JobPrivateValues default', 'SubscriptionPrivateAccess default', 'SubscriptionPrivateValues default',
6+
],
7+
'limits' => {
8+
'Create-Job Print-Job Print-URI Validate-Job' => ['Order deny,allow'],
9+
'Send-Document Send-URI Hold-Job Release-Job Restart-Job Purge-Jobs Set-Job-Attributes Create-Job-Subscription Renew-Subscription Cancel-Subscription Get-Notifications Reprocess-Job Cancel-Current-Job Suspend-Current-Job Resume-Job Cancel-My-Jobs Close-Job CUPS-Move-Job CUPS-Get-Document' => [
10+
'Require user @OWNER @SYSTEM',
11+
'Order deny,allow',
12+
],
13+
'CUPS-Add-Modify-Printer CUPS-Delete-Printer CUPS-Add-Modify-Class CUPS-Delete-Class CUPS-Set-Default CUPS-Get-Devices' => [
14+
'AuthType Default',
15+
'Require user @SYSTEM',
16+
'Order deny,allow',
17+
],
18+
'Pause-Printer Resume-Printer Enable-Printer Disable-Printer Pause-Printer-After-Current-Job Hold-New-Jobs Release-Held-New-Jobs Deactivate-Printer Activate-Printer Restart-Printer Shutdown-Printer Startup-Printer Promote-Job Schedule-Job-After Cancel-Jobs CUPS-Accept-Jobs CUPS-Reject-Jobs' => [
19+
'AuthType Default',
20+
'Require user @SYSTEM',
21+
'Order deny,allow',
22+
],
23+
'Cancel-Job CUPS-Authenticate-Job' => [
24+
'Require user @OWNER @SYSTEM',
25+
'Order deny,allow',
26+
],
27+
'All' => [
28+
'Order deny,allow',
29+
],
30+
},
31+
},
32+
'authenticated' => {
33+
'options' => [
34+
'JobPrivateAccess default', 'JobPrivateValues default', 'SubscriptionPrivateAccess default', 'SubscriptionPrivateValues default',
35+
],
36+
'limits' => {
37+
'Create-Job Print-Job Print-URI Validate-Job' => ['AuthType Default', 'Order deny,allow'],
38+
'Send-Document Send-URI Hold-Job Release-Job Restart-Job Purge-Jobs Set-Job-Attributes Create-Job-Subscription Renew-Subscription Cancel-Subscription Get-Notifications Reprocess-Job Cancel-Current-Job Suspend-Current-Job Resume-Job Cancel-My-Jobs Close-Job CUPS-Move-Job CUPS-Get-Document' => [
39+
'AuthType Default',
40+
'Require user @OWNER @SYSTEM',
41+
'Order deny,allow',
42+
],
43+
'CUPS-Add-Modify-Printer CUPS-Delete-Printer CUPS-Add-Modify-Class CUPS-Delete-Class CUPS-Set-Default' => [
44+
'AuthType Default',
45+
'Require user @SYSTEM',
46+
'Order deny,allow',
47+
],
48+
'Pause-Printer Resume-Printer Enable-Printer Disable-Printer Pause-Printer-After-Current-Job Hold-New-Jobs Release-Held-New-Jobs Deactivate-Printer Activate-Printer Restart-Printer Shutdown-Printer Startup-Printer Promote-Job Schedule-Job-After Cancel-Jobs CUPS-Accept-Jobs CUPS-Reject-Jobs' => [
49+
'AuthType Default',
50+
'Require user @SYSTEM',
51+
'Order deny,allow',
52+
],
53+
'Cancel-Job CUPS-Authenticate-Job' => [
54+
'AuthType Default',
55+
'Require user @OWNER @SYSTEM',
56+
'Order deny,allow',
57+
],
58+
'All' => [
59+
'Order deny,allow',
60+
],
61+
},
62+
},
63+
}
64+
65+
@final_policies = cups_policies_defaults
66+
67+
if ! @policies.nil? && @policies.is_a?(Hash)
68+
@policies.each_pair do |policy, directives|
69+
if ! @final_policies.has_key?(policy)
70+
@final_policies[policy] ||= directives
71+
else
72+
if directives.has_key?('options')
73+
@final_policies[policy]['options'] = directives['options']
74+
end
75+
if directives.has_key?('limits')
76+
directives['limits'].each_pair do |lim, opts|
77+
@final_policies[policy]['limits'][lim] = opts
78+
end
79+
end
80+
end
81+
end
82+
end
83+
84+
-%>
85+
<% @final_policies.each_pair do |policy, directives| -%>
86+
<% next if directives.nil? || directives.empty? -%>
87+
<Policy <%= policy -%>>
88+
<% if directives.has_key?('options') -%>
89+
<% directives['options'].each do |opt| -%>
90+
<%= opt %>
91+
<% end -%>
92+
<% end -%>
93+
<% if directives.has_key?('limits') -%>
94+
<% directives['limits'].each_pair do |lim, opts| -%>
95+
<Limit <%= lim %>>
96+
<% opts.each do |opt| -%>
97+
<%= opt %>
98+
<% end -%>
6299
</Limit>
100+
<% end -%>
101+
<% end -%>
63102
</Policy>
103+
<% end -%>

0 commit comments

Comments
 (0)