#

# CDDL HEADER START

#

# The contents of this file are subject to the terms of the

# Common Development and Distribution License (the "License").

# You may not use this file except in compliance with the License.

#

# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE

# or http://www.opensolaris.org/os/licensing.

# See the License for the specific language governing permissions

# and limitations under the License.

#

# When distributing Covered Code, include this CDDL HEADER in each

# file and include the License file at usr/src/OPENSOLARIS.LICENSE.

# If applicable, add the following below this CDDL HEADER, with the

# fields enclosed by brackets "[]" replaced with your own identifying

# information: Portions Copyright [yyyy] [name of copyright owner]

#

# CDDL HEADER END

#

# Copyright (c) 2012, Oracle and/or its affiliates. All rights reserved.

#

SETTING UP TEST ENVIRONMENT

---------------------------

The following steps should be followed for setting up the test environment

for Trusted Solaris:

1. Install trusted packages

# pkg install system/trusted

# pkg install system/trusted/trusted-global-zone

# pkg install trusted-extensions

2. Enable labeld service

# svcadm enable -s labeld

3. Verify that the service is enabled.

# svcs -x labeld

svc:/system/labeld:default (Trusted Extensions)

State: online since weekday month date hour:minute:second year

See: labeld(1M)

Impact: None.

4. This step is required in case you want to install your own

label_encodings file.

To test labels greater than 80 characters, you will have to use

large labels_encodings file.

i) Copy the label_encodings file to the disk.

ii) Check the syntax of the file and make it the active

label_encodings file.

a) Run the chk_encodings command.

# /usr/sbin/chk_encodings /full-pathname-of-label-encodings-file

b) Make the file the active label_encodings file.

# cp /full-pathname-of-label-encodings-file \

/etc/security/tsol/label.encodings.site

# cd /etc/security/tsol

# cp label_encodings label_encodings.tx.orig

# cp label.encodings.site label_encodings

Your label_encodings file must pass the Check Encodings test before

you continue.

5. Reboot the system.

6. Once the system is up after reboot, create labeled zones.

Labeled zones can be created using '/usr/sbin/txzonemgr' command.

For details refer to 'txzonemgr(1M)' manpage.

Documentation on 'Printing in Trusted extensions environment' can be found at:

http://docs.oracle.com/cd/E23824_01/html/821-1482/manageprint-1.html#scrolltoc

--------------------------------------------------------------------------------------------

TEST CASES

----------

All the following test cases should be run in Trusted Solaris environment.

1. Run printing test suite for CUPS.

Details on printing test-suite can be found at:

https://stbeehive.oracle.com/teamcollab/wiki/Solaris+Printing:CUPS+Printing+Test+Suite

2. Printing from labeled zones to network printer directly.

3. Printing from labeled zones to network printer via Global zone.

4. Printing from global zone to directly attached USB printer.

5. Printing from global zone to network printer.

6. Print in different orientations. (Should be tested for both Image & Text files)

The -o landscape option will rotate the page 90 degrees to print in landscape

orientation:

lp -o landscape filename

lpr -o landscape filename

The -o orientation-requested=N option rotates the page depending on the value of N:

-o orientation-requested=3 - portrait orientation (no rotation)

-o orientation-requested=4 - landscape orientation (90 degrees)

-o orientation-requested=5 - reverse landscape or seascape orientation (270 degrees)

-o orientation-requested=6 - reverse portrait or upside-down orientation

(180 degrees)

-o number-up=2

-o number-up=6

this should be landscape by default

rest number-up should be portrait

Mix -o number-up & orientation-requested.

7. Printing On Both Sides of the Paper

-o sides=two-sided-short-edge

-o sides=two-sided-long-edge

These options will enable two-sided printing on the printer if the printer supports it.

'-o sides=two-sided-short-edge' option is suitable for landscape pages,

while '-o sides=two-sided-long-edge' option is suitable for portrait pages:

lp -o sides=two-sided-short-edge filename

lp -o sides=two-sided-long-edge filename

lpr -o sides=two-sided-long-edge filename

The default is to print single-sided:

lp -o sides=one-sided filename

lpr -o sides=one-sided filename

8. Labels greater than 80 characters.

Labels greater than 80 characters would be truncated at the right by '->'

9. Printing to a printer in same subnet.

If the printer is in the same subnet, then add it using cups web interface

at localhost:631

10. Printing to a printer in different subnet.

You should be able to ping the printer ip address.

Adding the printer:

lpadmin -p printer_name -E -v socket://<ip-addr-of-printer> -m <model>

You can find your printer model using

lpinfo -m | grep -i <model name>

model example: "foomatic-db-ppds/Ricoh/PS/Ricoh-Aficio_MP_5000_PS.ppd.gz"

e.g:

lpadmin -p printer -E -v socket://10.163.198.77 -m foomatic-db-ppds/Ricoh/PS/Ricoh-Aficio_MP_5000_PS.ppd.gz

11. Printing without banner and trailer pages and also without page-labels.

-o nolabels

Does not print job labels

-o job-sheets=none

-o job-sheets=none, none

-o job-sheets=none,<any-label>

The above three work same. No banner and trailer pages get printed.

-o job-sheets=<any-label>,none

-o job-sheets=<any-label>,<any-label>

The above two work same. Both banner and trailer pages get printed.

-o job-sheets=none -o nolabels

No banner and trailer page and no job-labels

12. Test following authorizations:

solaris.print.admin

solaris.print.unlabeled

solaris.print.nobanner

solaris.print.list

Following command can be used to list the user authorizations:

$ auths <user>

For eg:

Printing from a labeled zone as root.

$ lp -d public -o job-sheets=none,none /etc/release

request id is public-19 (1 file(s))

This request is submitted to the server as 'remroot'. In this case both

banner and trailer pages get printed, as 'remroot' does not have the

solaris.print.nobanner authorization.

solaris.print.list

# lp -d test /etc/release

request id is test-313 (1 file(s))

# lpstat test

test-313 root 3072 Fri Mar 30 07:42:58 2012

---> Login as 'remroot' <---

# su - remroot

Oracle Corporation SunOS 5.11 11.0 November 2011

---> 'remroot' doesn't have solaris.print.list authorization so it cannot list

the jobs for printer test <---

$ lpstat test

$ lp -d test /etc/release

request id is test-314 (1 file(s))

---> For 'remroot', 'lpstat' lists only the jobs requested by 'remroot' <---

$ lpstat test

test-314 remroot 3072 Fri Mar 30 07:43:44 2012

$ logout

---> For 'root', 'lpstat' lists all the jobs <---

# lpstat test

test-313 root 3072 Fri Mar 30 07:42:58 2012

test-314 remroot 3072 Fri Mar 30 07:43:44 2012

---> Give remroot solaris.print.list authorization <---

# usermod -A solaris.print.list remroot

Found user in files repository.

---> Login as 'remroot'

root@txx2270-05:/var/log/cups# su - remroot

Oracle Corporation SunOS 5.11 11.0 November 2011

---> Now for 'root', 'lpstat' lists all the jobs <---

-bash-4.1$ lpstat test

test-313 root 3072 Fri Mar 30 07:42:58 2012

test-314 remroot 3072 Fri Mar 30 07:43:44 2012

13. Printing to a printer which is outside the labeled range.

E.g: Printing from a 'Public Zone' to a printer labeled 'Confidential'

$ lp -d hp /etc/release

lp: label violation.

14. Cascade printing

Print from a system which is accessible from local zone, to a printer which

is accessible to the GZ only.

Print request goes from the system to LZ to GZ to Printer.

Note: For cascading to work printer must be shared on both LZ and GZ.

Printer can be shared from command line as:

$ lpadmin -p <printer> -o printer-is-shared=true