Set SE range from document, not from client request --- cups/scheduler/ipp.c 2019-04-08 16:38:34.106031431 +0000 +++ cups/scheduler/ipp.c 2019-04-08 17:45:39.568497974 +0000 @@ -11798,6 +11798,30@ } snprintf(filename, sizeof(filename), "%s/d%05d-%03d", RequestRoot, fromjob, document_number); + if ( is_selinux_mls_enabled() ) + { + char * fcon; + context_t jcon; + const char *range = NULL; + ipp_attribute_t *attr; + + if ( getfilecon( filename, &fcon ) > 0) + { + cupsdLogMessage( CUPSD_LOG_DEBUG, "alt_doc_ft_job: filename context is %s", + fcon ); + + jcon = context_new( fcon ); + range = context_range_get( jcon ); + + attr = ippFindAttribute( job->attrs, "security-context-range", IPP_TAG_NAME ); + ippSetString( job->attrs, &attr , + 0, range ); + cupsdLogMessage( CUPSD_LOG_ERROR, "alt_doc_ft_job: context set to: %s", range ); + } + else { + cupsdLogMessage( CUPSD_LOG_ERROR, "alt_doc_ft_job: can't determine context of %s", filename); + } + } if (con->filename != NULL) cupsdLogMessage(CUPSD_LOG_DEBUG2, "alt_doc_ft_job: con->filename is %s",