What's New in Printing?

This section describes new and changed printing features in this Oracle Solaris release. For a complete listing of new features and a description of Oracle Solaris releases, see Oracle Solaris 10 9/10 What’s New.

Privilege Requirements for Using Print Commands

The design of the Open Standard Print API (PAPI) implementation in the Oracle Solaris release makes it no longer necessary for applications, toolkits, and print commands to run with elevated privilege to interact with print services.

As a result, the following print commands are no longer installed SUID root:

• /usr/bin/lp

• /usr/bin/lpstat

• /usr/bin/cancel

• /usr/bin/lpmove

• /usr/{ucb|bin}/lpr

• /usr/{ucb|bin}lpq

• /usr/{ucb|bin}/lprm

• /usr/lib/print/printd

Previously, these commands were installed SUID root because the commands required an elevated privilege for the following purposes:

• Opening a reserved port

• Allocating a sequential job-id number

• Manipulating files in the /var/spool/print directory

This functionality is now localized in a small helper application, /usr/lib/print/lpd-port. As a result, any applications that use the RFC-1179 PAPI support no longer require elevated privilege. The lpd-port helper application contains minimal support for passing RFC-1179 protocol requests on a reserved port and allocating sequential job-id numbers. Although the helper application is installed SUID root, all elevated privileges are dropped until they are required. When necessary, the privilege is elevated for the required operation and then permanently dropped if the elevated privilege is no longer required. In the Oracle Solaris release, this process is accomplished through the use of privileges. On other platforms, the process is accomplished by using the setuid, seteuid, or setreuid functions.

If you have local printers that you do not want to share on the network, you can safely disable the printing network listeners. If you are running the Oracle Solaris release, or a CUPS server, the lpstat command provides you with more information about remote print queues and print jobs, as well as their capabilities when using IPP to communicate with those servers.

When IPP is in use, and with the proper authorization, the following operations can be performed on remote print queues and print jobs:

• accept

• reject

• enable

• disable

• move job

• modify job

Also, you can now move print requests between queues on a print server and modify print requests remotely when IPP is in use.

For more information, see the privileges(5) man page. For step-by-step procedures, see Administering Printers on a Network When Using the Internet Printing Protocol (Task Map).

PPD File Management Utility

Solaris 10 5/08: The PPD File Manager, /usr/sbin/ppdmgr, is a utility for administering PostScript^TM Printer Description (PPD) files that are used with the print subsystem. When you add a PPD file to the system by using the ppdmgr utility or the lpadmin command with the -n option, a cache of PPD file information is automatically updated. This cache is used by Solaris Print Manager.

For more information, see Administering PPD Files by Using the PPD File Management Utility (Task Map) and the ppdmgr(1M) man page.