[Openicc] Do we want /usr/local/share/color/icc as a third profile directory ?

[Michael Sweet]

Chris Murphy wrote:
> 
> On Nov 26, 2005, at 12:33 PM, Bob Friesenhahn wrote:
> 
>> If CUPS is worried about security, then ordinary users can not be 
>> allowed to update the CUPS profile directory, and CUPS may not trust 
>> profiles which are attached to print jobs.  This seems self-defeating 
>> to me.
> 
> This is currently a problem on Windows were only admins are allowed to 
> add/remove profiles from the only profiles directory. So regular end 
> users can't add/remove profiles. The solution is that essentially no one 
> logs in as anything other than admin user which then opens the machine 
> to security problems.
> 
> Adding/removing profiles is a necessary and regular task for regular, 
> non-admin users. Any OS needs to respect that requirement.

In the context of CUPS, there are two specific ways we will support
color profiles: "source" profiles embedded in documents and
"destination" profiles stored on the server and used in the
rendering/printer driver stage.

Administrators can provide write access to individual users (or
groups of users) to the destination profiles in
/usr/share/cups/profiles in a variety of ways, including through
the use of symbolic links to the users' home directories.

-- 
______________________________________________________________________
Michael Sweet, Easy Software Products           mike at easysw dot com
Internet Printing and Document Software          http://www.easysw.com