Suppose I have a privilege-aware program running on Solaris 10.
How do I assign privileges to that program, on the command line
rather than the GUI as mentioned in the S10 Security Admin guide?
I get the impression that an SUID 0 program has "all privileges",
that can then be removed from the working set as desired, but if
possible I'd like my program to not be SUID 0 in the first place.
If it helps, the specific privilege I intend to use is PRIV_FILE_DAC_READ
(for reading /etc/shadow).
TIA,
--
Rich Teer, SCNA, SCSA, OpenSolaris CAB member
President,
Rite Online Inc.
Voice: +1 (250) 979-1638
URL: http://www.rite-group.com/rich
> Hi all,
>
> Suppose I have a privilege-aware program running on Solaris 10.
> How do I assign privileges to that program, on the command line
> rather than the GUI as mentioned in the S10 Security Admin guide?
>
> I get the impression that an SUID 0 program has "all privileges",
> that can then be removed from the working set as desired, but if
> possible I'd like my program to not be SUID 0 in the first place.
>
> If it helps, the specific privilege I intend to use is PRIV_FILE_DAC_READ
> (for reading /etc/shadow).
ppriv?
--
Dragan Cvetkovic,
To be or not to be is true. G. Boole No it isn't. L. E. J. Brouwer
!!! Sender/From address is bogus. Use reply-to one !!!
> ppriv?
That lets you assign privs to an already running process, or run
a program with specific privs. BUt instead of saying "ppriv foo"
to run foo with privs, I want to just say "foo", and have foo's
default privileges appear by magic. (Said privs having previously
been assigned by the sysadmin.)
This could be done with a secure version of UNIX I used years ago,
so I'm guessing that something similar can be accomplished with S10.
Can't you just set the privs you want with a syscall in your program
or something like that? Or would that require that the program be
SUID 0 to work (which is what you're attempting to avoid)?
I need to go back and read the priveliges docs anyhow (and the
appropriate sections in SSP ;))
--
Coy Hile
hi...@cse.psu.edu
> Can't you just set the privs you want with a syscall in your program
You can, but only from the set that your program has been assigned
(the permitted set).
> or something like that? Or would that require that the program be
> SUID 0 to work (which is what you're attempting to avoid)?
Right. If I understand correctly, a UID 0 program starts will all
privs permitted, so yes, a program could assign itself a more restricted
set of privs. But I want to avoid the UID = 0 step if possible.
> I need to go back and read the priveliges docs anyhow (and the
> appropriate sections in SSP ;))
Not too much in SSP about privs, alas, because they're new with S10.
And if there was, I wouldn't need to ask here! :-)
> Apparently, /usr/sadm/bin/smexec would seem to do the trick, but it
> requires the SMC backend to run and will prompt you for the password
> for the user or role you specified with -r or -u, respectively :(
Hmm. Not useful for my situation then, alas...
> I know of no way to assign a defined set of privileges directly to an
> executable, analogous to the suid-bit (which does not neccesary mean
> there is none, see the disclaimer above).
Bummer, because that's exactly what I want to do. I want this program
to always start running with basic + file_dac+read as its permitted
privilege set, no matter who (or what role) executes it, and without
the end user having to do anything they wouldn't have to do for a SUID 0
program. Is there no way to do this? Casper?
you mean that you would have copied/adapted the appropriate manpage.
droll. other people know how to run "man" on their computer.
--
Thomas E. Dickey
http://invisible-island.net
ftp://invisible-island.net
> Hi all,
>
> How do I assign privileges to that program, on the command line
Create a role (~user) dedicated to this program, like :
roleadd -d /home/<program> -s /usr/bin/bash ... <role>
rolemod -K "defaultpriv=basic,file_dac_read" <role>
su - <role>
ppriv -l $$
and you should now see basic privs more file_dac_read
See:
http://www.asyd.net/home/doku.php?id=docs:solaris:rbac
i'm not sure that is you really want, if no, shame on me
--
\_o< asyd
> you mean that you would have copied/adapted the appropriate manpage.
I guess it hasn't occurred to you that making a decent book by reading
and interpreting manual pages & other reference info is actually quite
hard work, and something which a lot of people find very useful. You
should try it some time.
--tim
hmm - I know something about it.
But since you're making an offensive remark, it's up to you to back it up.
Here's some fuel:
http://invisible-island.net/critique/APUE-SSP.html
That's a rather serious allegation. Have you informed the author of the
existence of this page? Did he say something to it?
-- jpg
> That's a rather serious allegation. Have you informed the author of the
> existence of this page? Did he say something to it?
For the record, I (being said author) refute any and all claims of
plagiarism. Yes, there are some similarities between my book and
APUE. As I've said in the past, they are intentional, imitation
being the sincerest form of flattery. But there are also MANY
differences (my book is almost twice the size of APUE, so there'd
have to be!).
My publisher is aware of Dickey's allegations, and has investigated
the matter. As far as they are concerned, it is a non-issue; and
my book is published by the same company as APUE. So as far as the
copyright holders are concerned, there is no plagiarism; and that's
good enough for me.
Naturally, I reserve the right to persue any legal action I chose
against Dickey, for his slanderous/libellous allegations, and his
tarnishing of my good name and reputation, and any loss of earnings
due to that. So does my publisher...
I guess he's (Dickey) just some Net Kook he enjoys stiring the brown
stuff. Personally, I ignore him.
certainly. He continues to deny it. I informed the publisher also.
My understanding is that they're doing something about (but of course
I don't know what - not my business).
> For the record, I (being said author) refute any and all claims of
> plagiarism. Yes, there are some similarities between my book and
> APUE. As I've said in the past, they are intentional, imitation
> being the sincerest form of flattery. But there are also MANY
> differences (my book is almost twice the size of APUE, so there'd
> have to be!).
APUE is not the only material to which passages of your book have
a similarity on a word-by-word or sentence-by-sentence level. Here
is an example involving a Solaris manual page:
| Note that the alloca function is very machine-, compiler-, and
| system dependent; its use is strongly discouraged. [your book,
| page 99]
vs.
| The alloca() function is machine-, compiler-, and most of all,
| system-dependent. Its use is strongly discouraged. [Solaris 8
| malloc(3C)]
The origin of this passage can be traced back to SunOS 4 at least.
How does it come that your book contains the same three adjectives
in the same order as well as the same second clause in its entirety?
> My publisher is aware of Dickey's allegations, and has investigated
> the matter. As far as they are concerned, it is a non-issue; and
> my book is published by the same company as APUE. So as far as the
> copyright holders are concerned, there is no plagiarism; and that's
> good enough for me.
Is this to mean that you deny the relevance of ethic standards in this
area?
> Naturally, I reserve the right to persue any legal action I chose
> against Dickey, for his slanderous/libellous allegations, and his
> tarnishing of my good name and reputation, and any loss of earnings
> due to that. So does my publisher...
You really consider to discuss the material from
<http://invisible-island.net/critique/APUE-SSP.html> in court?
> I guess he's (Dickey) just some Net Kook he enjoys stiring the brown
> stuff. Personally, I ignore him.
Perhaps you should make a habit of doing a Google web search for the
names of persons before guessing about them. Thomas has provided
excellent services to the Unix community for over a decade with his
maintenance and development of xterm, ncurses, etc. There is hardly
anybody in these groups who has never used the Open Source software
Thomas has donated to the community; many do so daily, and many do so
just in the very moment they are reading these lines.
In this case, he has compiled enough material to fill a large web
page. You will not defeat that by guesses ad hominem.
Gunnar
The web page seems to be alleging that unauthorized borrowing occurred.
Do you mean that no borrowing occurred (ie that the author of the page
is mistaken), or that borrowing did occur but was authorized by the
publisher of Stevens' book?
-- jpg
> The web page seems to be alleging that unauthorized borrowing occurred.
> Do you mean that no borrowing occurred (ie that the author of the page
> is mistaken), or that borrowing did occur but was authorized by the
> publisher of Stevens' book?
Since Teer denies _any_ borrowing, my belief is that it is unauthorized.
Your opinion seems clear from the web page. But please, I would
rather have the author answer the question.
-- jpg
> The web page seems to be alleging that unauthorized borrowing occurred.
> Do you mean that no borrowing occurred (ie that the author of the page
> is mistaken), or that borrowing did occur but was authorized by the
> publisher of Stevens' book?
I wouldn't word it quite that way, but the latter is closer to the truth.
As I said before, any similarity between my book and APUE is intentional,
and has my publisher's blessings. My publisher is (essentially) the same
as the publisher of APUE.
But it is NOT accurate to say that I copied APUE wholesale. SSP took me
3.5 years to write, 3 of which I was otherwise unemployed for (I gave up
my job to work on SSP full time), so naturally I take exception to people's
scurrilous accusations.
As we say in England: 'nuff said.
So you mean there is borrowing (that Thomas Dickey is right)?
You said "I wouldn't word it quite that way". There must be
some thing I'm missing: how would you word it?
-- jpg
Well, I am sure there is some borrowing. After all, we all use (more or
less) common language and avoiding _all_ words and phrases occuring in
Stevens' book just for the sake of it would be ridiculous. Then you'll need
to invent a new language, as Tolkien did with his (two variants) of Elvish
and dwarf languages in "The Lord of the Rings".
However, if you are in the UNIX community for quite some time and you keep
using the same terminology, you are bound to have certain phrases,
expressions and words associated with them. E.g. how many different ways
can you find to describe (for me unfortunatelly rather boring) termcap
and/or term functionality?
Most probably, both Teer and Stevens draw their inspiration (or did so)
from the same source which I would also call a "UNIX folklore".
And no, my reply has nothing to do with me being one of Teer's
reviewers. It's just a common sense.
Bye, Dragan
Please (had to say this to Thomas Dickey too!) -- I think
it's better not to have other people answering for the
author. I was asking him to describe how he sees things.
-- jpg
>
> Please (had to say this to Thomas Dickey too!) -- I think
> it's better not to have other people answering for the
> author. I was asking him to describe how he sees things.
Then don't ask that in a public forum. Send an email to Rich and, if you
want to put his answer here, ask his permission to do so. Simply enough.
> However, if you are in the UNIX community for quite some time and you keep
> using the same terminology, you are bound to have certain phrases,
> expressions and words associated with them. E.g. how many different ways
> can you find to describe (for me unfortunatelly rather boring) termcap
> and/or term functionality?
Apparently more than just one plus an obvious paraphrase.
> Most probably, both Teer and Stevens draw their inspiration (or did so)
> from the same source which I would also call a "UNIX folklore".
indeed: the millions of books about termcap/terminfo, and just this matches.
> And no, my reply has nothing to do with me being one of Teer's
> reviewers. It's just a common sense.
no, nothing at all...
>>
>> Please (had to say this to Thomas Dickey too!) -- I think
>> it's better not to have other people answering for the
>> author. I was asking him to describe how he sees things.
> Then don't ask that in a public forum. Send an email to Rich and, if you
> want to put his answer here, ask his permission to do so. Simply enough.
If he would give a different answer privately, it's not worth repeating.
>You really consider to discuss the material from
><http://invisible-island.net/critique/APUE-SSP.html> in court?
>
>> I guess he's (Dickey) just some Net Kook he enjoys stiring the brown
>> stuff. Personally, I ignore him.
>
>Perhaps you should make a habit of doing a Google web search for the
>names of persons before guessing about them. Thomas has provided
>excellent services to the Unix community for over a decade with his
>maintenance and development of xterm, ncurses, etc. There is hardly
>anybody in these groups who has never used the Open Source software
>Thomas has donated to the community; many do so daily, and many do so
>just in the very moment they are reading these lines.
If you did read this newsgroup during the past years, you should know that
Mr. Dickey did not appear her before ~ 2003 and that he did in many cases
act like a net cook being unwilling to have fact based discussions.
Mr. Dickey in many cases acts extremely aggressive to other people and
rarely sends real information besides something like "you are wrong".
He did write once an informative posting about the problems with
broken xterm entries found on Linux but he denies provable problems with
TERMINFO and often acts like a wounded animal when anything appers here that
could be brought into a relationship to curses.
If I had to judge on him only from his statements in c.u.s, I would need
to call him a poor troll.
>In this case, he has compiled enough material to fill a large web
>page. You will not defeat that by guesses ad hominem.
Looking at this web page gives a different light on Mr. Dickey.
It seems that (besides from his appearance in c.u.c) he is able to
do serious work.
Discussing the content if this web page however is not simple:
If the publisher on Rich's book has all rights on Stevens book too
and Rich is not going to publish his book though different channels
I see no problems. What needs to be discussed too, is how much of the
book similar to Stevens book.
If the web page lists _all_ similarities of a 1000 page book, I see no problems.
BTW: Let me discuss a point from the web page. The text on sigset() is not very
convincing as it does not mention how possible problems should occur and
sigset() of course does set SA_RESTART. If you did read the discussion of the
SIGCHLD problem on the POSIX mailing list, you should know that Solaris
may be the only OS where this is handled correctly.
--
EMail:jo...@schily.isdn.cs.tu-berlin.de (home) Jörg Schilling D-13353 Berlin
j...@cs.tu-berlin.de (uni)
schi...@fokus.fraunhofer.de (work) Blog: http://schily.blogspot.com/
URL: http://cdrecord.berlios.de/old/private/ ftp://ftp.berlios.de/pub/schily
> In comp.unix.solaris Dragan Cvetkovic <m...@privacy.net> wrote:
>
>> However, if you are in the UNIX community for quite some time and you keep
>> using the same terminology, you are bound to have certain phrases,
>> expressions and words associated with them. E.g. how many different ways
>> can you find to describe (for me unfortunatelly rather boring) termcap
>> and/or term functionality?
>
> Apparently more than just one plus an obvious paraphrase.
Let us be more constructive: Can you give an example how would _you_
formulate this terminfo vs. termcap issue that you are mentioning as a
first example in http://invisible-island.net/critique/APUE-SSP.html
As I said, I find termcap/terminfo stuff rather boring in general (I am
sure I am not the only one), so let us all benefit from it.
>> Most probably, both Teer and Stevens draw their inspiration (or did so)
>> from the same source which I would also call a "UNIX folklore".
>
> indeed: the millions of books about termcap/terminfo, and just this matches.
Care to mention some? Except these two in dispute, I only know about
"termcap & terminfo" by John Strang, Linda Mui and Tim O'Reilly, last
published in 1988 (by O'Reilly), but as I said, I am not too deep into the
topic.
A book by definition is a public thing, and this topic came up
in a public channel (I didn't start it). The author also wrote
something in this thread, so he appears willing to discuss /
clarify the matter. I was asking him to clarify his public
statement. I see no problem with doing that in public. So I'll
just ask it again: how would the author describe the situation
with respect to any borrowing from Stevens' book?
-- jpg
> Dragan Cvetkovic wrote:
>> "Jim Haig" <jph...@yahoo.com> writes:
>> >
>> > Please (had to say this to Thomas Dickey too!) -- I think
>> > it's better not to have other people answering for the
>> > author. I was asking him to describe how he sees things.
>>
>> Then don't ask that in a public forum. Send an email to Rich and, if you
>> want to put his answer here, ask his permission to do so. Simply enough.
>
> A book by definition is a public thing, and this topic came up
> in a public channel (I didn't start it). The author also wrote
> something in this thread, so he appears willing to discuss /
> clarify the matter. I was asking him to clarify his public
> statement. I see no problem with doing that in public.
Jim, I have no problems with that. I am just saying that you can't expect
others to refrain from discussing something in a public forum. If you wan't
just a two-way communication (between you and Rich), then use a peer to
peer communication method: email.
There already exists a public discussion about this topic,
and private communication will not make that discussion stop. The
author is the best person here to clarify things, and he has shown
his willingness to discuss things in public. If he made a clear
statement of his position, maybe the public discussion would stop.
-- jpg
>>> Most probably, both Teer and Stevens draw their inspiration (or did so)
>>> from the same source which I would also call a "UNIX folklore".
>>
>> indeed: the millions of books about termcap/terminfo, and just this matches.
> Care to mention some? Except these two in dispute, I only know about
> "termcap & terminfo" by John Strang, Linda Mui and Tim O'Reilly, last
> published in 1988 (by O'Reilly), but as I said, I am not too deep into the
> topic.
Your comment about "UNIX folklore" relies upon the assumptiont that there
are many people all saying the same thing. That's absurd of course (I
assume you meant your whole response sarcastically, since it cannot be
taken seriously).
(the rest of Schilling's remarks are as usual, ill-informed).
> You said "I wouldn't word it quite that way". There must be
> some thing I'm missing: how would you word it?
I admire Rich Stevens, and find his writing style very readable.
I therefore attempted to emulate his style in my book. Given that,
and that we talk about the same things, and we (presumably) had access
to at least some common reference material, some similarities are
more or less inevitable.
So, borrowing? Perhaps; inspiration? Definately (hence the bit
on the back cover about APUE).
The part where I asked you to formulate your view of terminfo/termcap
(which you have snipped) was not meant sarcastically. It was meant to bring
this discussion to a more constructive level which would benefit all of us.
I don't have a dog in this fight but I have to comment that examples
like the above, and the other comparisons I see on Thomas' site, are
weak IMHO. All of the examples on Thomas' webpage are about
descriptions of simple concepts like the statement above. There are
only so many ways you can state a straightforward concept in a
straightforward way. Especially when you need to limit yourself to
contextual terminology to be clear.
I admit the similarity of the figures shown on Thomas' site are
striking but if you think about it how could they not be strikingly
similar? There is no art there. The topology of the first two is
dictated by the topology of the structures they describe. By
definition they must be topologically identical to be accurate so any
adjustment of the components would create only superficial differences
that you would still question. As for the 3rd table, how could they
appear significantly different and still be accurate? If I write a
book with a table of the U.S. States and their respective Capitals
would you be plagiarizing if you had a table with the same content?
Any change you make will be superficial. Unless you're suggesting it's
plagiarism to use a table at all.
How would Stevens fare if you applied the same standard when comparing
his text to the reference materials and writings on the same simple
concepts that predate his book?
Clearly, and logically, Mr. Teer wanted to capitalize on the popularity
of APUE. It only makes sense for him to try and mimic it's proven
success. His preface (from his site) includes experienced UNIX
programmer's in his audience. It only makes sense for him to try and
make his book seem familiar to that audience. Stevens' chapter names
read like an index and are logically ordered. It would be difficult to
parallel it without ending up with something that looked a lot like it.
I tend to agree that Mr. Teer should have given Stevens more respect
and credit. I suspect Mr. Teer regrets not doing so at this point. And
I can understand how those who knew and/or respected W. Richard Stevens
as the icon he was in our field might be angry about the seeming lack
of respect. But I don't buy the plagiarism argument.
-- ced
--
Chuck Dillon
Senior Software Engineer
NimbleGen Systems Inc.
>(the rest of Schilling's remarks are as usual, ill-informed).
If you have nothing to say, please stay quiet but do not act as
a net cook.