From meem@triplex.east.sun.com Fri Apr 20 23:03:06 2007 Received: from sunmail4.Singapore.Sun.COM (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l3L635JB021672 for ; Fri, 20 Apr 2007 23:03:06 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail4.Singapore.Sun.COM (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id l3L62HdL010537; Sat, 21 Apr 2007 14:02:18 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JGU00F013FSOJ00@nwk-avmta-2.sfbay.sun.com>; Fri, 20 Apr 2007 23:02:16 -0700 (PDT) Received: from triplex.East.Sun.COM ([129.148.174.104]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JGU00IQH3FRP3B0@nwk-avmta-2.sfbay.sun.com>; Fri, 20 Apr 2007 23:02:16 -0700 (PDT) Received: from triplex.East.Sun.COM (localhost [127.0.0.1]) by triplex.East.Sun.COM (8.14.0+Sun/8.14.0) with ESMTP id l3L62FhY012315; Sat, 21 Apr 2007 02:02:15 -0400 (EDT) Received: (from meem@localhost) by triplex.East.Sun.COM (8.14.0+Sun/8.14.0/Submit) id l3L62FFv012312; Sat, 21 Apr 2007 02:02:15 -0400 (EDT) Date: Sat, 21 Apr 2007 02:02:15 -0400 From: Peter Memishian Subject: PSARC/2007/223 Wireless WPA Supplicant Addendum To: psarc-ext@sun.com Cc: wifi-dladm@sun.com, quaker.fang@sun.com Message-id: <17961.43239.554672.815492@gargle.gargle.HOWL> MIME-version: 1.0 X-Mailer: VM 7.17 under 21.4 (patch 18) "Social Property" XEmacs Lucid Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 Status: RO Content-Length: 3132 I'm sponsoring the following fasttrack for Quaker Fang and the WiFi team. All changes are to unshipped or uncommitted interfaces. Aside from the package name, all proposed interfaces are Consolidation Private. Patch binding is again requested. The timer is set for Friday, April 27th. ---8<--- While wrapping up the implementation of Wireless WPA Supplicant (specified by PSARC/2006/046), we needed to change some minor pieces of the original proposal. The changes and their rationale are provided below. Proposed changes: 1. SMF service model changes The SMF service model has been changed to be multiple-instance -- one per link using WPA. There is no default WPA service, and thus no WPA services if WPA is not in-use. Each WPA instance will be temporarily created by dladm connect-wifi when connecting to a WPA WLAN, and will be deleted by dladm when WPA is no longer in use. The service instance name is "svc:/network/wpa:". This simplifies the code and enables more fine-grained handling of faults. 2. Package Name Per code reviewer's request, the package names have been changed from SUNWsupr/SUNWsupu to SUNWwpar/SUNWwpau. 3. solaris.smf.modify authorization granted to user "dladm" During testing, we found that when running as non-root, dladm needs the solaris.smf.modify authorization to create or delete WPA service instances. Given the current SMF security model, this means the dladm user needs to also be granted solaris.smf.modify in /etc/user_attr: + "dladm::::auths=solaris.smf.manage.wpa,solaris.smf.modify" We have contacted with SMF team, and SMF team acknowledges that the need for the (very powerful) "solaris.smf.modify" authorization to create or destroy service instances is a deficiency in the current SMF security architecture. In the future, if a more fine-grained authorization is provided, /etc/user_attr can be updated. 4. WL_ENC_WPA To specify the WPA encryption mode of access points, a new WL_ENC_WPA encryption type has been added to . #define WL_ENC_WPA 0x2 5. libdladm WLAN API Enhancements [libdladm.txt, section 4] To support WPA, several new libdladm APIs have been added, and minor changes were made to the existing dladm_wlan_get_link_attr() and dladm_wlan_scan() APIs. dladm_wlan_wpa_set_wpa() Enables or disables WPA in the driver for a specified WiFi link. dladm_wlan_wpa_set_ie() Sets the WPA/RSN information in the driver for a specified WiFi link. dladm_wlan_wpa_del_key() Deletes specific WPA keys in the driver for a specified WiFi link. dladm_wlan_wpa_set_key() Sets dynamically-generated WPA keys (unicast/multicast/broadcast) in the driver for a specified WiFi link. dladm_wlan_wpa_set_mlme() Sets the WPA auth/deauth/associate/disassociate information in the driver for a specified WiFi link. dladm_wlan_wpa_get_sr() Gets the WPA/RSN information from WPA-mode APs on a WiFi link. See the diffmarked parts of libdladm.txt in the materials directory for details on these APIs. -- meem From gww@eng.sun.com Sat Apr 21 10:22:19 2007 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l3LHMIFo018979 for ; Sat, 21 Apr 2007 10:22:18 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail5.uk.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id l3LHLPMA007316; Sat, 21 Apr 2007 18:21:29 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JGU00605YVSDB00@nwk-avmta-2.sfbay.sun.com>; Sat, 21 Apr 2007 10:21:28 -0700 (PDT) Received: from engmail3mpk.sfbay.Sun.COM ([129.146.11.26]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JGU00H0GYVSHCC0@nwk-avmta-2.sfbay.sun.com>; Sat, 21 Apr 2007 10:21:28 -0700 (PDT) Received: from marduk.eng.sun.com (marduk.SFBay.Sun.COM [129.146.108.224]) by engmail3mpk.sfbay.Sun.COM (8.13.6+Sun/8.13.6/ENSMAIL,v2.2) with ESMTP id l3LHLQSJ008193; Sat, 21 Apr 2007 10:21:26 -0700 (PDT) Received: from marduk.eng.sun.com (localhost [127.0.0.1]) by marduk.eng.sun.com (8.13.6+Sun/8.12.11) with ESMTP id l3LHMfTa005087; Sat, 21 Apr 2007 10:22:41 -0700 (PDT) Received: (from gww@localhost) by marduk.eng.sun.com (8.13.6+Sun/8.12.11/Submit) id l3LHMf2Z005086; Sat, 21 Apr 2007 10:22:41 -0700 (PDT) Date: Sat, 21 Apr 2007 10:22:41 -0700 (PDT) From: Gary Winiger Subject: Re: PSARC/2007/223 Wireless WPA Supplicant Addendum To: psarc-ext@sun.com, peter.memishian@sun.com Cc: wifi-dladm@sun.com, quaker.fang@sun.com Message-id: <200704211722.l3LHMf2Z005086@marduk.eng.sun.com> Content-transfer-encoding: 7BIT X-Sun-Charset: US-ASCII X-PMX-Version: 5.2.0.264296 Status: RO Content-Length: 955 > 3. solaris.smf.modify authorization granted to user "dladm" > During testing, we found that when running as non-root, dladm needs the > solaris.smf.modify authorization to create or delete WPA service > instances. Given the current SMF security model, this means the dladm > user needs to also be granted solaris.smf.modify in /etc/user_attr: > > + "dladm::::auths=solaris.smf.manage.wpa,solaris.smf.modify" > > We have contacted with SMF team, and SMF team acknowledges that the need > for the (very powerful) "solaris.smf.modify" authorization to create or > destroy service instances is a deficiency in the current SMF security > architecture. In the future, if a more fine-grained authorization is > provided, /etc/user_attr can be updated. Humm, I thought it was possible to do this with an authorization specified within the manifest. Perhaps adding a general framework modify_authorization value. Gary.. From meem@triplex.east.sun.com Sat Apr 21 10:23:18 2007 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l3LHNFFt019016 for ; Sat, 21 Apr 2007 10:23:18 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail5.uk.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id l3LHMMpL007917; Sat, 21 Apr 2007 18:22:23 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JGU00603YXAF500@nwk-avmta-2.sfbay.sun.com>; Sat, 21 Apr 2007 10:22:22 -0700 (PDT) Received: from triplex.East.Sun.COM ([129.148.174.104]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JGU00HIGYXAH8A0@nwk-avmta-2.sfbay.sun.com>; Sat, 21 Apr 2007 10:22:22 -0700 (PDT) Received: from triplex.East.Sun.COM (localhost [127.0.0.1]) by triplex.East.Sun.COM (8.14.0+Sun/8.14.0) with ESMTP id l3LHMLbC013615; Sat, 21 Apr 2007 13:22:21 -0400 (EDT) Received: (from meem@localhost) by triplex.East.Sun.COM (8.14.0+Sun/8.14.0/Submit) id l3LHMKR7013612; Sat, 21 Apr 2007 13:22:20 -0400 (EDT) Date: Sat, 21 Apr 2007 13:22:20 -0400 From: Peter Memishian Subject: Re: PSARC/2007/223 Wireless WPA Supplicant Addendum In-reply-to: <200704211722.l3LHMf2Z005086@marduk.eng.sun.com> To: Gary Winiger Cc: psarc-ext@sun.com, peter.memishian@sun.com, wifi-dladm@sun.com, quaker.fang@sun.com Message-id: <17962.18508.851007.283920@gargle.gargle.HOWL> MIME-version: 1.0 X-Mailer: VM 7.17 under 21.4 (patch 18) "Social Property" XEmacs Lucid Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 References: <200704211722.l3LHMf2Z005086@marduk.eng.sun.com> Status: RO Content-Length: 1069 > > 3. solaris.smf.modify authorization granted to user "dladm" > > During testing, we found that when running as non-root, dladm needs the > > solaris.smf.modify authorization to create or delete WPA service > > instances. Given the current SMF security model, this means the dladm > > user needs to also be granted solaris.smf.modify in /etc/user_attr: > > > > + "dladm::::auths=solaris.smf.manage.wpa,solaris.smf.modify" > > > > We have contacted with SMF team, and SMF team acknowledges that the need > > for the (very powerful) "solaris.smf.modify" authorization to create or > > destroy service instances is a deficiency in the current SMF security > > architecture. In the future, if a more fine-grained authorization is > > provided, /etc/user_attr can be updated. > > Humm, I thought it was possible to do this with an authorization > specified within the manifest. Perhaps adding a general framework > modify_authorization value. What is "this"? Create and destroy SMF service instances? -- meem From gww@eng.sun.com Sat Apr 21 10:28:57 2007 Received: from sunmail3mpk.sfbay.sun.com (sunmail3mpk.SFBay.Sun.COM [129.146.11.52]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l3LHSvqn019136 for ; Sat, 21 Apr 2007 10:28:57 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail3mpk.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id l3LHS9Zv003890; Sat, 21 Apr 2007 10:28:09 -0700 (PDT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JGU0060JZ6XOP00@nwk-avmta-2.sfbay.sun.com>; Sat, 21 Apr 2007 10:28:09 -0700 (PDT) Received: from engmail3mpk.sfbay.Sun.COM ([129.146.11.26]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JGU00HBWZ6XHCC0@nwk-avmta-2.sfbay.sun.com>; Sat, 21 Apr 2007 10:28:09 -0700 (PDT) Received: from marduk.eng.sun.com (marduk.SFBay.Sun.COM [129.146.108.224]) by engmail3mpk.sfbay.Sun.COM (8.13.6+Sun/8.13.6/ENSMAIL,v2.2) with ESMTP id l3LHS7XL008599; Sat, 21 Apr 2007 10:28:07 -0700 (PDT) Received: from marduk.eng.sun.com (localhost [127.0.0.1]) by marduk.eng.sun.com (8.13.6+Sun/8.12.11) with ESMTP id l3LHTLMo005100; Sat, 21 Apr 2007 10:29:21 -0700 (PDT) Received: (from gww@localhost) by marduk.eng.sun.com (8.13.6+Sun/8.12.11/Submit) id l3LHTLfR005099; Sat, 21 Apr 2007 10:29:21 -0700 (PDT) Date: Sat, 21 Apr 2007 10:29:21 -0700 (PDT) From: Gary Winiger Subject: Re: PSARC/2007/223 Wireless WPA Supplicant Addendum To: gww@eng.sun.com, peter.memishian@Sun.COM Cc: psarc-ext@Sun.COM, peter.memishian@Sun.COM, wifi-dladm@Sun.COM, quaker.fang@Sun.COM Message-id: <200704211729.l3LHTLfR005099@marduk.eng.sun.com> Content-transfer-encoding: 7BIT X-Sun-Charset: US-ASCII X-PMX-Version: 5.2.0.264296 Status: RO Content-Length: 1188 > > > 3. solaris.smf.modify authorization granted to user "dladm" > > > During testing, we found that when running as non-root, dladm needs the > > > solaris.smf.modify authorization to create or delete WPA service > > > instances. Given the current SMF security model, this means the dladm > > > user needs to also be granted solaris.smf.modify in /etc/user_attr: > > > > > > + "dladm::::auths=solaris.smf.manage.wpa,solaris.smf.modify" > > > > > > We have contacted with SMF team, and SMF team acknowledges that the need > > > for the (very powerful) "solaris.smf.modify" authorization to create or > > > destroy service instances is a deficiency in the current SMF security > > > architecture. In the future, if a more fine-grained authorization is > > > provided, /etc/user_attr can be updated. > > > > Humm, I thought it was possible to do this with an authorization > > specified within the manifest. Perhaps adding a general framework > > modify_authorization value. > > What is "this"? Create and destroy SMF service instances? Yes; service instances. Perhaps I'm not reading smf_security(5) accurately. Gary.. From Quaker.Fang@sun.com Sun Apr 22 19:05:33 2007 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l3N25W3n012326 for ; Sun, 22 Apr 2007 19:05:33 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail5.uk.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id l3N24eT0025664; Mon, 23 Apr 2007 03:04:44 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JGX0031LHRU2X00@nwk-avmta-1.sfbay.Sun.COM>; Sun, 22 Apr 2007 19:04:42 -0700 (PDT) Received: from sineb-mail-2.sun.com ([192.18.19.7]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JGX00JB2HRPME80@nwk-avmta-1.sfbay.Sun.COM>; Sun, 22 Apr 2007 19:04:38 -0700 (PDT) Received: from fe-apac-06.sun.com (fe-apac-06.sun.com [192.18.19.177] (may be forged)) by sineb-mail-2.sun.com (8.13.6+Sun/8.12.9) with ESMTP id l3N24bmR029403; Mon, 23 Apr 2007 02:04:37 +0000 (GMT) Received: from conversion-daemon.mail-apac.sun.com by mail-apac.sun.com (Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006)) id <0JGX00A01HNIIR00@mail-apac.sun.com> (original mail from Quaker.Fang@Sun.COM); Mon, 23 Apr 2007 10:04:37 +0800 (SGT) Received: from [129.158.218.191] by mail-apac.sun.com (Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006)) with ESMTPSA id <0JGX00BG6HRNR1QK@mail-apac.sun.com>; Mon, 23 Apr 2007 10:04:37 +0800 (SGT) Date: Mon, 23 Apr 2007 10:03:25 +0800 From: Quaker Fang Subject: Re: PSARC/2007/223 Wireless WPA Supplicant Addendum In-reply-to: <200704211729.l3LHTLfR005099@marduk.eng.sun.com> Sender: Quaker.Fang@sun.com To: Gary Winiger Cc: Peter.Memishian@sun.com, psarc-ext@sun.com, wifi-dladm@sun.com Message-id: <462C13ED.4050400@sun.com> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-Accept-Language: zh-cn X-PMX-Version: 5.2.0.264296 References: <200704211729.l3LHTLfR005099@marduk.eng.sun.com> User-Agent: Mozilla/5.0 (X11; U; SunOS i86pc; zh-CN; rv:1.7) Gecko/20050816 Status: RO Content-Length: 2157 Hi Gary, Gary Winiger wrote: >> > > 3. solaris.smf.modify authorization granted to user "dladm" >> > > During testing, we found that when running as non-root, dladm needs the >> > > solaris.smf.modify authorization to create or delete WPA service >> > > instances. Given the current SMF security model, this means the dladm >> > > user needs to also be granted solaris.smf.modify in /etc/user_attr: >> > > >> > > + "dladm::::auths=solaris.smf.manage.wpa,solaris.smf.modify" >> > > >> > > We have contacted with SMF team, and SMF team acknowledges that the need >> > > for the (very powerful) "solaris.smf.modify" authorization to create or >> > > destroy service instances is a deficiency in the current SMF security >> > > architecture. In the future, if a more fine-grained authorization is >> > > provided, /etc/user_attr can be updated. >> > >> > Humm, I thought it was possible to do this with an authorization >> > specified within the manifest. Perhaps adding a general framework >> > modify_authorization value. >> >>What is "this"? Create and destroy SMF service instances? >> >> > > Yes; service instances. Perhaps I'm not reading smf_security(5) > accurately. > > > Thanks, but the modify_authorization seems not enough to add/delete service instances. see smf_security(5) ---- Property group-specific authorization can be specified by properties contained in the property group. modify_authorization Authorizations allow the addition, deletion, or modification of proper- ties within the property group. ------- Besides, I have ever tried this method, added a modify_authorzation value in general framework, but no success. -------- --------- Please correct me. -- Quaker From Darren.Moffat@Sun.COM Mon Apr 23 01:14:38 2007 Received: from sunmail3mpk.sfbay.sun.com (sunmail3mpk.SFBay.Sun.COM [129.146.11.52]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l3N8Ecbs023535 for ; Mon, 23 Apr 2007 01:14:38 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail3mpk.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id l3N8DoaC010435; Mon, 23 Apr 2007 01:13:50 -0700 (PDT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JGX00D05YV2PW00@nwk-avmta-1.sfbay.Sun.COM>; Mon, 23 Apr 2007 01:13:50 -0700 (PDT) Received: from gmp-ea-fw-1.sun.com ([129.156.42.5]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JGX00KTIYUXT6C0@nwk-avmta-1.sfbay.Sun.COM>; Mon, 23 Apr 2007 01:13:46 -0700 (PDT) Received: from d1-emea-09.sun.com (d1-emea-09.sun.com [192.18.2.119]) by gmp-ea-fw-1.sun.com (8.13.6+Sun/8.12.9) with ESMTP id l3N8DiN9012983; Mon, 23 Apr 2007 08:13:44 +0000 (GMT) Received: from conversion-daemon.d1-emea-09.sun.com by d1-emea-09.sun.com (Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006)) id <0JGX00001YPDT500@d1-emea-09.sun.com> (original mail from Darren.Moffat@Sun.COM); Mon, 23 Apr 2007 09:13:44 +0100 (BST) Received: from [129.150.120.43] by d1-emea-09.sun.com (Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006)) with ESMTPSA id <0JGX008A7YUVRT00@d1-emea-09.sun.com>; Mon, 23 Apr 2007 09:13:44 +0100 (BST) Date: Mon, 23 Apr 2007 09:13:43 +0100 From: Darren J Moffat Subject: Re: PSARC/2007/223 Wireless WPA Supplicant Addendum In-reply-to: <17961.43239.554672.815492@gargle.gargle.HOWL> Sender: Darren.Moffat@Sun.COM To: Peter Memishian Cc: psarc-ext@Sun.COM, wifi-dladm@Sun.COM, Quaker.Fang@Sun.COM Message-id: <462C6AB7.6000300@Sun.COM> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 References: <17961.43239.554672.815492@gargle.gargle.HOWL> User-Agent: Thunderbird 2.0b2 (X11/20070227) Status: RO Content-Length: 1556 Peter Memishian wrote: > 3. solaris.smf.modify authorization granted to user "dladm" > During testing, we found that when running as non-root, dladm needs the > solaris.smf.modify authorization to create or delete WPA service > instances. Given the current SMF security model, this means the dladm > user needs to also be granted solaris.smf.modify in /etc/user_attr: > > + "dladm::::auths=solaris.smf.manage.wpa,solaris.smf.modify" > > We have contacted with SMF team, and SMF team acknowledges that the need > for the (very powerful) "solaris.smf.modify" authorization to create or > destroy service instances is a deficiency in the current SMF security > architecture. In the future, if a more fine-grained authorization is > provided, /etc/user_attr can be updated. I went over this with the project team during code and design review. While I really wish this wasn't require it appears that it is the only way to create new instances of a service. Since WiFi NIC's can come and go at any time we can't have the :default instance create the others "at boot", particularly since WiFi NICs can be PCMCIA or USB attached and may not always be present. If this was required to be given to any user needing to set WiFi link properties I would have rejected this outright, however it is just for the system dladm account not for all users. Members of the SMF team were also involved in the discussion so they are aware of the need to refine the security model of SMF instance creation. -- Darren J Moffat From meem@triplex.east.sun.com Wed Apr 25 10:24:25 2007 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l3PHOObf010764 for ; Wed, 25 Apr 2007 10:24:25 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail5.uk.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id l3PHNTE3029416; Wed, 25 Apr 2007 18:23:30 +0100 (BST) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JH200B03DN4BO00@brm-avmta-1.central.sun.com>; Wed, 25 Apr 2007 11:23:28 -0600 (MDT) Received: from triplex.East.Sun.COM ([129.148.174.104]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JH200CBWDN4BHF0@brm-avmta-1.central.sun.com>; Wed, 25 Apr 2007 11:23:28 -0600 (MDT) Received: from triplex.East.Sun.COM (localhost [127.0.0.1]) by triplex.East.Sun.COM (8.14.0+Sun/8.14.0) with ESMTP id l3PHNS1W026126; Wed, 25 Apr 2007 13:23:28 -0400 (EDT) Received: (from meem@localhost) by triplex.East.Sun.COM (8.14.0+Sun/8.14.0/Submit) id l3PHNSg1026123; Wed, 25 Apr 2007 13:23:28 -0400 (EDT) Date: Wed, 25 Apr 2007 13:23:28 -0400 From: Peter Memishian Subject: re: PSARC/2007/223 Wireless WPA Supplicant Addendum In-reply-to: <17961.43239.554672.815492@gargle.gargle.HOWL> To: Peter Memishian Cc: psarc-ext@Sun.COM, wifi-dladm@Sun.COM, Quaker.Fang@Sun.COM Message-id: <17967.36496.275062.640944@gargle.gargle.HOWL> MIME-version: 1.0 X-Mailer: VM 7.17 under 21.4 (patch 18) "Social Property" XEmacs Lucid Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 References: <17961.43239.554672.815492@gargle.gargle.HOWL> Status: RO Content-Length: 269 This case was approved at today's PSARC meeting. In addition, the project team has been asked to file a CR requesting that SMF be enhanced with an authorization that will allow processes to create or delete service instances (if one does not already exist). -- meem