From gww@eng.sun.com Tue May 15 10:16:51 2007 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l4FHGoU9009554 for ; Tue, 15 May 2007 10:16:50 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail5.uk.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id l4FHFdbB010399 for <@sunmail3mpk.sfbay.sun.com:psarc-ext@sun.com>; Tue, 15 May 2007 18:15:40 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JI300303EM3FX00@nwk-avmta-2.sfbay.sun.com> for psarc-ext@sun.com (ORCPT psarc-ext@sun.com); Tue, 15 May 2007 10:15:39 -0700 (PDT) Received: from engmail3mpk.sfbay.Sun.COM ([129.146.11.26]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JI3003MTEM36I00@nwk-avmta-2.sfbay.sun.com> for psarc-ext@sun.com (ORCPT psarc-ext@sun.com); Tue, 15 May 2007 10:15:39 -0700 (PDT) Received: from marduk.eng.sun.com (marduk.SFBay.Sun.COM [129.146.108.224]) by engmail3mpk.sfbay.Sun.COM (8.13.6+Sun/8.13.6/ENSMAIL,v2.2) with ESMTP id l4FHFcdc004405; Tue, 15 May 2007 10:15:38 -0700 (PDT) Received: from marduk.eng.sun.com (localhost [127.0.0.1]) by marduk.eng.sun.com (8.13.6+Sun/8.12.11) with ESMTP id l4FHHUnB005830; Tue, 15 May 2007 10:17:30 -0700 (PDT) Received: (from gww@localhost) by marduk.eng.sun.com (8.13.6+Sun/8.12.11/Submit) id l4FHHUhw005829; Tue, 15 May 2007 10:17:30 -0700 (PDT) Date: Tue, 15 May 2007 10:17:30 -0700 (PDT) From: Gary Winiger Subject: 2007/275 - pam_tsol_account To: psarc-ext@sun.com Cc: ric.aleshire@sun.com Message-id: <200705151717.l4FHHUhw005829@marduk.eng.sun.com> Content-transfer-encoding: 7BIT X-Sun-Charset: US-ASCII X-PMX-Version: 5.2.0.264296 Status: RO Content-Length: 3754 I'm sponsoring this fast track for Ric Aleshire and the TX project team. This is an OpenSolaris case. It is the first and largest of three interfaces that fell through the cracks when Layered Trusted Solaris (PSARC/2002/762) was presented. The other two will be coming along shortly. This case provides a PAM account management module for TX, pam_tsol_account(5). The proposed interface taxonomy is Committed and the requested release binding is Patch. A copy of the prototype man page is in the case directory. The timer is set for 23 May, 2007. Gary.. +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Background ========== When Trusted Extensions (TX) is enabled (see Enabling method for Trusted Extensions, PSARC/2007/254), two TX specific account management policies need to be enforced: Users may not operate at labels not administratively granted to them. See Layered Trusted Solaris Label Interfaces (PSARC/2005/259), Trusted Extensions for Solaris Management Console (LSARC/2006/007), Trusted Extensions RBAC Changes (PSARC/2006/155). Even for authorized users, remote administration is restricted to labeled (CIPSO) machines. This restriction can optionally overridded by the administrator of the target TX machine. Proposal ======== Provide pam_tsol_account(5) and add it to the default Solaris pam.conf(4). Details ======= The default Solaris delivered (and upgraded) pam.conf(4) default account management section will read: # # Default definition for Account management # Used when service name is not explicitly mentioned for account management # other account requisite pam_roles.so.1 other account required pam_unix_account.so.1 other account required pam_tsol_account.so.1 Note: unless TX is enabled, pam_tsol_account will have no effect on the outcome of the Solaris default account management PAM stack. pam_tsol_account(5): NAME pam_tsol_account - Trusted Extensions account management module SYNOPSIS pam_tsol_account.so.1 DESCRIPTION The pam_tsol_account module implements pam_sm_acct_mgmt(3PAM). It verifies that a user's assigned label range contains the user's currently requested label. For remote access, unless the allow_unlabeled option is specified, it verifies that access to the Global Zone is from a labeled (CIPSO) system. The user's label range is that returned by getuserrange(3TSOL). The PAM items PAM_USER and PAM_RHOST are used to determine the outcome of this module. If Trusted Extensions is not enabled, this module always returns PAM_IGNORE. OPTIONS The following options can be passed to the module: allow_unlabeled Allows remote connections from hosts with unlabeled template types. See tnrhtp(4). debug Provides debugging information at the LOG_DEBUG level. See syslog(3C). ERRORS Upon successful completion, PAM_SUCCESS is returned. The following error codes are returned upon error: PAM_PERM_DENIED The current process label is outside the user's label range, or the remote host type is not valid. ATTRIBUTES See attributes(5) for description of the following attributes: ATTRIBUTE TYPE ATTRIBUTE VALUE Interface Stability Committed MT Level MT-Safe with exceptions SEE ALSO getplabel(3TSOL), getuserrange(3TSOL), libpam(3LIB), pam(3PAM), pam_sm_acct_mgmt(3PAM), syslog(3C), label_encodings(4), user_attr(4), tnrhtp(4), attributes(5) NOTES The interfaces in libpam(3LIB) are MT-Safe only if each thread within the multi-threaded application uses its own PAM handle. From Darren.Moffat@sun.com Thu May 17 04:50:46 2007 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l4HBojw0012669 for ; Thu, 17 May 2007 04:50:46 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail5.uk.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id l4HBnQrY019948; Thu, 17 May 2007 12:49:34 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JI600B0VOUGMH00@nwk-avmta-2.sfbay.sun.com>; Thu, 17 May 2007 04:49:28 -0700 (PDT) Received: from gmp-ea-fw-1.sun.com ([129.156.42.6]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JI60076QOUEA3C0@nwk-avmta-2.sfbay.sun.com>; Thu, 17 May 2007 04:49:27 -0700 (PDT) Received: from d1-emea-09.sun.com ([192.18.2.119]) by gmp-ea-fw-1.sun.com (8.13.6+Sun/8.12.9) with ESMTP id l4HBnP41015312; Thu, 17 May 2007 11:49:25 +0000 (GMT) Received: from conversion-daemon.d1-emea-09.sun.com by d1-emea-09.sun.com (Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006)) id <0JI600M01OU9K500@d1-emea-09.sun.com> (original mail from Darren.Moffat@Sun.COM); Thu, 17 May 2007 12:49:25 +0100 (BST) Received: from [129.156.173.21] by d1-emea-09.sun.com (Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006)) with ESMTPSA id <0JI600A3OOUDA730@d1-emea-09.sun.com>; Thu, 17 May 2007 12:49:25 +0100 (BST) Date: Thu, 17 May 2007 12:49:25 +0100 From: Darren J Moffat Subject: Re: 2007/275 - pam_tsol_account In-reply-to: <200705151717.l4FHHUhw005829@marduk.eng.sun.com> Sender: Darren.Moffat@sun.com To: Gary Winiger Cc: psarc-ext@sun.com, ric.aleshire@sun.com Message-id: <464C4145.4090007@Sun.COM> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 References: <200705151717.l4FHHUhw005829@marduk.eng.sun.com> User-Agent: Thunderbird 2.0b2 (X11/20070326) Status: RO Content-Length: 1280 Gary Winiger wrote: > I'm sponsoring this fast track for Ric Aleshire and the TX project team. > This is an OpenSolaris case. > > It is the first and largest of three interfaces that fell through the > cracks when Layered Trusted Solaris (PSARC/2002/762) was presented. > The other two will be coming along shortly. > > This case provides a PAM account management module for TX, pam_tsol_account(5). > The proposed interface taxonomy is Committed and the requested release > binding is Patch. > A copy of the prototype man page is in the case directory. A pitty this is already shipping this way in S10 updates because IMO the name could have been better. I understand the legacy (if I remember correctly it used to do much more than this) of why it is named as it is. Ideally this would be named better so that it indicated what it actually does: label restriction. For example one of these might have been better: pam_user_clearance.so pam_label_range.so pam_user_label.so But since it is already shipping and renaming/deleteing/adding PAM modules to the default stack is hard enough as it is I wouldn't insist that it had a better name, but if the project team feels they could do it and not impact their schedule that would be wonderful. -- Darren J Moffat From gww@eng.sun.com Wed May 23 10:22:37 2007 Received: from sunmail4.Singapore.Sun.COM (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l4NHMaVT007788 for ; Wed, 23 May 2007 10:22:37 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail4.Singapore.Sun.COM (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id l4NHLCMU009024 for <@sunmail3mpk.sfbay.sun.com:psarc-ext@sun.com>; Thu, 24 May 2007 01:21:23 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JII00G0L87JZP00@nwk-avmta-2.sfbay.sun.com> for psarc-ext@sun.com (ORCPT psarc-ext@sun.com); Wed, 23 May 2007 10:21:19 -0700 (PDT) Received: from engmail3mpk.sfbay.Sun.COM ([129.146.11.26]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JII00DAS87IAE50@nwk-avmta-2.sfbay.sun.com> for psarc-ext@sun.com (ORCPT psarc-ext@sun.com); Wed, 23 May 2007 10:21:18 -0700 (PDT) Received: from marduk.eng.sun.com (marduk.SFBay.Sun.COM [129.146.108.224]) by engmail3mpk.sfbay.Sun.COM (8.13.6+Sun/8.13.6/ENSMAIL,v2.2) with ESMTP id l4NHLHcg007813; Wed, 23 May 2007 10:21:17 -0700 (PDT) Received: from marduk.eng.sun.com (localhost [127.0.0.1]) by marduk.eng.sun.com (8.13.6+Sun/8.12.11) with ESMTP id l4NHNLGK017000; Wed, 23 May 2007 10:23:21 -0700 (PDT) Received: (from gww@localhost) by marduk.eng.sun.com (8.13.6+Sun/8.12.11/Submit) id l4NHNLkc016999; Wed, 23 May 2007 10:23:21 -0700 (PDT) Date: Wed, 23 May 2007 10:23:21 -0700 (PDT) From: Gary Winiger Subject: Re: 2007/275 - pam_tsol_account To: gww@eng.sun.com, psarc-ext@sun.com Cc: ric.aleshire@sun.com Message-id: <200705231723.l4NHNLkc016999@marduk.eng.sun.com> Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 Status: RO Content-Length: 57 This case was approved at today's PSARC meeting. Gary..