From sacadmin Tue Jun 19 19:05:17 2007 Received: from sac.sfbay.sun.com (localhost [127.0.0.1]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5K25GbE000053; Tue, 19 Jun 2007 19:05:16 -0700 (PDT) Received: (from gww@localhost) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8/Submit) id l5K25GeU000049; Tue, 19 Jun 2007 19:05:16 -0700 (PDT) Date: Tue, 19 Jun 2007 19:05:16 -0700 (PDT) From: Gary Winiger Message-Id: <200706200205.l5K25GeU000049@sac.sfbay.sun.com> To: PSARC-record@sac.sfbay.sun.com Subject: auths(1) Update [PSARC/2007/369 FastTrack timeout 06/27/2007] Status: RO Content-Length: 550 Template Version: @(#)sac_nextcase 1.63 06/14/07 SMI This information is Copyright 2007 Sun Microsystems 1. Introduction 1.1. Project/Component Working Name: auths(1) Update 1.2. Name of Document Author/Supplier: Author: Bart Blanquart 1.3 Date of This Document: 19 June, 2007 4. Technical Description See the case directory for more detail 6. Resources and Schedule 6.4. Steering Committee requested information 6.4.1. Consolidation C-team Name: ON 6.5. ARC review type: FastTrack 6.6. ARC Exposure: open From gww@eng.sun.com Tue Jun 19 19:08:10 2007 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5K2895W000071 for ; Tue, 19 Jun 2007 19:08:09 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail5.uk.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id l5K26U7I020885 for <@sunmail3mpk.sfbay.sun.com:psarc-ext@sun.com>; Wed, 20 Jun 2007 03:06:31 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJW00807WIPBD00@nwk-avmta-2.sfbay.sun.com> for psarc-ext@sun.com (ORCPT psarc-ext@sun.com); Tue, 19 Jun 2007 19:06:25 -0700 (PDT) Received: from engmail3mpk.sfbay.Sun.COM ([129.146.11.26]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJW00KIUWIPTTD0@nwk-avmta-2.sfbay.sun.com> for psarc-ext@sun.com (ORCPT psarc-ext@sun.com); Tue, 19 Jun 2007 19:06:25 -0700 (PDT) Received: from marduk.eng.sun.com (marduk.SFBay.Sun.COM [129.146.108.224]) by engmail3mpk.sfbay.Sun.COM (8.13.6+Sun/8.13.6/ENSMAIL,v2.2) with ESMTP id l5K26NwE004103; Tue, 19 Jun 2007 19:06:23 -0700 (PDT) Received: from marduk.eng.sun.com (localhost [127.0.0.1]) by marduk.eng.sun.com (8.13.6+Sun/8.12.11) with ESMTP id l5K2988L022999; Tue, 19 Jun 2007 19:09:08 -0700 (PDT) Received: (from gww@localhost) by marduk.eng.sun.com (8.13.6+Sun/8.12.11/Submit) id l5K298dW022998; Tue, 19 Jun 2007 19:09:08 -0700 (PDT) Date: Tue, 19 Jun 2007 19:09:08 -0700 (PDT) From: Gary Winiger Subject: 2007/369 auths(1) Update To: psarc-ext@sun.com Cc: Bart.Blanquart@sun.com Message-id: <200706200209.l5K298dW022998@marduk.eng.sun.com> Content-transfer-encoding: 7BIT X-Sun-Charset: US-ASCII X-PMX-Version: 5.2.0.264296 Status: RO Content-Length: 2440 I'm sponsoring this fast track for Bart Blanquart. It updates the auths(1) command introduced by "Execution Profiles for Restricted Environments" (PSARC/1997/332) to provide for easier scripting of authorization checking. No original functionality is changed. The interface taxonomy is upgraded from Evolving to Committed. A patch release binding is requested. Full diffmarked man pages are in the case directory. The time is set for 27 June, 2007. Gary.. +++++++++++++++++++++++++++++++++++++++++++++++++ auths(1): ======== SYNOPSIS auths [ user ]... + auths -a authorization [ user ] OPTIONS + The following options are supported: + + -a authorization + + Does not write anything to the standard output. Exits with + zero status if you or the optionally specified user has + been granted this authorization. + Example 2 Testing for an authorization + if [ auths -a solaris.foo.bar ] + then + echo "You are authorized to use this feature." + # Perform actions here that require authorization + else + echo "Sorry, you are not authorized to use this feature." + fi EXIT STATUS The following exit values are returned: 0 Successful completion. 1 An error occurred. + >1 The user was not granted the specified authorization. ATTRIBUTES See attributes(5) for descriptions of the following attri- butes: ____________________________________________________________ | ATTRIBUTE TYPE | ATTRIBUTE VALUE | |_____________________________|_____________________________| | Availability | SUNWcsu | |_____________________________|_____________________________| + | Interface Stability | Committed | |_____________________________|_____________________________| rbac(5): ======== Authorizations can be explicitly checked in shell scripts by - checking the output of the auths(1) utility. For example, - - for auth in `auths | tr , " "` NOTFOUND - do - [ "$auth" = "solaris.date" ] && break # authorization found - done - - if [ "$auth" != "solaris.date" ] - then - echo >&2 "$PROG: ERROR: you are not authorized to set the date" - exit 1 - fi + using the auths(1) utility. For example, + + if [ ! auths -a solaris.date ] + then + echo >&2 "$PROG: ERROR: you are not authorized to set the date" + exit 1 + fi From danek.duvall@sun.com Tue Jun 19 19:18:11 2007 Received: from sunmail4.Singapore.Sun.COM (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5K2IABm000441 for ; Tue, 19 Jun 2007 19:18:11 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail4.Singapore.Sun.COM (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id l5K2GUta007318 for <@sunmail3mpk.sfbay.sun.com:psarc-ext@Sun.COM>; Wed, 20 Jun 2007 10:16:32 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJW00803WZIWQ00@nwk-avmta-2.sfbay.sun.com> for psarc-ext@Sun.COM (ORCPT psarc-ext@Sun.COM); Tue, 19 Jun 2007 19:16:30 -0700 (PDT) Received: from sfbaymail2sca.sfbay.sun.com ([129.145.155.42]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJW00KU8WZITWE0@nwk-avmta-2.sfbay.sun.com> for psarc-ext@Sun.COM (ORCPT psarc-ext@Sun.COM); Tue, 19 Jun 2007 19:16:30 -0700 (PDT) Received: from zruty.sfbay.sun.com (zruty.SFBay.Sun.COM [129.146.168.40]) by sfbaymail2sca.sfbay.sun.com (8.13.6+Sun/8.12.10/ENSMAIL,v2.2) with ESMTP id l5K2GSmK006186; Tue, 19 Jun 2007 19:16:28 -0700 (PDT) Received: from zruty.sfbay.sun.com (localhost [127.0.0.1]) by zruty.sfbay.sun.com (8.14.0+Sun/8.14.0) with ESMTP id l5K2FpC6027795; Tue, 19 Jun 2007 19:15:51 -0700 (PDT) Received: (from dduvall@localhost) by zruty.sfbay.sun.com (8.14.0+Sun/8.14.0/Submit) id l5K2FpwO027794; Tue, 19 Jun 2007 19:15:51 -0700 (PDT) Date: Tue, 19 Jun 2007 19:15:51 -0700 From: Danek Duvall Subject: Re: 2007/369 auths(1) Update In-reply-to: <200706200209.l5K298dW022998@marduk.eng.sun.com> To: Gary Winiger Cc: psarc-ext@sun.com, Bart.Blanquart@sun.com Message-id: <20070620021551.GE2389@zruty.sfbay.sun.com> MIME-version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-disposition: inline X-PMX-Version: 5.2.0.264296 References: <200706200209.l5K298dW022998@marduk.eng.sun.com> User-Agent: mutt-ng/devel-r535 (SunOS) Status: RO Content-Length: 732 On Tue, Jun 19, 2007 at 07:09:08PM -0700, Gary Winiger wrote: > Authorizations can be explicitly checked in shell scripts by > - checking the output of the auths(1) utility. For example, > - > - for auth in `auths | tr , " "` NOTFOUND > - do > - [ "$auth" = "solaris.date" ] && break # authorization found > - done > - > - if [ "$auth" != "solaris.date" ] > - then > - echo >&2 "$PROG: ERROR: you are not authorized to set the date" > - exit 1 > - fi Ah, zsh. :) [[ ${#${(M)${(s:,:)$(auths)}:#solaris.date}} -eq 1 ]] > + if [ ! auths -a solaris.date ] But regardless of shell choice, that's wrong. Ditch the brackets: if ! auths -a solaris.date ... Danek From gww@eng.sun.com Wed Jun 20 10:47:05 2007 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5KHl5Io022858 for ; Wed, 20 Jun 2007 10:47:05 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id l5KHisEc008952 for <@newsunmail1brm.central.sun.com:psarc-ext@sun.com>; Wed, 20 Jun 2007 11:44:54 -0600 (MDT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJY003073ZQIU00@brm-avmta-1.central.sun.com> for psarc-ext@sun.com (ORCPT psarc-ext@sun.com); Wed, 20 Jun 2007 11:45:26 -0600 (MDT) Received: from engmail3mpk.sfbay.Sun.COM ([129.146.11.26]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJY00HCP3ZQV770@brm-avmta-1.central.sun.com> for psarc-ext@sun.com (ORCPT psarc-ext@sun.com); Wed, 20 Jun 2007 11:45:26 -0600 (MDT) Received: from marduk.eng.sun.com (marduk.SFBay.Sun.COM [129.146.108.224]) by engmail3mpk.sfbay.Sun.COM (8.13.6+Sun/8.13.6/ENSMAIL,v2.2) with ESMTP id l5KHjOBW026949; Wed, 20 Jun 2007 10:45:24 -0700 (PDT) Received: from marduk.eng.sun.com (localhost [127.0.0.1]) by marduk.eng.sun.com (8.13.6+Sun/8.12.11) with ESMTP id l5KHmAwW023571; Wed, 20 Jun 2007 10:48:10 -0700 (PDT) Received: (from gww@localhost) by marduk.eng.sun.com (8.13.6+Sun/8.12.11/Submit) id l5KHmAdi023570; Wed, 20 Jun 2007 10:48:10 -0700 (PDT) Date: Wed, 20 Jun 2007 10:48:10 -0700 (PDT) From: Gary Winiger Subject: Re: 2007/369 auths(1) Update To: danek.duvall@sun.com, gww@eng.sun.com Cc: Bart.Blanquart@sun.com, psarc-ext@sun.com Message-id: <200706201748.l5KHmAdi023570@marduk.eng.sun.com> Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 Status: RO Content-Length: 378 > Ah, zsh. :) > > [[ ${#${(M)${(s:,:)$(auths)}:#solaris.date}} -eq 1 ]] > > > + if [ ! auths -a solaris.date ] > > But regardless of shell choice, that's wrong. Ditch the brackets: > > if ! auths -a solaris.date > ... The project team sent me an update to rbac.5 that includes Danek's kind code review comment. The materials are so updated. Gary.. From gww@eng.sun.com Wed Jun 20 18:50:59 2007 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l5L1owCD015944 for ; Wed, 20 Jun 2007 18:50:59 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail5.uk.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id l5L1n8Kr020401 for <@sunmail3mpk.sfbay.sun.com:psarc-ext@sun.com>; Thu, 21 Jun 2007 02:49:18 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JJY00705QE4AE00@nwk-avmta-2.sfbay.sun.com> for psarc-ext@sun.com (ORCPT psarc-ext@sun.com); Wed, 20 Jun 2007 18:49:16 -0700 (PDT) Received: from engmail3mpk.sfbay.Sun.COM ([129.146.11.26]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JJY00IP0QE4KR80@nwk-avmta-2.sfbay.sun.com> for psarc-ext@sun.com (ORCPT psarc-ext@sun.com); Wed, 20 Jun 2007 18:49:16 -0700 (PDT) Received: from marduk.eng.sun.com (marduk.SFBay.Sun.COM [129.146.108.224]) by engmail3mpk.sfbay.Sun.COM (8.13.6+Sun/8.13.6/ENSMAIL,v2.2) with ESMTP id l5L1nFd3021672; Wed, 20 Jun 2007 18:49:15 -0700 (PDT) Received: from marduk.eng.sun.com (localhost [127.0.0.1]) by marduk.eng.sun.com (8.13.6+Sun/8.12.11) with ESMTP id l5L1q1Mw024418; Wed, 20 Jun 2007 18:52:01 -0700 (PDT) Received: (from gww@localhost) by marduk.eng.sun.com (8.13.6+Sun/8.12.11/Submit) id l5L1q1gE024417; Wed, 20 Jun 2007 18:52:01 -0700 (PDT) Date: Wed, 20 Jun 2007 18:52:01 -0700 (PDT) From: Gary Winiger Subject: Re: 2007/369 auths(1) Update To: gww@eng.sun.com, psarc-ext@sun.com Cc: Bart.Blanquart@sun.com Message-id: <200706210152.l5L1q1gE024417@marduk.eng.sun.com> Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 Status: RO Content-Length: 57 This case was approved at today's PSARC meeting. Gary..