From sacadmin Tue Jan 22 08:13:54 2008 Received: from absurd.sfbay.sun.com (absurd [129.146.228.172]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m0MGDsc5010545; Tue, 22 Jan 2008 08:13:54 -0800 (PST) Received: from absurd.sfbay.sun.com (localhost [127.0.0.1]) by absurd.sfbay.sun.com (8.14.2+Sun/8.14.2) with ESMTP id m0MGDrhs029262; Tue, 22 Jan 2008 08:13:54 -0800 (PST) Received: (from lianep@localhost) by absurd.sfbay.sun.com (8.14.2+Sun/8.14.2/Submit) id m0MGDrtU029258; Tue, 22 Jan 2008 08:13:53 -0800 (PST) Date: Tue, 22 Jan 2008 08:13:53 -0800 (PST) From: Liane Praza Message-Id: <200801221613.m0MGDrtU029258@absurd.sfbay.sun.com> To: PSARC-record@sac.sfbay.sun.com Cc: Antonello.Cruz@sun.com, David.Powell@sun.com Subject: Process Contract Decorations [PSARC/2008/046 FastTrack timeout 01/28/2008] Status: RO Content-Length: 566 Template Version: @(#)sac_nextcase 1.64 07/13/07 SMI This information is Copyright 2008 Sun Microsystems 1. Introduction 1.1. Project/Component Working Name: Process Contract Decorations 1.2. Name of Document Author/Supplier: Author: Antonello Cruz 1.3 Date of This Document: 22 January, 2008 4. Technical Description See the case directory for more detail 6. Resources and Schedule 6.4. Steering Committee requested information 6.4.1. Consolidation C-team Name: ON 6.5. ARC review type: FastTrack 6.6. ARC Exposure: open From liane.praza@sun.com Tue Jan 22 08:30:51 2008 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m0MGUo48010783 for ; Tue, 22 Jan 2008 08:30:51 -0800 (PST) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id m0MGUhJE022418; Tue, 22 Jan 2008 09:30:49 -0700 (MST) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JV2001270JD8600@nwk-avmta-1.sfbay.Sun.COM>; Tue, 22 Jan 2008 08:30:49 -0800 (PST) Received: from jurassic-x4600.sfbay.sun.com ([129.146.17.63]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JV200MNO0JCB420@nwk-avmta-1.sfbay.Sun.COM>; Tue, 22 Jan 2008 08:30:48 -0800 (PST) Received: from [129.146.228.172] (absurd.SFBay.Sun.COM [129.146.228.172]) by jurassic-x4600.sfbay.sun.com (8.14.2+Sun/8.14.2) with ESMTP id m0MGUmKo868611; Tue, 22 Jan 2008 08:30:48 -0800 (PST) Date: Tue, 22 Jan 2008 08:30:48 -0800 From: Liane Praza Subject: 2008/046 Process Contract Decorations To: psarc-ext@sun.com Cc: Antonello.Cruz@sun.com, David Powell Message-id: <47961A38.5000100@sun.com> MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 User-Agent: Thunderbird 2.0.0.6 (X11/20071203) Status: RO Content-Length: 10820 I'm submitting this fasttrack on behalf of Antonello Cruz. We request a Patch binding, and new interfaces introduced are Committed. The timer is set for 28 January, 2008. liane --- Process Contract Decorations Antonello Cruz 1/22/2008 1. Summary This proposal adds new terms to process contracts for the service fmri and additional information that will enable one to identify the provenance of a process contract. It also updates SMF(5), ctrun(1), and init(1M) to publish this information. Unmodified process contract consumers will continue to work in a compatible fashion. We are requesting patch release binding for these changes. 2. Problem Solved svc.startd and inetd currently track which contracts they created for which services. While this information is made available to other consumers, it isn't conveniently accessed: the data is indexed by service, not contract; the data isn't available in kernel or post-mortem environments; and data on sub-contracts (contracts created by contracts created by svc.startd/inetd) doesn't exist. With these changes: Administrators will be able to easily (i.e. in one step only) identify where a contract originated. Contracts without an existing genealogical link to contracts known to SMF will still be identifiable. Observation and debugging tools (e.g. DTrace) in both userland and the kernel will be able to efficiently obtain and use the service owner of a contract. Post-mortem tools will be able to identify the ownership of contracts. 3. Description Details 3.1 New process contract terms The following new terms are added to the process contract: Service FMRI: This term contains the service FMRI for the process contract members. The value is set on the contract template and if left undefined, it will be inherited from the parent's process contract. Creator Auxiliary: This term allows a particular creator to further describe the purpose of a contract. In general, the values of this term are undefined by this case; it is up to individual creators to create and follow conventions. For example, svc.startd could (and will, see below) use this field to store the method name. The primary consumers of this term are observation tools that could be running in a variety of locales; we recommend producers (which are typically daemons or system tools) limit their content to the C locale (ASCII). In addition to the above terms, the kernel will publish the following information for each process contract: Service Contract ID The contract ID of the first contract in this service. The first contract is the youngest ancestor for which the Service FMRI was set (i.e. not inherited). Creator The name of the process that created the process contract. 3.2 New privileges In order to be able to reliably identify a process contract based on the service FMRI value, we will require privilege to set the term in the process contract template. There is no current privilege that could be leveraged for the purpose of contract identification. Thus, we introduce a new privilege, {PRIV_CONTRACT_IDENTITY}, that will be required of processes that set the Service FMRI term. 3.3 Change to existing software The following interfaces were added to libcontract(3LIB) to access the new terms in the template and process contracts. These descriptions can be found in the man pages. ct_pr_tmpl_set_svc_fmri() ct_pr_tmpl_get_svc_fmri() ct_pr_tmpl_set_svc_aux() ct_pr_tmpl_get_svc_aux() ct_pr_status_get_svc_fmri() ct_pr_status_get_svc_aux() ct_pr_status_get_svc_ctid() ct_pr_status_get_svc_creator() To permit a user to define values to the new term, new options were introduced to ctrun. Option -F to set the value for service FMRI and option -A to set the value for service auxiliary New contract term values of well-known process contracts. init(1M) term set by value ---------------------------------------------------------------- FMRI kernel svc:/system/init:default ctid kernel init's contract id creator kernel "sched" aux kernel "" init-started "services" term set by value ----------------------------------------------------------------- FMRI init(1M) init:/ ctid kernel service's contract id creator kernel "init" aux init(1M) inittab entry id svc.startd(1M) (special case of the above) term set by value ---------------------------------------------------------------- FMRI init(1M) svc:/system/svc/restarter:default ctid kernel svc.startd's contract id creator kernel "init" aux init(1M) "smf" (svc.startd's inittab entry id) svc.configd(1M) term set by value ---------------------------------------------------------------- FMRI svc.startd(1M) svc:/system/svc/repository:default ctid kernel svc.configd's contract id creator kernel "svc.startd" aux svc.startd(1M) "svc.configd" services term set by value ---------------------------------------------------------------- FMRI restarter service FMRI ctid kernel service's contract id creator kernel restarter execname (e.g svc.startd) aux restarter method (e.g start, stop) subcontract of services/commands unaware of new terms e.g. ssh, console-login, zlogin term set by value ---------------------------------------------------------------- FMRI kernel service FMRI inherited from parent ctid kernel service's contract id creator kernel contract creator's execname (e.g sshd) aux kernel "" ctrun(1) term set by value ---------------------------------------------------------------- FMRI ctrun(1) defined by option -F, if omitted it will inherit the value from parent's contract ctid kernel service's contract id (or the contract's id, if a new FMRI was specified using -F creator kernel "ctrun" aux ctrun(1) defined by option -A, if omitted it will be "" 4. Examples The following example obtains a verbose report of contract which its id is 1: example% ctstat -vi 1 CTID TYPE STATE HOLDER EVENTS QTIME NTIME 1 process owned 100579 0 - - informative event set: none critical event set: hwerr core fatal event set: hwerr parameter set: none member processes: 100600 100601 inherited ctids: none service fmri: svc:/system/init:default service fmri's ctid: 1 creator: sched aux: Here is a dtrace example for aggregating system calls by FMRI. #!/usr/sbin/dtrace -s syscall:::entry { @[stringof(curthread->t_procp->p_ct_process->conp_svc_fmri-> rs_string)] = count(); } dtrace: script './svc_sys_aggr.d' matched 232 probes ^C svc:/system/fmd:default 7 svc:/system/utmp:default 11 svc:/system/system-log:default 18 svc:/network/rpc/keyserv:default 20 svc:/system/hal:default 20 svc:/system/intrd:default 36 svc:/system/zones:default 72 svc:/network/smtp:sendmail 122 svc:/network/inetd:default 292 svc:/network/rpc/bind:default 372 svc:/system/cryptosvc:default 394 svc:/network/nfs/mapid:default 439 svc:/network/rpc/gss:default 623 svc:/network/nfs/cbd:default 668 svc:/system/filesystem/autofs:default 1402 svc:/network/nfs/status:default 1556 svc:/system/webconsole:console 1842 svc:/network/nfs/nlockmgr:default 1977 svc:/application/graphical-login/cde-login:default 2449 svc:/system/svc/restarter:default 2851 svc:/system/name-service-cache:default 3819 svc:/system/console-login:default 5124 svc:/system/svc/repository:default 9686 svc:/network/ssh:default 10819 5. Interface table The new libcontract(3LIB) interfaces created by this project are listed below. This is the set of interfaces used to modify and retrieve values in the process contract template structure. ct_pr_tmpl_set_svc_fmri() Committed ct_pr_tmpl_get_svc_fmri() Committed ct_pr_tmpl_set_svc_aux() Committed ct_pr_tmpl_get_svc_aux() Committed This is the set of interfaces used to retrieve values in the process contract status structure. ct_pr_status_get_svc_fmri() Committed ct_pr_status_get_svc_aux() Committed ct_pr_status_get_svc_ctid() Committed ct_pr_status_get_svc_creator() Committed Modified commands interface ctrun invocation Committed ctstat output Not-an-Interface Privilege created PRIV_CONTRACT_IDENTITY Committed 6. Documentation changes See the 'materials' subdirectory of the case directory for manpage diffs. From Darren.Moffat@sun.com Wed Jan 23 02:53:17 2008 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m0NArGn7013800 for ; Wed, 23 Jan 2008 02:53:17 -0800 (PST) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m0NArEK3001748 for <@sunmail2sca.sfbay.sun.com:psarc-ext@sun.com>; Wed, 23 Jan 2008 10:53:16 GMT Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JV300M07FKQMC00@nwk-avmta-1.sfbay.Sun.COM> for psarc-ext@sun.com (ORCPT psarc-ext@sun.com); Wed, 23 Jan 2008 02:53:14 -0800 (PST) Received: from gmp-eb-mail-1.sun.com ([192.18.6.21]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JV300I9XFKO4A20@nwk-avmta-1.sfbay.Sun.COM> for psarc-ext@sun.com (ORCPT psarc-ext@sun.com); Wed, 23 Jan 2008 02:53:13 -0800 (PST) Received: from fe-emea-10.sun.com (gmp-eb-lb-2-fe2.eu.sun.com [192.18.6.11]) by gmp-eb-mail-1.sun.com (8.13.7+Sun/8.12.9) with ESMTP id m0NArC9H007138 for ; Wed, 23 Jan 2008 10:53:12 +0000 (GMT) Received: from conversion-daemon.fe-emea-10.sun.com by fe-emea-10.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0JV300A01EV12300@fe-emea-10.sun.com> (original mail from Darren.Moffat@Sun.COM) for psarc-ext@sun.com (ORCPT psarc-ext@sun.com); Wed, 23 Jan 2008 10:53:12 +0000 (GMT) Received: from [129.156.173.199] by fe-emea-10.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0JV300I61FKN2G10@fe-emea-10.sun.com>; Wed, 23 Jan 2008 10:53:11 +0000 (GMT) Date: Wed, 23 Jan 2008 10:53:11 +0000 From: Darren J Moffat Subject: Re: 2008/046 Process Contract Decorations In-reply-to: <47961A38.5000100@sun.com> Sender: Darren.Moffat@sun.com To: Liane Praza Cc: psarc-ext@sun.com, David Powell , Antonello.Cruz@sun.com Message-id: <47971C97.8030207@Sun.COM> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 References: <47961A38.5000100@sun.com> User-Agent: Thunderbird 2.0.0.6 (X11/20071119) Status: RO Content-Length: 1244 Liane Praza wrote: > 3.2 New privileges > > In order to be able to reliably identify a process contract based > on the service FMRI value, we will require privilege to set the > term in the process contract template. There is no current > privilege that could be leveraged for the purpose of contract > identification. Thus, we introduce a new privilege, > {PRIV_CONTRACT_IDENTITY}, that will be required of processes that > set the Service FMRI term. I'm assuming this applies to both the "Service FMRI" and the "Creator Auxiliary" information. This means that end users using ctrun(1) won't be able to setup contract identities that seems a shame since they can create new contracts. Would it be sufficient that the privilege is needed only to change the stored identity information if it is already set or be required only to set the "Service FMRI" and to change the aux information (if already set). This looks like great stuff and I'd like to see it get as much scope for use. I can see that setting a service FMRI as an end user could be seen as a bad thing because it could confuse analysis tools but I'm not sure I see the security risk in doing so, is there one ? -- Darren J Moffat From casper@holland.sun.com Wed Jan 23 03:11:42 2008 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m0NBBfRb014250 for ; Wed, 23 Jan 2008 03:11:41 -0800 (PST) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m0NBBOfZ009351 for <@sunmail2sca.sfbay.sun.com:psarc-ext@Sun.COM>; Wed, 23 Jan 2008 11:11:40 GMT Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JV300M0JGFDKY00@brm-avmta-1.central.sun.com> for psarc-ext@Sun.COM (ORCPT psarc-ext@Sun.COM); Wed, 23 Jan 2008 04:11:37 -0700 (MST) Received: from dm-holland-02.uk.sun.com ([129.156.101.225]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JV3000VJGFBCQD0@brm-avmta-1.central.sun.com> for psarc-ext@Sun.COM (ORCPT psarc-ext@Sun.COM); Wed, 23 Jan 2008 04:11:36 -0700 (MST) Received: from holland (room101.Holland.Sun.COM [10.16.117.40]) by dm-holland-02.uk.sun.com (8.13.6+Sun/8.13.6/ENSMAIL,v2.2) with ESMTP id m0NBBWVJ029790; Wed, 23 Jan 2008 11:11:32 +0000 (GMT) Date: Wed, 23 Jan 2008 12:11:32 +0100 From: Casper.Dik@sun.com Subject: Re: 2008/046 Process Contract Decorations In-reply-to: <47971C97.8030207@Sun.COM> Sender: casper@holland.sun.com To: Darren J Moffat Cc: Liane Praza , psarc-ext@sun.com, David Powell , Antonello.Cruz@sun.com Message-id: <200801231111.m0NBBWVJ029790@dm-holland-02.uk.sun.com> Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 References: <47961A38.5000100@sun.com> <47971C97.8030207@Sun.COM> Status: RO Content-Length: 1377 >Liane Praza wrote: >> 3.2 New privileges >> >> In order to be able to reliably identify a process contract based >> on the service FMRI value, we will require privilege to set the >> term in the process contract template. There is no current >> privilege that could be leveraged for the purpose of contract >> identification. Thus, we introduce a new privilege, >> {PRIV_CONTRACT_IDENTITY}, that will be required of processes that >> set the Service FMRI term. > >I'm assuming this applies to both the "Service FMRI" and the "Creator >Auxiliary" information. This means that end users using ctrun(1) won't >be able to setup contract identities that seems a shame since they can >create new contracts. > >Would it be sufficient that the privilege is needed only to change the >stored identity information if it is already set or be required only to >set the "Service FMRI" and to change the aux information (if already set). > >This looks like great stuff and I'd like to see it get as much scope for >use. I can see that setting a service FMRI as an end user could be seen >as a bad thing because it could confuse analysis tools but I'm not sure >I see the security risk in doing so, is there one ? I would expect you would need to "own" the contract in question or be able to control it in order to set the identity. Casper From Antonello.Cruz@sun.com Wed Jan 23 09:32:44 2008 Received: from sunmail2sca.sfbay.sun.com (sunmail2sca [129.145.155.234]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m0NHWiwx021734 for ; Wed, 23 Jan 2008 09:32:44 -0800 (PST) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail2sca.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id m0NHWhQG008522 for <@sunmail2sca.sfbay.sun.com:psarc-ext@sun.com>; Wed, 23 Jan 2008 09:32:44 -0800 (PST) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JV30050DY2JOH00@brm-avmta-1.central.sun.com> for psarc-ext@sun.com (ORCPT psarc-ext@sun.com); Wed, 23 Jan 2008 10:32:43 -0700 (MST) Received: from sca-es-mail-1.sun.com ([192.18.43.132]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JV3003L4Y2IEH10@brm-avmta-1.central.sun.com> for psarc-ext@sun.com (ORCPT psarc-ext@sun.com); Wed, 23 Jan 2008 10:32:42 -0700 (MST) Received: from fe-sfbay-09.sun.com ([192.18.43.129]) by sca-es-mail-1.sun.com (8.13.7+Sun/8.12.9) with ESMTP id m0NHWgie018937 for ; Wed, 23 Jan 2008 09:32:42 -0800 (PST) Received: from conversion-daemon.fe-sfbay-09.sun.com by fe-sfbay-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0JV300301XYOUU00@fe-sfbay-09.sun.com> (original mail from Antonello.Cruz@Sun.COM) for psarc-ext@sun.com (ORCPT psarc-ext@sun.com); Wed, 23 Jan 2008 09:32:42 -0800 (PST) Received: from [129.146.228.12] by fe-sfbay-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0JV300CZIY2IL1E0@fe-sfbay-09.sun.com>; Wed, 23 Jan 2008 09:32:42 -0800 (PST) Date: Wed, 23 Jan 2008 09:32:19 -0800 From: Antonello Cruz Subject: Re: 2008/046 Process Contract Decorations In-reply-to: <200801231111.m0NBBWVJ029790@dm-holland-02.uk.sun.com> Sender: Antonello.Cruz@sun.com To: Casper.Dik@sun.com Cc: Darren J Moffat , Liane Praza , PSARC-ext@sun.com, David Powell Message-id: <47977A23.9000701@sun.com> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 References: <47961A38.5000100@sun.com> <47971C97.8030207@Sun.COM> <200801231111.m0NBBWVJ029790@dm-holland-02.uk.sun.com> User-Agent: Thunderbird 2.0.0.6 (X11/20080102) Status: RO Content-Length: 2317 Casper.Dik@Sun.COM wrote: > Darren J Moffat wrote: >> Liane Praza wrote: >>> 3.2 New privileges >>> >>> In order to be able to reliably identify a process contract based >>> on the service FMRI value, we will require privilege to set the >>> term in the process contract template. There is no current >>> privilege that could be leveraged for the purpose of contract >>> identification. Thus, we introduce a new privilege, >>> {PRIV_CONTRACT_IDENTITY}, that will be required of processes that >>> set the Service FMRI term. >> I'm assuming this applies to both the "Service FMRI" and the "Creator >> Auxiliary" information. This means that end users using ctrun(1) won't >> be able to setup contract identities that seems a shame since they can >> create new contracts. >> >> Would it be sufficient that the privilege is needed only to change the >> stored identity information if it is already set or be required only to >> set the "Service FMRI" and to change the aux information (if already set). Actually the privilege is required only for setting the "Service FMRI". The man pages diffs should better clarify that the privilege is required for ctrun -F and ct_pr_tmpl_set_svc_fmri(). >> >> This looks like great stuff and I'd like to see it get as much scope for >> use. I can see that setting a service FMRI as an end user could be seen >> as a bad thing because it could confuse analysis tools but I'm not sure >> I see the security risk in doing so, is there one ? There is no security vulnerability in not requiring privilege to set the "Service FMRI". Requiring privilege has the goal of making the term "Service FMRI" a trusted, system-wide name for observability purposes. Just as the SMF service FMRI is today. We don't require the privilege for term "Creator Auxiliary" so that unprivileged processes can differentiate contracts they spawn. After all, the contracts created by an unprivileged process would all have the same inherited "Service FMRI". > > > I would expect you would need to "own" the contract in question or > be able to control it in order to set the identity. The terms of a contract cannot be changed after it is created. Therefore, when a process owns a contract, it cannot change the contract's identity terms. Antonello From gww@eng.sun.com Wed Jan 23 14:11:02 2008 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m0NMB1md020014 for ; Wed, 23 Jan 2008 14:11:02 -0800 (PST) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id m0NMAvKj012566 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Thu, 24 Jan 2008 06:11:00 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JV400H05AYCR500@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 23 Jan 2008 14:11:00 -0800 (PST) Received: from dm-eng-02.sfbay.sun.com ([129.146.11.32]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JV4005L8AYBFN60@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 23 Jan 2008 14:10:59 -0800 (PST) Received: from marduk.eng.sun.com (marduk.SFBay.Sun.COM [129.146.108.224]) by dm-eng-02.sfbay.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m0NMAuWP048221; Wed, 23 Jan 2008 14:10:56 -0800 (PST) Received: from marduk.eng.sun.com (localhost [127.0.0.1]) by marduk.eng.sun.com (8.13.6+Sun/8.12.11) with ESMTP id m0NM9gH9020114; Wed, 23 Jan 2008 14:09:42 -0800 (PST) Received: (from gww@localhost) by marduk.eng.sun.com (8.13.6+Sun/8.12.11/Submit) id m0NM9gdj020113; Wed, 23 Jan 2008 14:09:42 -0800 (PST) Date: Wed, 23 Jan 2008 14:09:42 -0800 (PST) From: Gary Winiger Subject: Re: 2008/046 Process Contract Decorations To: Antonello.Cruz@sun.com, Casper.Dik@sun.com Cc: Darren.Moffat@sun.com, David.Powell@sun.com, Liane.Praza@sun.com, PSARC-ext@sun.com Message-id: <200801232209.m0NM9gdj020113@marduk.eng.sun.com> Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 Status: RO Content-Length: 2619 > >> Liane Praza wrote: > >>> 3.2 New privileges > >>> > >>> In order to be able to reliably identify a process contract based > >>> on the service FMRI value, we will require privilege to set the > >>> term in the process contract template. There is no current > >>> privilege that could be leveraged for the purpose of contract > >>> identification. Thus, we introduce a new privilege, > >>> {PRIV_CONTRACT_IDENTITY}, that will be required of processes that > >>> set the Service FMRI term. > >> I'm assuming this applies to both the "Service FMRI" and the "Creator > >> Auxiliary" information. This means that end users using ctrun(1) won't > >> be able to setup contract identities that seems a shame since they can > >> create new contracts. > >> > >> Would it be sufficient that the privilege is needed only to change the > >> stored identity information if it is already set or be required only to > >> set the "Service FMRI" and to change the aux information (if already set). > Actually the privilege is required only for setting the "Service FMRI". > The man pages diffs should better clarify that the privilege is required > for ctrun -F and ct_pr_tmpl_set_svc_fmri(). > > >> > >> This looks like great stuff and I'd like to see it get as much scope for > >> use. I can see that setting a service FMRI as an end user could be seen > >> as a bad thing because it could confuse analysis tools but I'm not sure > >> I see the security risk in doing so, is there one ? > There is no security vulnerability in not requiring privilege to set the > "Service FMRI". Requiring privilege has the goal of making the term > "Service FMRI" a trusted, system-wide name for observability purposes. > Just as the SMF service FMRI is today. Hummm, is that really worth adding a privilege and requiring ctrun to be called with that privilege? What's the risk of the FMRI being spoofed on a contract? What Rights Profile is being proposed to grant ctrun privilege? And who should be granted this profile? Gary.. > We don't require the privilege for term "Creator Auxiliary" so that > unprivileged processes can differentiate contracts they spawn. After > all, the contracts created by an unprivileged process would all have the > same inherited "Service FMRI". > > > > > > > I would expect you would need to "own" the contract in question or > > be able to control it in order to set the identity. > The terms of a contract cannot be changed after it is created. > Therefore, when a process owns a contract, it cannot change the > contract's identity terms. From Nicolas.Williams@sun.com Wed Jan 23 14:29:11 2008 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m0NMTBwD021052 for ; Wed, 23 Jan 2008 14:29:11 -0800 (PST) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id m0NMTAfj028857; Wed, 23 Jan 2008 15:29:10 -0700 (MST) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JV400B31BSMQJ00@nwk-avmta-2.sfbay.sun.com>; Wed, 23 Jan 2008 14:29:10 -0800 (PST) Received: from binky.Central.Sun.COM ([129.153.128.104]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JV40087ABSJWJ30@nwk-avmta-2.sfbay.sun.com>; Wed, 23 Jan 2008 14:29:08 -0800 (PST) Received: from binky.Central.Sun.COM (localhost [127.0.0.1]) by binky.Central.Sun.COM (8.14.1+Sun/8.14.1) with ESMTP id m0NMT7Fx010815; Wed, 23 Jan 2008 16:29:07 -0600 (CST) Received: (from nw141292@localhost) by binky.Central.Sun.COM (8.14.1+Sun/8.14.1/Submit) id m0NMT7Xb010814; Wed, 23 Jan 2008 16:29:07 -0600 (CST) Date: Wed, 23 Jan 2008 16:29:07 -0600 From: Nicolas Williams Subject: Re: 2008/046 Process Contract Decorations In-reply-to: <47961A38.5000100@sun.com> To: Liane Praza Cc: PSARC-ext@sun.com, David Powell , Antonello.Cruz@sun.com Mail-followup-to: Liane Praza , PSARC-ext@Sun.COM, David Powell , Antonello.Cruz@sun.com Message-id: <20080123222907.GJ6591@Sun.COM> MIME-version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-disposition: inline X-PMX-Version: 5.2.0.264296 References: <47961A38.5000100@sun.com> X-Authentication-warning: binky.Central.Sun.COM: nw141292 set sender to Nicolas.Williams@sun.com using -f User-Agent: Mutt/1.5.7i Status: RO Content-Length: 737 Is there a stable DTrace interface to get at a contract's decorations? The problem with inheritting the FMRI from the contract's parent contract is that login sessions' contracts (which are created primarily to be distinct from that of the service that performed the login) and sub-contracts will have an FMRI that is not necessarily useful -- the FMRI decoration will only be useful in conjunction with a bit indicating whether the FMRI was inheritted. And if you wanted to you could make the privilege work sligthly differently: rather than use the privilege to authorize the contract identity set operation the kernel could simply set a one-bit decoration value indicating whether the contract creator had that privilege. Nico -- From Antonello.Cruz@sun.com Fri Jan 25 07:41:24 2008 Received: from sunmail2sca.sfbay.sun.com (sunmail2sca [129.145.155.234]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m0PFfN0D012064 for ; Fri, 25 Jan 2008 07:41:23 -0800 (PST) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail2sca.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id m0PFfKQS022702 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Fri, 25 Jan 2008 07:41:23 -0800 (PST) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JV70070TI8YFI00@nwk-avmta-2.sfbay.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Fri, 25 Jan 2008 07:41:22 -0800 (PST) Received: from sca-es-mail-1.sun.com ([192.18.43.132]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JV70048SI8V3P30@nwk-avmta-2.sfbay.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Fri, 25 Jan 2008 07:41:19 -0800 (PST) Received: from fe-sfbay-09.sun.com ([192.18.43.129]) by sca-es-mail-1.sun.com (8.13.7+Sun/8.12.9) with ESMTP id m0PFfJre017902 for ; Fri, 25 Jan 2008 07:41:19 -0800 (PST) Received: from conversion-daemon.fe-sfbay-09.sun.com by fe-sfbay-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0JV700A01I83ZL00@fe-sfbay-09.sun.com> (original mail from Antonello.Cruz@Sun.COM) for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Fri, 25 Jan 2008 07:41:19 -0800 (PST) Received: from [129.146.228.12] by fe-sfbay-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0JV700IT7I8VT850@fe-sfbay-09.sun.com>; Fri, 25 Jan 2008 07:41:19 -0800 (PST) Date: Fri, 25 Jan 2008 07:40:55 -0800 From: Antonello Cruz Subject: Re: 2008/046 Process Contract Decorations In-reply-to: <200801232209.m0NM9gdj020113@marduk.eng.sun.com> Sender: Antonello.Cruz@sun.com To: Gary Winiger Cc: Casper.Dik@sun.com, Darren.Moffat@sun.com, David.Powell@sun.com, Liane.Praza@sun.com, PSARC-ext@sun.com Message-id: <479A0307.4010109@sun.com> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 References: <200801232209.m0NM9gdj020113@marduk.eng.sun.com> User-Agent: Thunderbird 2.0.0.6 (X11/20080102) Status: RO Content-Length: 1153 Gary Winiger wrote: >> There is no security vulnerability in not requiring privilege to set the >> "Service FMRI". Requiring privilege has the goal of making the term >> "Service FMRI" a trusted, system-wide name for observability purposes. >> Just as the SMF service FMRI is today. > > Hummm, is that really worth adding a privilege and requiring > ctrun to be called with that privilege? What's the risk of > the FMRI being spoofed on a contract? The FMRI term as proposed is intended to allow an administrator to reliably identify where each contract on the system originates from. Since creating a new contract doesn't require privilege, permitting any contract creator to set the FMRI term limits observability and impedes forensic analysis. > > What Rights Profile is being proposed to grant ctrun privilege? A new Rights Profile named "Process Contract Identifier" should be amended to this case. > And who should be granted this profile? Users who are responsible for creating service-like collections of processes that the administrator has decided should be identified separately from services started by SMF Antonello From Antonello.Cruz@sun.com Fri Jan 25 07:44:01 2008 Received: from sunmail2sca.sfbay.sun.com (sunmail2sca [129.145.155.234]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m0PFi0E0012104 for ; Fri, 25 Jan 2008 07:44:00 -0800 (PST) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail2sca.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id m0PFi0w3023388 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Fri, 25 Jan 2008 07:44:00 -0800 (PST) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JV700K0PIDCGC00@brm-avmta-1.central.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Fri, 25 Jan 2008 08:44:00 -0700 (MST) Received: from sca-es-mail-2.sun.com ([192.18.43.133]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JV700G0LIDBQR90@brm-avmta-1.central.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Fri, 25 Jan 2008 08:43:59 -0700 (MST) Received: from fe-sfbay-10.sun.com ([192.18.43.129]) by sca-es-mail-2.sun.com (8.13.7+Sun/8.12.9) with ESMTP id m0PFhwlu028812 for ; Fri, 25 Jan 2008 07:43:58 -0800 (PST) Received: from conversion-daemon.fe-sfbay-10.sun.com by fe-sfbay-10.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0JV700J01IB1O000@fe-sfbay-10.sun.com> (original mail from Antonello.Cruz@Sun.COM) for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Fri, 25 Jan 2008 07:43:58 -0800 (PST) Received: from [129.146.228.12] by fe-sfbay-10.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0JV700JVJIDAAO30@fe-sfbay-10.sun.com>; Fri, 25 Jan 2008 07:43:58 -0800 (PST) Date: Fri, 25 Jan 2008 07:43:35 -0800 From: Antonello Cruz Subject: Re: 2008/046 Process Contract Decorations In-reply-to: <20080123222907.GJ6591@Sun.COM> Sender: Antonello.Cruz@sun.com To: Liane Praza , PSARC-ext@sun.com, David Powell , Antonello.Cruz@sun.com Message-id: <479A03A7.9030804@sun.com> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 References: <47961A38.5000100@sun.com> <20080123222907.GJ6591@Sun.COM> User-Agent: Thunderbird 2.0.0.6 (X11/20080102) Status: RO Content-Length: 1169 Nicolas Williams wrote: > Is there a stable DTrace interface to get at a contract's decorations? There are many possible consumers of these new terms. DTrace is only one such consumer, and can be designed separately from this case and in parallel with other consumers. > > The problem with inheritting the FMRI from the contract's parent > contract is that login sessions' contracts (which are created primarily > to be distinct from that of the service that performed the login) and > sub-contracts will have an FMRI that is not necessarily useful -- the > FMRI decoration will only be useful in conjunction with a bit indicating > whether the FMRI was inheritted. process(4) man page diff has code example to check if the "Service FMRI" was inherited or not. > > And if you wanted to you could make the privilege work sligthly > differently: rather than use the privilege to authorize the contract > identity set operation the kernel could simply set a one-bit decoration > value indicating whether the contract creator had that privilege. The "Creator Auxiliary" field was designed to permit an unprivileged contract creator to tag the contract. Antonello From Nicolas.Williams@sun.com Fri Jan 25 08:03:22 2008 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m0PG3LTR012524 for ; Fri, 25 Jan 2008 08:03:22 -0800 (PST) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id m0PG330I015749; Sat, 26 Jan 2008 00:03:15 +0800 (SGT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JV700L5HJ9DJ700@brm-avmta-1.central.sun.com>; Fri, 25 Jan 2008 09:03:14 -0700 (MST) Received: from binky.Central.Sun.COM ([129.153.128.104]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JV700GHRJ7SQTC0@brm-avmta-1.central.sun.com>; Fri, 25 Jan 2008 09:02:19 -0700 (MST) Received: from binky.Central.Sun.COM (localhost [127.0.0.1]) by binky.Central.Sun.COM (8.14.1+Sun/8.14.1) with ESMTP id m0PG2Cv0012802; Fri, 25 Jan 2008 10:02:12 -0600 (CST) Received: (from nw141292@localhost) by binky.Central.Sun.COM (8.14.1+Sun/8.14.1/Submit) id m0PG2Cbg012801; Fri, 25 Jan 2008 10:02:12 -0600 (CST) Date: Fri, 25 Jan 2008 10:02:12 -0600 From: Nicolas Williams Subject: Re: 2008/046 Process Contract Decorations In-reply-to: <479A0307.4010109@sun.com> To: Antonello Cruz Cc: Gary Winiger , David.Powell@sun.com, PSARC-ext@sun.com, Liane.Praza@sun.com, Casper.Dik@sun.com Mail-followup-to: Antonello Cruz , Gary Winiger , David.Powell@sun.com, PSARC-ext@sun.com, Liane.Praza@sun.com, Casper.Dik@sun.com Message-id: <20080125160211.GM12183@Sun.COM> MIME-version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-disposition: inline X-PMX-Version: 5.2.0.264296 References: <200801232209.m0NM9gdj020113@marduk.eng.sun.com> <479A0307.4010109@sun.com> X-Authentication-warning: binky.Central.Sun.COM: nw141292 set sender to Nicolas.Williams@sun.com using -f User-Agent: Mutt/1.5.7i Status: RO Content-Length: 1054 On Fri, Jan 25, 2008 at 07:40:55AM -0800, Antonello Cruz wrote: > Gary Winiger wrote: > > What Rights Profile is being proposed to grant ctrun privilege? > A new Rights Profile named "Process Contract Identifier" should be > amended to this case. > > > And who should be granted this profile? > Users who are responsible for creating service-like collections of > processes that the administrator has decided should be identified > separately from services started by SMF But will there be such users? It strikes me that this is a privilege that only restarters will need, and those should be services themselves, able to obtain this privilege straight from svc.startd. I.e., services that use ctrun to implement a restarter, or which use librestart may need this privilege, and they should have that privilege as part of the start method context. I can't imagine applications that are not SMF services requiring this privilege (except, perhaps, for debugging). So a rights profile to go with this privilege seems unnecessary. IMO, Nico -- From Antonello.Cruz@sun.com Fri Jan 25 13:41:19 2008 Received: from sunmail3mpk.sfbay.sun.com (sunmail3mpk [129.146.11.52]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m0PLfJIJ020956 for ; Fri, 25 Jan 2008 13:41:19 -0800 (PST) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail3mpk.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id m0PLfJdQ020398 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Fri, 25 Jan 2008 13:41:19 -0800 (PST) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JV700105YWTZW00@brm-avmta-1.central.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Fri, 25 Jan 2008 14:41:17 -0700 (MST) Received: from sca-es-mail-2.sun.com ([192.18.43.133]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JV700AVKYWSFK90@brm-avmta-1.central.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Fri, 25 Jan 2008 14:41:17 -0700 (MST) Received: from fe-sfbay-10.sun.com ([192.18.43.129]) by sca-es-mail-2.sun.com (8.13.7+Sun/8.12.9) with ESMTP id m0PLfGhC008755 for ; Fri, 25 Jan 2008 13:41:16 -0800 (PST) Received: from conversion-daemon.fe-sfbay-10.sun.com by fe-sfbay-10.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0JV700C01YP5AD00@fe-sfbay-10.sun.com> (original mail from Antonello.Cruz@Sun.COM) for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Fri, 25 Jan 2008 13:41:16 -0800 (PST) Received: from [129.146.228.12] by fe-sfbay-10.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0JV700LN7YWS4P60@fe-sfbay-10.sun.com>; Fri, 25 Jan 2008 13:41:16 -0800 (PST) Date: Fri, 25 Jan 2008 13:40:53 -0800 From: Antonello Cruz Subject: Re: 2008/046 Process Contract Decorations In-reply-to: <20080125160211.GM12183@Sun.COM> Sender: Antonello.Cruz@sun.com To: Antonello Cruz , Gary Winiger , David.Powell@sun.com, PSARC-ext@sun.com, Liane.Praza@sun.com, Casper.Dik@sun.com Message-id: <479A5765.90607@sun.com> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 References: <200801232209.m0NM9gdj020113@marduk.eng.sun.com> <479A0307.4010109@sun.com> <20080125160211.GM12183@Sun.COM> User-Agent: Thunderbird 2.0.0.6 (X11/20080102) Status: RO Content-Length: 1350 Nicolas Williams wrote: > On Fri, Jan 25, 2008 at 07:40:55AM -0800, Antonello Cruz wrote: >> Gary Winiger wrote: >>> What Rights Profile is being proposed to grant ctrun privilege? >> A new Rights Profile named "Process Contract Identifier" should be >> amended to this case. >> >>> And who should be granted this profile? >> Users who are responsible for creating service-like collections of >> processes that the administrator has decided should be identified >> separately from services started by SMF > > But will there be such users? It strikes me that this is a privilege > that only restarters will need, and those should be services themselves, > able to obtain this privilege straight from svc.startd. > > I.e., services that use ctrun to implement a restarter, or which use > librestart may need this privilege, and they should have that privilege > as part of the start method context. > > I can't imagine applications that are not SMF services requiring this > privilege (except, perhaps, for debugging). I can think of development of new restartes or services that create contracts, which probably falls in your debugging set. > > So a rights profile to go with this privilege seems unnecessary. I agree it seems overkill to create a new Rights Profile. I don't feel strongly either way. What do others think? Antonello From gww@eng.sun.com Wed Jan 30 09:56:35 2008 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m0UHuYGb026299 for ; Wed, 30 Jan 2008 09:56:35 -0800 (PST) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m0UHuLbA018850 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Wed, 30 Jan 2008 17:56:33 GMT Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JVG00D05XU7MG00@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 30 Jan 2008 09:56:31 -0800 (PST) Received: from dm-eng-02.sfbay.sun.com ([129.146.11.32]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JVG001APXU64F90@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 30 Jan 2008 09:56:30 -0800 (PST) Received: from marduk.eng.sun.com (marduk.SFBay.Sun.COM [129.146.108.224]) by dm-eng-02.sfbay.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m0UHuStM006320; Wed, 30 Jan 2008 09:56:28 -0800 (PST) Received: from marduk.eng.sun.com (localhost [127.0.0.1]) by marduk.eng.sun.com (8.13.6+Sun/8.12.11) with ESMTP id m0UHt634004129; Wed, 30 Jan 2008 09:55:06 -0800 (PST) Received: (from gww@localhost) by marduk.eng.sun.com (8.13.6+Sun/8.12.11/Submit) id m0UHt6Dk004128; Wed, 30 Jan 2008 09:55:06 -0800 (PST) Date: Wed, 30 Jan 2008 09:55:06 -0800 (PST) From: Gary Winiger Subject: Re: 2008/046 Process Contract Decorations To: Antonello.Cruz@sun.com, Casper.Dik@sun.com, David.Powell@sun.com, Liane.Praza@sun.com, PSARC-ext@sun.com, gww@eng.sun.com Message-id: <200801301755.m0UHt6Dk004128@marduk.eng.sun.com> Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 Status: RO Content-Length: 453 > > So a rights profile to go with this privilege seems unnecessary. > I agree it seems overkill to create a new Rights Profile. I don't feel > strongly either way. What do others think? To me the fundimental question is how is ctrun intended to be used? Is the intent for ctrun to be used by users/admins interactively to do something that needs the FRMI value? Or perhaps through scripting that the user/admin uses interactively ..... Gary.. From liane.praza@sun.com Wed Jan 30 10:14:58 2008 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m0UIEvFj028581 for ; Wed, 30 Jan 2008 10:14:57 -0800 (PST) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id m0UIEq8T057746; Wed, 30 Jan 2008 11:14:55 -0700 (MST) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JVG00C15YOU5200@nwk-avmta-2.sfbay.sun.com>; Wed, 30 Jan 2008 10:14:55 -0800 (PST) Received: from jurassic-x4600.sfbay.sun.com ([129.146.17.59]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JVG007UNYOUZ580@nwk-avmta-2.sfbay.sun.com>; Wed, 30 Jan 2008 10:14:54 -0800 (PST) Received: from [129.146.228.172] (absurd.SFBay.Sun.COM [129.146.228.172]) by jurassic-x4600.sfbay.sun.com (8.14.2+Sun/8.14.2) with ESMTP id m0UIEsfK276861; Wed, 30 Jan 2008 10:14:54 -0800 (PST) Date: Wed, 30 Jan 2008 10:14:54 -0800 From: Liane Praza Subject: Re: 2008/046 Process Contract Decorations In-reply-to: <200801301755.m0UHt6Dk004128@marduk.eng.sun.com> To: Gary Winiger Cc: Antonello.Cruz@sun.com, Casper.Dik@sun.com, David.Powell@sun.com, PSARC-ext@sun.com Message-id: <47A0BE9E.8050003@sun.com> MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 References: <200801301755.m0UHt6Dk004128@marduk.eng.sun.com> User-Agent: Thunderbird 2.0.0.6 (X11/20080102) Status: RO Content-Length: 725 Gary Winiger wrote: >>> So a rights profile to go with this privilege seems unnecessary. >> I agree it seems overkill to create a new Rights Profile. I don't feel >> strongly either way. What do others think? > > To me the fundimental question is how is ctrun intended to be > used? Is the intent for ctrun to be used by users/admins > interactively to do something that needs the FRMI value? > Or perhaps through scripting that the user/admin uses > interactively ..... We discussed and agreed at the meeting that ctrun -f isn't expected to be used interactively, and thus a rights profile is overkill at this point. This case was voted as approved in today's meeting with no changes to the initial spec. liane