From Thu Feb 21 17:25:50 2008 Date: Thu, 21 Feb 2008 17:25:50 -0800 (PST) From: Postmaster Subject: Message from mail server Content-Length: 95 Mime-Version: 1.0 Status: RO X-IMAP: 1203643550 6 Delete. This is a system message. --END+PSEUDO-- From mws@zion.sfbay.sun.com Wed Feb 13 23:27:35 2008 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m1E7RZAk026653 for ; Wed, 13 Feb 2008 23:27:35 -0800 (PST) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id m1E7RV4m046260; Thu, 14 Feb 2008 00:27:33 -0700 (MST) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JW700B0JWPWHS00@brm-avmta-1.central.sun.com>; Thu, 14 Feb 2008 00:27:32 -0700 (MST) Received: from zion.sfbay.sun.com ([129.146.17.75]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JW7009A4WPW8L10@brm-avmta-1.central.sun.com>; Thu, 14 Feb 2008 00:27:32 -0700 (MST) Received: from zion.sfbay.sun.com (localhost [127.0.0.1]) by zion.sfbay.sun.com (8.14.2+Sun/8.14.2) with ESMTP id m1E7RV1i488534; Thu, 14 Feb 2008 07:27:31 +0000 (GMT) Received: (from mws@localhost) by zion.sfbay.sun.com (8.14.2+Sun/8.14.2/Submit) id m1E7RVSu488533; Wed, 13 Feb 2008 23:27:31 -0800 (PST) Date: Wed, 13 Feb 2008 23:27:31 -0800 From: Mike Shapiro Subject: PSARC 2008/109 Fine Grained Access Permissions (FGAP) To: psarc-ext@sun.com Cc: mws@sun.com, casper.dik@sun.com Message-id: <20080214072731.GA488502@sun.com> MIME-version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-disposition: inline X-PMX-Version: 5.2.0.264296 User-Agent: Mutt/1.4.2.1i Content-Length: 4716 Status: RO X-Status: $$$$ X-UID: 0000000001 I'm sponsoring the following fast-track for Casper Dik (FGAP). This case instantiates a set of Consolidation Private interfaces to permit fine- grained policy checks by a user-level policy daemon. This case has Micro binding and the timer is set for next Wednesday Feb 20th. -Mike ---8<--- 1. Technical Description The Fine Grained Access Permissions (FGAP) project will provide a mechanism and associated framework to allow per-object exceptions to the kernel security policy. I.e., rather than giving the file_dac_read privilege to a process or user, you can give access to only one particular file or set of files. This case instantiates the initial set of interfaces as Consolidation Private in order to enable early access and experimentation for developers as we explore the full set of interfaces that are required for such a policy mechanism. The intent of the project team is to then return with a future case providing man pages for the completed interfaces and upgrading the interfaces to Committed when we have sufficient developer feedback. The current policy checks are performed through the secpolicy* functions and ultimately funneling through priv_policy*. The FGAP mechanism intervenes at the latest possible moment and when the process in question does not have sufficient privileges, rather than returning failure, an upcall is performed to a daemon which has registered interest in handling exemptions for (a) particular privilege(s). This upcall passes along additional information about the object, such as: - filesystem pathname - reserved port protocol and port number and, as this call is made in the context of the caller, it also makes available the full process context of the calling process through the user credential. To this end some additional parameters are passed to the relevant secpolicy_* ()functions, such as the "vnode *", port numbers and protocols. Only processes marked with the "PRIV_XPOLICY" process flags will be subject to the upcall mechanism, making the overhead for ordinary processes negligible. There are several ways to register a "klpd" globally or local to a set of related processes. A klpd is registered for a specific set of privileges and the registering process will need to possess these privileges. 2. Security Considerations A process which registers a daemon requires the privileges it registers for. The processes which run under the policy are required to have the privileges required in their limit set. A process can only (partially) exceed its privileges if allowed to do so by a privileged policy broker. When the daemon fails or dies, all failures will be safe as all further policy calls will fail. 3. Reliability Considerations Only processes which run under the policy on a system which is configured with a policy for a set of processes or globally are affected. The mechanism shipped by this project will not include any such by default. This fasttrack defines the following "Consolidation Private" interfaces INTERFACES +-----------------------+------------------+------------------------+ | Interface | Classification | Comments | +-----------------------+------------------+------------------------+ | | Consolidation | | | klpd_create | Private | libc.so, SUNWprivate | | klpd_getpath | | | | klpd_getport | | | | klpd_getucred | | | | klpd_register | | | | klpd_register_id | | | | klpd_unregister | | | | klpd_unregister_id | | | | | | | | PRIV_XPOLICY | | | | (flag to setpflags) | | | | | | | | ppriv(1) -x | | New option | +-----------------------+------------------+------------------------+ and extends the "ppriv(1)" command with the ability to report and set the PRIV_XPOLICY flag using the "-x" argument. The intention is to fully document and publish the final versions of these interfaces in a future case, once the project team has had sufficient time to experiment with them and receive feedback from the community. From sacadmin Wed Feb 13 23:20:29 2008 Received: from sac.sfbay.sun.com (localhost [127.0.0.1]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m1E7KTQc026558; Wed, 13 Feb 2008 23:20:29 -0800 (PST) Received: (from mws@localhost) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8/Submit) id m1E7KTIH026554; Wed, 13 Feb 2008 23:20:29 -0800 (PST) Date: Wed, 13 Feb 2008 23:20:29 -0800 (PST) From: Michael Shapiro Message-Id: <200802140720.m1E7KTIH026554@sac.sfbay.sun.com> To: PSARC-record@sac.sfbay.sun.com Subject: Fine Grained Access Permissions (FGAP) [PSARC/2008/109 FastTrack timeout 02/20/2008] Content-Length: 577 Status: RO X-Status: $$$$ X-UID: 0000000002 Template Version: @(#)sac_nextcase 1.64 07/13/07 SMI This information is Copyright 2008 Sun Microsystems 1. Introduction 1.1. Project/Component Working Name: Fine Grained Access Permissions (FGAP) 1.2. Name of Document Author/Supplier: Author: Casper Dik 1.3 Date of This Document: 13 February, 2008 4. Technical Description See the case directory for more detail 6. Resources and Schedule 6.4. Steering Committee requested information 6.4.1. Consolidation C-team Name: OS/Net 6.5. ARC review type: FastTrack 6.6. ARC Exposure: open From gww@eng.sun.com Wed Feb 20 10:27:49 2008 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m1KIRlFQ016514 for ; Wed, 20 Feb 2008 10:27:48 -0800 (PST) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id m1KIRgGD025728; Thu, 21 Feb 2008 02:27:45 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JWJ0032ZVA8OC00@nwk-avmta-2.sfbay.sun.com>; Wed, 20 Feb 2008 10:27:44 -0800 (PST) Received: from dm-eng-02.sfbay.sun.com ([129.146.11.32]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JWJ002TWVA5CE20@nwk-avmta-2.sfbay.sun.com>; Wed, 20 Feb 2008 10:27:42 -0800 (PST) Received: from marduk.eng.sun.com (marduk.SFBay.Sun.COM [129.146.108.224]) by dm-eng-02.sfbay.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m1KIRege030966; Wed, 20 Feb 2008 10:27:40 -0800 (PST) Received: from marduk.eng.sun.com (localhost [127.0.0.1]) by marduk.eng.sun.com (8.13.6+Sun/8.12.11) with ESMTP id m1KIS2FY019271; Wed, 20 Feb 2008 10:28:02 -0800 (PST) Received: (from gww@localhost) by marduk.eng.sun.com (8.13.6+Sun/8.12.11/Submit) id m1KIS2fm019270; Wed, 20 Feb 2008 10:28:02 -0800 (PST) Date: Wed, 20 Feb 2008 10:28:02 -0800 (PST) From: Gary Winiger Subject: Re: PSARC 2008/109 Fine Grained Access Permissions (FGAP) To: mws@sun.com, psarc-ext@sun.com Cc: casper.dik@sun.com Message-id: <200802201828.m1KIS2fm019270@marduk.eng.sun.com> Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 Content-Length: 2383 Status: RO X-Status: $$$$ X-UID: 0000000003 > grained policy checks by a user-level policy daemon. This case has Micro > binding and the timer is set for next Wednesday Feb 20th. > This fasttrack defines the following "Consolidation Private" interfaces What's meant by a Micro binding? > INTERFACES > +-----------------------+------------------+------------------------+ > | Interface | Classification | Comments | > +-----------------------+------------------+------------------------+ > | | Consolidation | | > | klpd_create | Private | libc.so, SUNWprivate | > | klpd_getpath | | | > | klpd_getport | | | > | klpd_getucred | | | > | klpd_register | | | > | klpd_register_id | | | > | klpd_unregister | | | > | klpd_unregister_id | | | > | | | | > | PRIV_XPOLICY | | | > | (flag to setpflags) | | | > | | | | > | ppriv(1) -x | | New option | > +-----------------------+------------------+------------------------+ > The intention is to fully document and publish the final versions of > these interfaces in a future case, once the project team has had sufficient > time to experiment with them and receive feedback from the community. I'm unclear on what is actually being delivered by this case. Is there a policy daemon delivered? If so, what policies (privileges) does it support? If not, why is this case being brought at this time? Is it just too hard to keep the kernel in sync with prototyping of FGAP? Are there some OS.O dependences that can't be met with a project consolidation/gate? If this is dormant functionality, how will it be tested from build to build? What administrative interfaces are part of this case? Gary.. From casper@holland.sun.com Wed Feb 20 10:51:58 2008 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m1KIpvIX018455 for ; Wed, 20 Feb 2008 10:51:57 -0800 (PST) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m1KIpqRF029659; Wed, 20 Feb 2008 18:51:55 GMT Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JWJ00F03WEH5X00@nwk-avmta-1.sfbay.Sun.COM>; Wed, 20 Feb 2008 10:51:53 -0800 (PST) Received: from dm-holland-02.uk.sun.com ([129.156.101.225]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JWJ00DXGWEGST00@nwk-avmta-1.sfbay.Sun.COM>; Wed, 20 Feb 2008 10:51:53 -0800 (PST) Received: from holland (room101.Holland.Sun.COM [10.16.117.40]) by dm-holland-02.uk.sun.com (8.13.6+Sun/8.13.6/ENSMAIL,v2.2) with ESMTP id m1KIpouZ005766; Wed, 20 Feb 2008 18:51:50 +0000 (GMT) Date: Wed, 20 Feb 2008 19:51:50 +0100 From: Casper.Dik@sun.com Subject: Re: PSARC 2008/109 Fine Grained Access Permissions (FGAP) In-reply-to: <200802201828.m1KIS2fm019270@marduk.eng.sun.com> Sender: casper@holland.sun.com To: Gary Winiger Cc: mws@sun.com, psarc-ext@sun.com Message-id: <200802201851.m1KIpouZ005766@dm-holland-02.uk.sun.com> MIME-version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 References: <200802201828.m1KIS2fm019270@marduk.eng.sun.com> Content-Length: 2469 Status: RO X-Status: $$$$ X-UID: 0000000004 > What's meant by a Micro binding? I think "Minor" will do just fine (as we haven't ship "Micro" since 2.5.1) >> INTERFACES >> +-----------------------+------------------+------------------------+ >> | Interface | Classification | Comments | >> +-----------------------+------------------+------------------------+ >> | | Consolidation | | >> | klpd_create | Private | libc.so, SUNWprivate | >> | klpd_getpath | | | >> | klpd_getport | | | >> | klpd_getucred | | | >> | klpd_register | | | >> | klpd_register_id | | | >> | klpd_unregister | | | >> | klpd_unregister_id | | | >> | | | | >> | PRIV_XPOLICY | | | >> | (flag to setpflags) | | | >> | | | | >> | ppriv(1) -x | | New option | >> +-----------------------+------------------+------------------------+ > >> The intention is to fully document and publish the final versions of >> these interfaces in a future case, once the project team has had sufficient >> time to experiment with them and receive feedback from the community. > > I'm unclear on what is actually being delivered by this case. > Is there a policy daemon delivered? If so, what policies (privileges) > does it support? If not, why is this case being brought at this > time? Is it just too hard to keep the kernel in sync with prototyping > of FGAP? Are there some OS.O dependences that can't be met with a > project consolidation/gate? If this is dormant functionality, how > will it be tested from build to build? No, this case publishes exactly these interfaces and does not include a policy or or policy daemon. The list of interfaces here is complete. There is a particular community member which has requested these interfaces brought forward ASAP. Casper From gww@eng.sun.com Wed Feb 20 11:16:57 2008 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m1KJGvvG021422 for ; Wed, 20 Feb 2008 11:16:57 -0800 (PST) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id m1KJGvYA034757; Wed, 20 Feb 2008 12:16:57 -0700 (MST) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JWJ00501XK8LM00@nwk-avmta-2.sfbay.sun.com>; Wed, 20 Feb 2008 11:16:56 -0800 (PST) Received: from dm-eng-02.sfbay.sun.com ([129.146.11.32]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JWJ002XVXK8CK50@nwk-avmta-2.sfbay.sun.com>; Wed, 20 Feb 2008 11:16:56 -0800 (PST) Received: from marduk.eng.sun.com (marduk.SFBay.Sun.COM [129.146.108.224]) by dm-eng-02.sfbay.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m1KJGsd8002004; Wed, 20 Feb 2008 11:16:54 -0800 (PST) Received: from marduk.eng.sun.com (localhost [127.0.0.1]) by marduk.eng.sun.com (8.13.6+Sun/8.12.11) with ESMTP id m1KJHGGs019426; Wed, 20 Feb 2008 11:17:16 -0800 (PST) Received: (from gww@localhost) by marduk.eng.sun.com (8.13.6+Sun/8.12.11/Submit) id m1KJHG2N019425; Wed, 20 Feb 2008 11:17:16 -0800 (PST) Date: Wed, 20 Feb 2008 11:17:16 -0800 (PST) From: Gary Winiger Subject: Re: PSARC 2008/109 Fine Grained Access Permissions (FGAP) To: gww@eng.sun.com, Casper.Dik@sun.com Cc: mws@sun.com, psarc-ext@sun.com Message-id: <200802201917.m1KJHG2N019425@marduk.eng.sun.com> Content-transfer-encoding: 7BIT X-Sun-Charset: US-ASCII X-PMX-Version: 5.2.0.264296 Content-Length: 277 Status: RO X-Status: $$$$ X-UID: 0000000005 > There is a particular community member which has requested these interfaces > brought forward ASAP. OK. Please make the community member well aware that everything proposed by this case is subject to incompatible change when the full FGAP case comes for review. Gary.. From casper@holland.sun.com Wed Feb 20 11:55:37 2008 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m1KJtaNk025626 for ; Wed, 20 Feb 2008 11:55:37 -0800 (PST) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m1KJtS41025673; Wed, 20 Feb 2008 19:55:34 GMT Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JWJ00D0BZCK5P00@brm-avmta-1.central.sun.com>; Wed, 20 Feb 2008 12:55:32 -0700 (MST) Received: from dm-holland-02.uk.sun.com ([129.156.101.225]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JWJ009C0ZCI5C40@brm-avmta-1.central.sun.com>; Wed, 20 Feb 2008 12:55:30 -0700 (MST) Received: from holland (room101.Holland.Sun.COM [10.16.117.40]) by dm-holland-02.uk.sun.com (8.13.6+Sun/8.13.6/ENSMAIL,v2.2) with ESMTP id m1KJtRmn017397; Wed, 20 Feb 2008 19:55:28 +0000 (GMT) Date: Wed, 20 Feb 2008 20:55:27 +0100 From: Casper.Dik@sun.com Subject: Re: PSARC 2008/109 Fine Grained Access Permissions (FGAP) In-reply-to: <200802201917.m1KJHG2N019425@marduk.eng.sun.com> Sender: casper@holland.sun.com To: Gary Winiger Cc: mws@sun.com, psarc-ext@sun.com Message-id: <200802201955.m1KJtRmn017397@dm-holland-02.uk.sun.com> MIME-version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 References: <200802201917.m1KJHG2N019425@marduk.eng.sun.com> Content-Length: 425 Status: RO X-Status: $$$$ X-UID: 0000000006 >> There is a particular community member which has requested these interfaces >> brought forward ASAP. > > OK. Please make the community member well aware that everything > proposed by this case is subject to incompatible change when > the full FGAP case comes for review. They are. It's "Consolidation Private" for the good reason "you want this, but don't pin us down on the details and interfaces just yet? Casper From casper@holland.sun.com Thu Feb 28 05:45:43 2008 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m1SDjgU0002619 for ; Thu, 28 Feb 2008 05:45:43 -0800 (PST) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m1SDjetb025547 for <@sunmail2sca.sfbay.sun.com:psarc-ext@sun.com>; Thu, 28 Feb 2008 13:45:41 GMT Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JWY0080JBK31500@brm-avmta-1.central.sun.com> for psarc-ext@sun.com (ORCPT psarc-ext@sun.com); Thu, 28 Feb 2008 06:45:39 -0700 (MST) Received: from dm-holland-02.uk.sun.com ([129.156.101.225]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JWY00AGBBK2QVC0@brm-avmta-1.central.sun.com> for psarc-ext@sun.com (ORCPT psarc-ext@sun.com); Thu, 28 Feb 2008 06:45:38 -0700 (MST) Received: from holland (room101.Holland.Sun.COM [10.16.117.40]) by dm-holland-02.uk.sun.com (8.13.6+Sun/8.13.6/ENSMAIL,v2.2) with ESMTP id m1SDjbOn001583 for ; Thu, 28 Feb 2008 13:45:37 +0000 (GMT) Date: Thu, 28 Feb 2008 14:45:37 +0100 From: Casper.Dik@sun.com Subject: Re: PSARC 2008/109 Fine Grained Access Permissions (FGAP) In-reply-to: <200802201828.m1KIS2fm019270@marduk.eng.sun.com> Sender: casper@holland.sun.com To: PSARC-ext@sun.com Message-id: <200802281345.m1SDjbOn001583@dm-holland-02.uk.sun.com> Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 References: <200802201828.m1KIS2fm019270@marduk.eng.sun.com> Status: RO Content-Length: 56 This case was approved by PSARC on 2008/02/20. Casper