From sacadmin Tue May 27 13:08:55 2008 Received: from spidey.central.sun.com (spidey.Central.Sun.COM [172.20.25.27]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m4RK8t74029663; Tue, 27 May 2008 13:08:55 -0700 (PDT) Received: from spidey.central.sun.com (localhost [127.0.0.1]) by spidey.central.sun.com (8.14.3+Sun/8.14.3) with ESMTP id m4RK8tTS011976; Tue, 27 May 2008 14:08:55 -0600 (MDT) Received: (from timh@localhost) by spidey.central.sun.com (8.14.3+Sun/8.14.3/Submit) id m4RK8tcG011975; Tue, 27 May 2008 14:08:55 -0600 (MDT) Date: Tue, 27 May 2008 14:08:55 -0600 (MDT) From: Tim Haley - Sun Microsystem Message-Id: <200805272008.m4RK8tcG011975@spidey.central.sun.com> To: PSARC-record@sac.sfbay.sun.com Cc: Afshin.Ardakani@sun.com, Alan.M.Wright@sun.com, mark.shellenbaum@sun.com Subject: Further SID support [PSARC/2008/342 FastTrack timeout 06/03/2008] Status: RO Content-Length: 5321 I am sponsoring this fast-track for Mark Shellenbaum. Requested binding is minor, we don't foresee a need to back port these changes. Timeout 06/03/2008. SUMMARY: This proposal is to provide several enhancements for setting NFSv4 ACLs and changing the owner and group ownership of files. Permission aliases will be added to allow a "set" of permissions to be specified. The sets to be provided are full_set, modify_set, read_set and write_set. Two special ACE types will be added to allow a user to specify a Windows SID in place of an ephemeral uid/gid. Both chown(1) and chgrp(1) will be enhanced to allow setting the owner and or group of files by SID rather than ephemeral id. PROBLEM: Users of the CIFS service often want to specify permissions on ZFS directories that map to the windows aliases. For completeness we should also allow a user to specify file owner ship via a SID and also allow ACEs to be specified by SID rather than uid/gid. PROPOSED SOLUTION: acl_totext() and acl_fromtext() will be enhanced to understand permission aliases and the special usersid and groupsid ACE types. The following special permissions aliases will be added full_set = all permissions modify_set = all permissions except write_acl and write_owner read_set = read_data, read_attributes, read_xattr and read_acl write_set = write_data, append_data, write_attributes, write_xattr usage example: chmod A+user:joe:full_set:allow chmod A+user:tom:modify_set:fd:allow chmod A+user:frank:read_set/write_set:allow usersid/groupsid ACE types. These are aliases for user and group, but instead of an id a windows SID is specified instead. usersid:S-1-5-4343545-34534-44354-23:rwxp:allow groupsid:S-1-5-438473-58347567-4848-55:rwx:allow The acl_fromtext() interface will use idmap to convert the SID string into an ephemeral id. The acl_totext() interface will introduce a new flag bit ACL_SID_FMT that will be used to instruct acl_totext() to use the usersid, or groupsid format when constructing textual ACLs when the "id" field is an ephemeral id and the flag parameter requests "sid" format. acl_totext(aclp, ACL_SID_FMT); Both chown(1) and chgrp(1) will have a -s option added to allow changing the owner/group by SID string. For example: chown -s S-1-5-4343545-34534-44354-23:S-1-5-438473-58347567-4848-55 file chgrp -s S-1-5-438473-58347567-4848-55 file All of the normal options to chown(1)/chgrp(1) will still apply, the -s argument simply tells the utility to treat the owner/group argument as a SID rather than a user or groupname. MANPAGE DIFFS chmod(1) 580a581 > usersid::[:inheritance flags]: 581a583,584 > Permissions for a specific user, but user is specified by SID > 585a589 > groupsid::[:inheritance flags]: 586a591 > Permissions for a specific group, but user is specified by SID 590a596,597 > > 703,704d709 < < 746a752,754 > Several special permission sets or aliases are also supported. > The following permission sets are used the same way that verbose > permissions are specified. 747a756 > full_set all permissions. 748a758,766 > modify_set all permissions except write_acl and write_owner. > > read_set read_data, read_acl, read_attributes, and > read_xattr > > write_set write_data, append_data, write_attributes, and > write_xattr > > acl_totext(3sec) 53a54,57 > ACL_SID_FMT For NFSv4 ACLs, the ACL entries for user or > group entries will use the usersid or groupsid > format when the "id" field in the ACL entry > is an ephemeral uid or gid. 55d58 < 104a108,109 > usersid This ACL entry with a SID specifies the SID of the user. > This type of entry is for a CIFS server created file. 108a114,115 > groupsid This ACL entry with a SID specifies the SID of the group. > This type of entry is for a CIFS server created file. chown(1) 13a14 > /usr/bin/chown -s [-fhR] ownersid[:groupsid] file... 16a18 > /usr/bin/chown -s -R [-f] [-H | -L | -P] ownersid[:groupsid] file... 20a23 > /usr/xpg4/bin/chown -s [-fhR] ownersid[:groupsid] file... 23a27 > /usr/xpg4/bin/chown -s -R [-f] [-H | -L | -P] ownersid[:groupsid] file... 105a110,112 > -s The owner and or group arguments are Windows SID strings. > This option requires a file system that supports storing SIDS, > such as ZFS. chgrp(1) 12a13 > chgrp -s [-fhR] groupsid file... 15a17 > chgrp -s -R [f] [-H | -L | -P] groupsid file... 88a91,92 > -s The specified group is a Windows SID. This option requires > a file system that supports storing SIDs, such as ZFS.. From Timothy.Haley@Sun.COM Tue May 27 13:45:11 2008 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m4RKjA95000706 for ; Tue, 27 May 2008 13:45:11 -0700 (PDT) Received: from brmea-mail-3.sun.com (brmea-mail-3.Sun.COM [192.18.98.34]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m4RKj9Iw005601 for ; Tue, 27 May 2008 21:45:09 +0100 (BST) Received: from fe-amer-10.sun.com ([192.18.109.80]) by brmea-mail-3.sun.com (8.13.6+Sun/8.12.9) with ESMTP id m4RKj8Ln010210 for ; Tue, 27 May 2008 20:45:08 GMT Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0K1J00301MNZ9J00@mail-amer.sun.com> (original mail from Timothy.Haley@Sun.COM) for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 27 May 2008 14:45:08 -0600 (MDT) Received: from [172.20.25.27] by mail-amer.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0K1J00D33OAG6Q50@mail-amer.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 27 May 2008 14:45:04 -0600 (MDT) Date: Tue, 27 May 2008 14:44:40 -0600 From: Tim Haley Subject: Further SID support [PSARC/2008/342 FastTrack timeout 06/03/2008] Sender: Timothy.Haley@Sun.COM To: PSARC-ext@Sun.COM Cc: Afshin Salek , Alan Wright , Mark Shellenbaum Message-id: <483C72B8.3090709@sun.com> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT User-Agent: Thunderbird 2.0.0.14 (X11/20080507) Status: RO Content-Length: 5403 I am sponsoring this fast-track for Mark Shellenbaum. Requested binding is minor, we don't foresee a need to back port these changes. Timeout 06/03/2008. SUMMARY: This proposal is to provide several enhancements for setting NFSv4 ACLs and changing the owner and group ownership of files. Permission aliases will be added to allow a "set" of permissions to be specified. The sets to be provided are full_set, modify_set, read_set and write_set. Two special ACE types will be added to allow a user to specify a Windows SID in place of an ephemeral uid/gid. Both chown(1) and chgrp(1) will be enhanced to allow setting the owner and or group of files by SID rather than ephemeral id. PROBLEM: Users of the CIFS service often want to specify permissions on ZFS directories that map to the windows aliases. For completeness we should also allow a user to specify file owner ship via a SID and also allow ACEs to be specified by SID rather than uid/gid. PROPOSED SOLUTION: acl_totext() and acl_fromtext() will be enhanced to understand permission aliases and the special usersid and groupsid ACE types. The following special permissions aliases will be added full_set = all permissions modify_set = all permissions except write_acl and write_owner read_set = read_data, read_attributes, read_xattr and read_acl write_set = write_data, append_data, write_attributes, write_xattr usage example: chmod A+user:joe:full_set:allow chmod A+user:tom:modify_set:fd:allow chmod A+user:frank:read_set/write_set:allow usersid/groupsid ACE types. These are aliases for user and group, but instead of an id a windows SID is specified instead. usersid:S-1-5-4343545-34534-44354-23:rwxp:allow groupsid:S-1-5-438473-58347567-4848-55:rwx:allow The acl_fromtext() interface will use idmap to convert the SID string into an ephemeral id. The acl_totext() interface will introduce a new flag bit ACL_SID_FMT that will be used to instruct acl_totext() to use the usersid, or groupsid format when constructing textual ACLs when the "id" field is an ephemeral id and the flag parameter requests "sid" format. acl_totext(aclp, ACL_SID_FMT); Both chown(1) and chgrp(1) will have a -s option added to allow changing the owner/group by SID string. For example: chown -s S-1-5-4343545-34534-44354-23:S-1-5-438473-58347567-4848-55 file chgrp -s S-1-5-438473-58347567-4848-55 file All of the normal options to chown(1)/chgrp(1) will still apply, the -s argument simply tells the utility to treat the owner/group argument as a SID rather than a user or groupname. MANPAGE DIFFS chmod(1) 580a581 > usersid::[:inheritance flags]: 581a583,584 > Permissions for a specific user, but user is specified by SID > 585a589 > groupsid::[:inheritance flags]: 586a591 > Permissions for a specific group, but user is specified by SID 590a596,597 > > 703,704d709 < < 746a752,754 > Several special permission sets or aliases are also supported. > The following permission sets are used the same way that verbose > permissions are specified. 747a756 > full_set all permissions. 748a758,766 > modify_set all permissions except write_acl and write_owner. > > read_set read_data, read_acl, read_attributes, and > read_xattr > > write_set write_data, append_data, write_attributes, and > write_xattr > > acl_totext(3sec) 53a54,57 > ACL_SID_FMT For NFSv4 ACLs, the ACL entries for user or > group entries will use the usersid or groupsid > format when the "id" field in the ACL entry > is an ephemeral uid or gid. 55d58 < 104a108,109 > usersid This ACL entry with a SID specifies the SID of the user. > This type of entry is for a CIFS server created file. 108a114,115 > groupsid This ACL entry with a SID specifies the SID of the group. > This type of entry is for a CIFS server created file. chown(1) 13a14 > /usr/bin/chown -s [-fhR] ownersid[:groupsid] file... 16a18 > /usr/bin/chown -s -R [-f] [-H | -L | -P] ownersid[:groupsid] file... 20a23 > /usr/xpg4/bin/chown -s [-fhR] ownersid[:groupsid] file... 23a27 > /usr/xpg4/bin/chown -s -R [-f] [-H | -L | -P] ownersid[:groupsid] file... 105a110,112 > -s The owner and or group arguments are Windows SID strings. > This option requires a file system that supports storing SIDS, > such as ZFS. chgrp(1) 12a13 > chgrp -s [-fhR] groupsid file... 15a17 > chgrp -s -R [f] [-H | -L | -P] groupsid file... 88a91,92 > -s The specified group is a Windows SID. This option requires > a file system that supports storing SIDs, such as ZFS.. From alan.coopersmith@sun.com Tue May 27 14:09:56 2008 Received: from sunmail2sca.sfbay.sun.com (sunmail2sca.SFBay.Sun.COM [129.145.155.234]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m4RL9uMX002271 for ; Tue, 27 May 2008 14:09:56 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail2sca.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id m4RL9tq6015880 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Tue, 27 May 2008 14:09:56 -0700 (PDT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K1J00607PGJ5C00@brm-avmta-1.central.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 27 May 2008 15:09:55 -0600 (MDT) Received: from sca-es-mail-2.sun.com ([192.18.43.133]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K1J00M0MPGJ4P40@brm-avmta-1.central.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 27 May 2008 15:09:55 -0600 (MDT) Received: from fe-sfbay-09.sun.com ([192.18.43.129]) by sca-es-mail-2.sun.com (8.13.7+Sun/8.12.9) with ESMTP id m4RL9t0x011642 for ; Tue, 27 May 2008 14:09:55 -0700 (PDT) Received: from conversion-daemon.fe-sfbay-09.sun.com by fe-sfbay-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0K1J00301MGP4900@fe-sfbay-09.sun.com> (original mail from Alan.Coopersmith@Sun.COM) for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 27 May 2008 14:09:55 -0700 (PDT) Received: from almas.sfbay.sun.com ([129.146.106.93]) by fe-sfbay-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0K1J00GYBPG2F440@fe-sfbay-09.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 27 May 2008 14:09:39 -0700 (PDT) Date: Tue, 27 May 2008 14:09:38 -0700 From: Alan Coopersmith Subject: Re: Further SID support [PSARC/2008/342 FastTrack timeout 06/03/2008] In-reply-to: <483C72B8.3090709@sun.com> Sender: alan.coopersmith@sun.com To: Tim Haley Cc: PSARC-ext@sun.com, Afshin Salek , Alan Wright , Mark Shellenbaum Message-id: <483C7892.5090309@sun.com> MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 X-Enigmail-Version: 0.95.1 References: <483C72B8.3090709@sun.com> User-Agent: Thunderbird 2.0.0.6 (X11/20071203) Status: RO Content-Length: 510 Will these changes be made to both the chmod & chown utilities in /usr/bin & /usr/gnu/bin ? (PSARC: do we need to add a best practice/policy that says that new functionality added to /usr/bin tools needs to also be added to /usr/gnu/bin equivalents if they exist to avoid causing problems for users with /usr/gnu/bin first in their $PATH, like the OpenSolaris 2008.05 default user setup?) -- -Alan Coopersmith- alan.coopersmith@sun.com Sun Microsystems, Inc. - X Window System Engineering From Mark.Shellenbaum@Sun.COM Tue May 27 14:11:13 2008 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m4RLBDAF002435 for ; Tue, 27 May 2008 14:11:13 -0700 (PDT) Received: from brmea-mail-2.sun.com (brmea-mail-2.Sun.COM [192.18.98.43]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id m4RLBDcs056233 for ; Tue, 27 May 2008 15:11:13 -0600 (MDT) Received: from fe-amer-10.sun.com ([192.18.109.80]) by brmea-mail-2.sun.com (8.13.6+Sun/8.12.9) with ESMTP id m4RLBDXX005165 for ; Tue, 27 May 2008 21:11:13 GMT Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0K1J00G01OJP6G00@mail-amer.sun.com> (original mail from Mark.Shellenbaum@Sun.COM) for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 27 May 2008 15:11:13 -0600 (MDT) Received: from [172.20.25.34] by mail-amer.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0K1J00DRZPIC6QC0@mail-amer.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 27 May 2008 15:11:01 -0600 (MDT) Date: Tue, 27 May 2008 15:09:42 -0600 From: Mark Shellenbaum Subject: Re: Further SID support [PSARC/2008/342 FastTrack timeout 06/03/2008] In-reply-to: <483C7892.5090309@sun.com> Sender: Mark.Shellenbaum@Sun.COM To: Alan Coopersmith Cc: Tim Haley , PSARC-ext@Sun.COM, Afshin Salek , Alan Wright Message-id: <483C7896.1000604@Sun.COM> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT References: <483C72B8.3090709@sun.com> <483C7892.5090309@sun.com> User-Agent: Thunderbird 2.0.0.12 (X11/20080422) Status: RO Content-Length: 156 Alan Coopersmith wrote: > Will these changes be made to both the chmod & chown utilities > in /usr/bin & /usr/gnu/bin ? > No, just the ones in /usr/bin From Nicolas.Williams@sun.com Tue May 27 14:16:50 2008 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m4RLGnSl002650 for ; Tue, 27 May 2008 14:16:49 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id m4RLGg2a004322; Wed, 28 May 2008 05:16:43 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K1J00M03PRU8R00@nwk-avmta-2.sfbay.sun.com>; Tue, 27 May 2008 14:16:42 -0700 (PDT) Received: from binky.Central.Sun.COM ([129.153.128.104]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K1J008HWPRTJI50@nwk-avmta-2.sfbay.sun.com>; Tue, 27 May 2008 14:16:41 -0700 (PDT) Received: from binky.Central.Sun.COM (localhost [127.0.0.1]) by binky.Central.Sun.COM (8.14.1+Sun/8.14.1) with ESMTP id m4RLGbuG001621; Tue, 27 May 2008 16:16:37 -0500 (CDT) Received: (from nw141292@localhost) by binky.Central.Sun.COM (8.14.1+Sun/8.14.1/Submit) id m4RLGbN2001620; Tue, 27 May 2008 16:16:37 -0500 (CDT) Date: Tue, 27 May 2008 16:16:37 -0500 From: Nicolas Williams Subject: Re: Further SID support [PSARC/2008/342 FastTrack timeout 06/03/2008] In-reply-to: <483C72B8.3090709@sun.com> To: Tim Haley Cc: PSARC-ext@sun.com, Afshin Salek , Alan Wright , Mark Shellenbaum Mail-followup-to: Tim Haley , PSARC-ext@Sun.COM, Afshin Salek , Alan Wright , Mark Shellenbaum Message-id: <20080527211637.GE1039@Sun.COM> MIME-version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-disposition: inline X-PMX-Version: 5.4.1.325704 References: <483C72B8.3090709@sun.com> X-Authentication-warning: binky.Central.Sun.COM: nw141292 set sender to Nicolas.Williams@sun.com using -f User-Agent: Mutt/1.5.7i Status: RO Content-Length: 1970 On Tue, May 27, 2008 at 02:44:40PM -0600, Tim Haley wrote: > usersid/groupsid ACE types. These are aliases for user and group, > but instead of an id a windows SID is specified instead. > > usersid:S-1-5-4343545-34534-44354-23:rwxp:allow > groupsid:S-1-5-438473-58347567-4848-55:rwx:allow > > The acl_fromtext() interface will use idmap to convert the SID > string into an ephemeral id. You can also use idmap interfaces to perform name-to-SID lookup + ID mapping. So you could allow "usersid:foo@domain:rwxp:allow"... Do, please, make sure that there's a way to distinguish between Unix user/group names and Windows user/group names. In the future we'll be adding an nss_ad module that will make the two namespaces equal, but it isn't necessarily the case that the customer will configure their system to use nss_ad, thus the need for distinguishing between namespaces. > The acl_totext() interface will introduce a new flag bit > ACL_SID_FMT that will be used to instruct acl_totext() to use > the usersid, or groupsid format when constructing textual > ACLs when the "id" field is an ephemeral id and the flag > parameter requests "sid" format. I think we'll need a flag to request the use of Windows names vs. plain SIDs. See above. > acl_totext(aclp, ACL_SID_FMT); > > Both chown(1) and chgrp(1) will have a -s option added to allow > changing the owner/group by SID string. > > For example: > > chown -s S-1-5-4343545-34534-44354-23:S-1-5-438473-58347567-4848-55 > file > chgrp -s S-1-5-438473-58347567-4848-55 file > > All of the normal options to chown(1)/chgrp(1) will still > apply, the -s argument simply tells the utility to treat the > owner/group argument as a SID rather than a user or > groupname. My comments re: chmod apply here as well. Nico -- From David.Comay@Sun.COM Tue May 27 14:16:58 2008 Received: from sunmail3mpk.sfbay.sun.com (sunmail3mpk.SFBay.Sun.COM [129.146.11.52]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m4RLGwsP002662 for ; Tue, 27 May 2008 14:16:58 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail3mpk.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id m4RLGvHq022505; Tue, 27 May 2008 14:16:57 -0700 (PDT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K1J00601PS9RI00@brm-avmta-1.central.sun.com>; Tue, 27 May 2008 15:16:57 -0600 (MDT) Received: from izimbra.SFBay.Sun.COM ([129.146.226.141]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K1J00MG9PS84S50@brm-avmta-1.central.sun.com>; Tue, 27 May 2008 15:16:56 -0600 (MDT) Received: from localhost (localhost [127.0.0.1]) by izimbra.SFBay.Sun.COM (8.14.3+Sun/8.14.3) with ESMTP id m4RLGuZY001328; Tue, 27 May 2008 14:16:56 -0700 (PDT) Date: Tue, 27 May 2008 14:16:56 -0700 (PDT) From: David.Comay@Sun.COM Subject: Re: Further SID support [PSARC/2008/342 FastTrack timeout 06/03/2008] In-reply-to: <483C7892.5090309@sun.com> Sender: comay@izimbra.SFBay.Sun.COM To: Alan Coopersmith Cc: Tim Haley , Alan Wright , PSARC-ext@Sun.COM, Afshin Salek , Mark Shellenbaum Message-id: MIME-version: 1.0 Content-type: TEXT/PLAIN; charset=US-ASCII; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <483C72B8.3090709@sun.com> <483C7892.5090309@sun.com> Status: RO Content-Length: 803 > (PSARC: do we need to add a best practice/policy that says that > new functionality added to /usr/bin tools needs to also be added > to /usr/gnu/bin equivalents if they exist to avoid causing > problems for users with /usr/gnu/bin first in their $PATH, > like the OpenSolaris 2008.05 default user setup?) Longer term, it's not clear what the disposition will be of these tools in the OpenSolaris 2008.05 binary product. It's possible that instead of leveraging /usr/gnu/bin being at the front of the PATH, the GNU features will be made to the "classic" utilities. Or perhaps, the changes will occur the other way around. I think it's ultimately the Indiana project team that will need to propose policy in this area although I suspect the resolution may differ on a utility-by-utility basis. dsc From Nicolas.Williams@sun.com Tue May 27 14:24:46 2008 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m4RLOkB6003093 for ; Tue, 27 May 2008 14:24:46 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id m4RLOi4v061855; Tue, 27 May 2008 15:24:44 -0600 (MDT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K1J00701Q58F200@brm-avmta-1.central.sun.com>; Tue, 27 May 2008 15:24:44 -0600 (MDT) Received: from binky.Central.Sun.COM ([129.153.128.104]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K1J00M8AQ574P50@brm-avmta-1.central.sun.com>; Tue, 27 May 2008 15:24:43 -0600 (MDT) Received: from binky.Central.Sun.COM (localhost [127.0.0.1]) by binky.Central.Sun.COM (8.14.1+Sun/8.14.1) with ESMTP id m4RLOhEl001628; Tue, 27 May 2008 16:24:43 -0500 (CDT) Received: (from nw141292@localhost) by binky.Central.Sun.COM (8.14.1+Sun/8.14.1/Submit) id m4RLOhTN001627; Tue, 27 May 2008 16:24:43 -0500 (CDT) Date: Tue, 27 May 2008 16:24:43 -0500 From: Nicolas Williams Subject: Re: Further SID support [PSARC/2008/342 FastTrack timeout 06/03/2008] In-reply-to: To: David.Comay@sun.com Cc: Alan Coopersmith , Tim Haley , Alan Wright , PSARC-ext@sun.com, Afshin Salek , Mark Shellenbaum Mail-followup-to: David.Comay@Sun.COM, Alan Coopersmith , Tim Haley , Alan Wright , PSARC-ext@sun.com, Afshin Salek , Mark Shellenbaum Message-id: <20080527212443.GF1039@Sun.COM> MIME-version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-disposition: inline X-PMX-Version: 5.4.1.325704 References: <483C72B8.3090709@sun.com> <483C7892.5090309@sun.com> X-Authentication-warning: binky.Central.Sun.COM: nw141292 set sender to Nicolas.Williams@sun.com using -f User-Agent: Mutt/1.5.7i Status: RO Content-Length: 1090 On Tue, May 27, 2008 at 02:16:56PM -0700, David.Comay@Sun.COM wrote: > >(PSARC: do we need to add a best practice/policy that says that > >new functionality added to /usr/bin tools needs to also be added > >to /usr/gnu/bin equivalents if they exist to avoid causing > >problems for users with /usr/gnu/bin first in their $PATH, > >like the OpenSolaris 2008.05 default user setup?) > > Longer term, it's not clear what the disposition will be of these tools > in the OpenSolaris 2008.05 binary product. It's possible that instead > of leveraging /usr/gnu/bin being at the front of the PATH, the GNU > features will be made to the "classic" utilities. Or perhaps, the > changes will occur the other way around. I think it's ultimately the > Indiana project team that will need to propose policy in this area > although I suspect the resolution may differ on a utility-by-utility > basis. I think too that it will help to promote SID-aware getXbyY functions that could be standardized. We plan to work on those, eventually, but perhaps our priority for those should be higher? Nico -- From Andrew.Gabriel@sun.com Tue May 27 14:53:16 2008 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m4RLrGvw004017 for ; Tue, 27 May 2008 14:53:16 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id m4RLrDQ6004059 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Tue, 27 May 2008 15:53:15 -0600 (MDT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K1J0090BRGRQK00@brm-avmta-1.central.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@Sun.COM); Tue, 27 May 2008 15:53:15 -0600 (MDT) Received: from gmp-eb-inf-2.sun.com ([192.18.6.24]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K1J00M0KRGQ4SB0@brm-avmta-1.central.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@Sun.COM); Tue, 27 May 2008 15:53:14 -0600 (MDT) Received: from fe-emea-10.sun.com (gmp-eb-lb-2-fe1.eu.sun.com [192.18.6.10]) by gmp-eb-inf-2.sun.com (8.13.7+Sun/8.12.9) with ESMTP id m4RLrDvS015834 for ; Tue, 27 May 2008 21:53:13 +0000 (GMT) Received: from conversion-daemon.fe-emea-10.sun.com by fe-emea-10.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0K1J00A01RBL6K00@fe-emea-10.sun.com> (original mail from Andrew.Gabriel@Sun.COM) for PSARC-ext@Sun.COM (ORCPT PSARC-ext@Sun.COM); Tue, 27 May 2008 22:53:13 +0100 (BST) Received: from [192.9.200.17] ([81.187.162.106]) by fe-emea-10.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0K1J009ZURGPF090@fe-emea-10.sun.com> for PSARC-ext@Sun.COM (ORCPT PSARC-ext@Sun.COM); Tue, 27 May 2008 22:53:13 +0100 (BST) Date: Tue, 27 May 2008 22:54:01 +0100 From: Andrew Gabriel Subject: Re: Further SID support [PSARC/2008/342 FastTrack timeout 06/03/2008] In-reply-to: <483C7892.5090309@sun.com> Sender: Andrew.Gabriel@sun.com To: Alan Coopersmith Cc: Tim Haley , PSARC-ext@sun.com, Afshin Salek , Alan Wright , Mark Shellenbaum Message-id: <483C82F9.4090900@sun.com> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <483C72B8.3090709@sun.com> <483C7892.5090309@sun.com> User-Agent: Thunderbird 2.0.0.12 (X11/20080422) Status: RO Content-Length: 711 Alan Coopersmith wrote: > Will these changes be made to both the chmod & chown utilities > in /usr/bin & /usr/gnu/bin ? > > (PSARC: do we need to add a best practice/policy that says that > new functionality added to /usr/bin tools needs to also be added > to /usr/gnu/bin equivalents if they exist to avoid causing > problems for users with /usr/gnu/bin first in their $PATH, > like the OpenSolaris 2008.05 default user setup?) That seems to me like a bad idea, as they won't be gnu any more. If it's felt desirable to have the changes in the gnu toolchain, then the team should be persuaded to get them accepted upstream, and then update the gnu tools in /usr/gnu/bin when that's been done. -- Andrew From gww@sac.sfbay.sun.com Tue May 27 15:52:31 2008 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m4RMqULe006227 for ; Tue, 27 May 2008 15:52:30 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m4RMqPnm003262 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@Sun.COM>; Tue, 27 May 2008 23:52:29 +0100 (BST) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K1J00E03U7EIZ00@brm-avmta-1.central.sun.com> for PSARC-ext@Sun.COM (ORCPT PSARC-ext@Sun.COM); Tue, 27 May 2008 16:52:26 -0600 (MDT) Received: from dm-sfbay-02.sfbay.sun.com ([129.146.11.31]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K1J00B67U7DU530@brm-avmta-1.central.sun.com> for PSARC-ext@Sun.COM (ORCPT PSARC-ext@Sun.COM); Tue, 27 May 2008 16:52:25 -0600 (MDT) Received: from sac.sfbay.sun.com (new-sac.SFBay.Sun.COM [129.146.175.65]) by dm-sfbay-02.sfbay.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m4RMqOHL055430; Tue, 27 May 2008 15:52:24 -0700 (PDT) Received: from sac.sfbay.sun.com (localhost [127.0.0.1]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m4RMqOJE006225; Tue, 27 May 2008 15:52:24 -0700 (PDT) Received: (from gww@localhost) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8/Submit) id m4RMqOfb006224; Tue, 27 May 2008 15:52:24 -0700 (PDT) Date: Tue, 27 May 2008 15:52:24 -0700 (PDT) From: Gary Winiger Subject: Re: Further SID support [PSARC/2008/342 FastTrack timeout 06/03/2008] To: PSARC-ext@sun.com, Timothy.Haley@sun.com Cc: Afshin.Ardakani@sun.com, Alan.M.Wright@sun.com, Mark.Shellenbaum@sun.com Message-id: <200805272252.m4RMqOfb006224@sac.sfbay.sun.com> Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 Status: RO Content-Length: 565 > Two special ACE types will be added to allow a user to specify a > Windows SID in place of an ephemeral uid/gid. > > Both chown(1) and chgrp(1) will be enhanced to allow setting the > owner and or group of files by SID rather than ephemeral id. How will this affect audit of chown(2), acl(2)? In particular when the audit trail file is processed on another system, or after a reboot? Will ephermeral uid's be stored in the audit trail file? How will praudit(1M), auditreduce(1M) be changed by this project? Gary.. From Mark.Shellenbaum@sun.com Tue May 27 15:57:06 2008 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m4RMv5q1006636 for ; Tue, 27 May 2008 15:57:05 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id m4RMv1OC015442 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Wed, 28 May 2008 06:57:04 +0800 (SGT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K1J00E0VUF2WU00@brm-avmta-1.central.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@Sun.COM); Tue, 27 May 2008 16:57:02 -0600 (MDT) Received: from brmea-mail-1.sun.com ([192.18.98.31]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K1J00B3VUF2U150@brm-avmta-1.central.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@Sun.COM); Tue, 27 May 2008 16:57:02 -0600 (MDT) Received: from fe-amer-10.sun.com ([192.18.109.80]) by brmea-mail-1.sun.com (8.13.6+Sun/8.12.9) with ESMTP id m4RMv2fI012908 for ; Tue, 27 May 2008 22:57:02 +0000 (GMT) Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0K1J00901U86WV00@mail-amer.sun.com> (original mail from Mark.Shellenbaum@Sun.COM) for PSARC-ext@Sun.COM (ORCPT PSARC-ext@Sun.COM); Tue, 27 May 2008 16:57:02 -0600 (MDT) Received: from [172.20.25.34] by mail-amer.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0K1J00CC2UF1D980@mail-amer.sun.com>; Tue, 27 May 2008 16:57:01 -0600 (MDT) Date: Tue, 27 May 2008 16:55:43 -0600 From: Mark Shellenbaum Subject: Re: Further SID support [PSARC/2008/342 FastTrack timeout 06/03/2008] In-reply-to: <200805272252.m4RMqOfb006224@sac.sfbay.sun.com> Sender: Mark.Shellenbaum@sun.com To: Gary Winiger Cc: PSARC-ext@sun.com, Timothy.Haley@sun.com, Afshin.Ardakani@sun.com, Alan.M.Wright@sun.com Message-id: <483C916F.9070505@Sun.COM> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200805272252.m4RMqOfb006224@sac.sfbay.sun.com> User-Agent: Thunderbird 2.0.0.12 (X11/20080422) Status: RO Content-Length: 771 Gary Winiger wrote: >> Two special ACE types will be added to allow a user to specify a >> Windows SID in place of an ephemeral uid/gid. >> >> Both chown(1) and chgrp(1) will be enhanced to allow setting the >> owner and or group of files by SID rather than ephemeral id. > > How will this affect audit of chown(2), acl(2)? In particular when > the audit trail file is processed on another system, or after a > reboot? Will ephermeral uid's be stored in the audit trail file? > How will praudit(1M), auditreduce(1M) be changed by this project? > > Gary.. This change doesn't change any syscalls. All it does is allow a user to specify SIDs and then uses the idmap(1M) API to convert those to ephemeral IDs. -Mark From gww@eng.sun.com Tue May 27 17:08:27 2008 Received: from sunmail3mpk.sfbay.sun.com (sunmail3mpk.SFBay.Sun.COM [129.146.11.52]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m4S08R2I009630 for ; Tue, 27 May 2008 17:08:27 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail3mpk.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id m4S08Obv028135 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Tue, 27 May 2008 17:08:27 -0700 (PDT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K1J00717XQ33V00@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 27 May 2008 17:08:27 -0700 (PDT) Received: from dm-eng-02.sfbay.sun.com ([129.146.11.32]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K1J00IEFXQ2SBE0@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 27 May 2008 17:08:26 -0700 (PDT) Received: from marduk.eng.sun.com (marduk.SFBay.Sun.COM [129.146.108.224]) by dm-eng-02.sfbay.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m4S08Ppr029829; Tue, 27 May 2008 17:08:25 -0700 (PDT) Received: from marduk.eng.sun.com (localhost [127.0.0.1]) by marduk.eng.sun.com (8.13.6+Sun/8.12.11) with ESMTP id m4S094gw006116; Tue, 27 May 2008 17:09:04 -0700 (PDT) Received: (from gww@localhost) by marduk.eng.sun.com (8.13.6+Sun/8.12.11/Submit) id m4S094bo006115; Tue, 27 May 2008 17:09:04 -0700 (PDT) Date: Tue, 27 May 2008 17:09:04 -0700 (PDT) From: Gary Winiger Subject: Re: Further SID support [PSARC/2008/342 FastTrack timeout 06/03/2008] To: gww@sac.sfbay.sun.com, Mark.Shellenbaum@sun.com Cc: PSARC-ext@sun.com, Timothy.Haley@sun.com, Afshin.Ardakani@sun.com, Alan.M.Wright@sun.com Message-id: <200805280009.m4S094bo006115@marduk.eng.sun.com> Content-transfer-encoding: 7BIT X-Sun-Charset: US-ASCII X-PMX-Version: 5.4.1.325704 Status: RO Content-Length: 1033 > > How will this affect audit of chown(2), acl(2)? In particular when > > the audit trail file is processed on another system, or after a > > reboot? Will ephermeral uid's be stored in the audit trail file? > > How will praudit(1M), auditreduce(1M) be changed by this project? > > > > Gary.. > > This change doesn't change any syscalls. All it does is allow a user to > specify SIDs and then uses the idmap(1M) API to convert those to > ephemeral IDs. Right and doesn't it store ephemeral IDs in the audit trail file? IIRC, ephemeral IDs were never supposed to survive reboots or be transfered to other systems. Audit trail files can be moved from the machine on which they were created; they can be processed after the system has been rebooted. How are ephemeral IDs processed in those environments? That is, "How will praudit(1M), auditreduce(1M) be changed by this project?" praudit translates user/group IDs to user/group names. auditreduce selects files based on fileowner and or filegroup. Gary.. From Mark.Shellenbaum@sun.com Tue May 27 17:13:47 2008 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m4S0DkIF009907 for ; Tue, 27 May 2008 17:13:47 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id m4S0DjUv013940 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Wed, 28 May 2008 08:13:46 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K1J0070BXYTQO00@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 27 May 2008 17:13:41 -0700 (PDT) Received: from brmea-mail-3.sun.com ([192.18.98.34]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K1J00I16XYSSDF0@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 27 May 2008 17:13:40 -0700 (PDT) Received: from fe-amer-09.sun.com ([192.18.109.79]) by brmea-mail-3.sun.com (8.13.6+Sun/8.12.9) with ESMTP id m4S0Dd5M016486 for ; Wed, 28 May 2008 00:13:39 +0000 (GMT) Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0K1J00701XV7Z600@mail-amer.sun.com> (original mail from Mark.Shellenbaum@Sun.COM) for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 27 May 2008 18:13:39 -0600 (MDT) Received: from mark-shellenbaums-computer.local ([24.9.106.99]) by mail-amer.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0K1J008Z0XYQEZF0@mail-amer.sun.com>; Tue, 27 May 2008 18:13:39 -0600 (MDT) Date: Tue, 27 May 2008 18:13:34 -0600 From: Mark Shellenbaum Subject: Re: Further SID support [PSARC/2008/342 FastTrack timeout 06/03/2008] In-reply-to: <200805280009.m4S094bo006115@marduk.eng.sun.com> Sender: Mark.Shellenbaum@sun.com To: Gary Winiger Cc: gww@sac.sfbay.sun.com, PSARC-ext@sun.com, Timothy.Haley@sun.com, Afshin.Ardakani@sun.com, Alan.M.Wright@sun.com Message-id: <483CA3AE.7080509@Sun.COM> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200805280009.m4S094bo006115@marduk.eng.sun.com> User-Agent: Thunderbird 2.0.0.14 (Macintosh/20080421) Status: RO Content-Length: 1295 Gary Winiger wrote: >>> How will this affect audit of chown(2), acl(2)? In particular when >>> the audit trail file is processed on another system, or after a >>> reboot? Will ephermeral uid's be stored in the audit trail file? >>> How will praudit(1M), auditreduce(1M) be changed by this project? >>> >>> Gary.. >> This change doesn't change any syscalls. All it does is allow a user to >> specify SIDs and then uses the idmap(1M) API to convert those to >> ephemeral IDs. > > Right and doesn't it store ephemeral IDs in the audit trail file? > IIRC, ephemeral IDs were never supposed to survive reboots or > be transfered to other systems. Audit trail files can be moved > from the machine on which they were created; they can be processed > after the system has been rebooted. How are ephemeral IDs processed in > those environments? That is, "How will praudit(1M), auditreduce(1M) > be changed by this project?" praudit translates user/group IDs to > user/group names. auditreduce selects files based on fileowner > and or filegroup. > > Gary.. It probably does store ephemeral IDs in audit trails today. That sounds like a bug that has been then since PSARC 2007/064 Unified POSIX and Windows Credentials for Solaris added support for ephemeral IDs. -Mark From Mark.Shellenbaum@sun.com Tue May 27 17:50:19 2008 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m4S0oINQ010939 for ; Tue, 27 May 2008 17:50:19 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m4S0oEx7015321 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Wed, 28 May 2008 01:50:17 +0100 (BST) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K1J00001ZNTOQ00@brm-avmta-1.central.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 27 May 2008 18:50:17 -0600 (MDT) Received: from brmea-mail-3.sun.com ([192.18.98.34]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K1J0008ZZNTAR10@brm-avmta-1.central.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 27 May 2008 18:50:17 -0600 (MDT) Received: from fe-amer-10.sun.com ([192.18.109.80]) by brmea-mail-3.sun.com (8.13.6+Sun/8.12.9) with ESMTP id m4S0oGvQ024975 for ; Wed, 28 May 2008 00:50:16 +0000 (GMT) Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0K1J00801ZIWUT00@mail-amer.sun.com> (original mail from Mark.Shellenbaum@Sun.COM) for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 27 May 2008 18:50:16 -0600 (MDT) Received: from mark-shellenbaums-computer.local ([129.150.32.214]) by mail-amer.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0K1J002M7ZNRGC10@mail-amer.sun.com>; Tue, 27 May 2008 18:50:16 -0600 (MDT) Date: Tue, 27 May 2008 18:50:14 -0600 From: Mark Shellenbaum Subject: Re: Further SID support [PSARC/2008/342 FastTrack timeout 06/03/2008] In-reply-to: <483CA3AE.7080509@Sun.COM> Sender: Mark.Shellenbaum@sun.com To: Gary Winiger Cc: PSARC-ext@sun.com, Timothy.Haley@sun.com, Afshin.Ardakani@sun.com, Alan.M.Wright@sun.com Message-id: <483CAC46.1090507@Sun.COM> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200805280009.m4S094bo006115@marduk.eng.sun.com> <483CA3AE.7080509@Sun.COM> User-Agent: Thunderbird 2.0.0.14 (Macintosh/20080421) Status: RO Content-Length: 1489 Mark Shellenbaum wrote: > Gary Winiger wrote: >>>> How will this affect audit of chown(2), acl(2)? In particular when >>>> the audit trail file is processed on another system, or after a >>>> reboot? Will ephermeral uid's be stored in the audit trail file? >>>> How will praudit(1M), auditreduce(1M) be changed by this project? >>>> >>>> Gary.. >>> This change doesn't change any syscalls. All it does is allow a user >>> to specify SIDs and then uses the idmap(1M) API to convert those to >>> ephemeral IDs. >> >> Right and doesn't it store ephemeral IDs in the audit trail file? >> IIRC, ephemeral IDs were never supposed to survive reboots or >> be transfered to other systems. Audit trail files can be moved >> from the machine on which they were created; they can be processed >> after the system has been rebooted. How are ephemeral IDs >> processed in >> those environments? That is, "How will praudit(1M), auditreduce(1M) >> be changed by this project?" praudit translates user/group IDs to >> user/group names. auditreduce selects files based on fileowner >> and or filegroup. >> >> Gary.. > > It probably does store ephemeral IDs in audit trails today. That sounds > like a bug that has been then since > > PSARC 2007/064 Unified POSIX and Windows Credentials for Solaris > > added support for ephemeral IDs. > > -Mark > I will run a test and see what currently gets audited with ephemeral IDs. -Mark From Joerg.Schilling@fokus.fraunhofer.de Wed May 28 02:59:38 2008 Received: from sunmail3mpk.sfbay.sun.com (sunmail3mpk.SFBay.Sun.COM [129.146.11.52]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m4S9xcso024966 for ; Wed, 28 May 2008 02:59:38 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail3mpk.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id m4S9xbu8013416; Wed, 28 May 2008 02:59:37 -0700 (PDT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K1K00M01P3CDK00@brm-avmta-1.central.sun.com>; Wed, 28 May 2008 03:59:36 -0600 (MDT) Received: from sca-ea-mail-4.sun.com ([192.18.43.22]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K1K00JQCP3CBU20@brm-avmta-1.central.sun.com>; Wed, 28 May 2008 03:59:36 -0600 (MDT) Received: from relay21.sun.com (relay21.sun.com [192.12.251.24] (may be forged)) by sca-ea-mail-4.sun.com (8.13.6+Sun/8.12.9) with ESMTP id m4S9uNWx015148; Wed, 28 May 2008 09:59:35 +0000 (GMT) Received: from mms24es.mms.us.syntegra.com ([150.143.232.70] [150.143.232.70]) by relay21i.sun.com with ESMTP id BT-MMP-904035; Wed, 28 May 2008 09:59:35 +0000 (Z) Received: from relay22.sun.com (relay22.sun.com [192.12.251.34]) by mms24es.mms.us.syntegra.com with ESMTP id BT-MMP-796601; Wed, 28 May 2008 09:59:34 +0000 (Z) Received: from mailgw1.fraunhofer.de ([153.96.1.17] [153.96.1.17]) by relay22i.sun.com with ESMTP id BT-MMP-831984; Wed, 28 May 2008 09:59:34 +0000 (Z) Received: from mailgw1.fraunhofer.de (localhost [127.0.0.1]) by mailgw1.fraunhofer.de[host mailgw27] (8.14.2+/8.14.2) with ESMTP id m4S9qD8V019363; Wed, 28 May 2008 11:52:13 +0200 (CEST) Received: from pluto.fokus.fraunhofer.de (pluto.fokus.fraunhofer.de [195.37.77.164]) by mailgw1.fraunhofer.de (8.14.2+/8.14.2) with ESMTP id m4S9qCbl019339 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Wed, 28 May 2008 11:52:12 +0200 (CEST) Received: from EXCHSRV.fokus.fraunhofer.de (bohr [10.147.9.231]) by pluto.fokus.fraunhofer.de (8.13.7/8.13.7) with SMTP id m4S9qCCG012794; Wed, 28 May 2008 11:52:12 +0200 (MEST) Received: from rigel ([10.147.65.195]) by EXCHSRV.fokus.fraunhofer.de with Microsoft SMTPSVC(6.0.3790.3959); Wed, 28 May 2008 11:52:12 +0200 Date: Wed, 28 May 2008 11:52:12 +0200 From: Joerg.Schilling@fokus.fraunhofer.de (Joerg Schilling) Subject: Re: Further SID support [PSARC/2008/342 FastTrack timeout 06/03/2008] In-reply-to: <20080527212443.GF1039@Sun.COM> To: Nicolas.Williams@sun.com, David.Comay@sun.com Cc: Timothy.Haley@sun.com, PSARC-ext@sun.com, Mark.Shellenbaum@sun.com, Alan.M.Wright@sun.com, Alan.Coopersmith@sun.com, Afshin.Ardakani@sun.com Message-id: <483d2b4c.DUgncGA0cyRcBcs4%Joerg.Schilling@fokus.fraunhofer.de> MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1 Content-transfer-encoding: 8BIT X-PMX-Version: 5.4.1.325704 X-Brightmail-Tracker: AAAAAA== X-Fraunhofer-Email-Policy: accepted X-Antispam: No, score=0.0/5.0, scanned in 0.243sec at (localhost [127.0.0.1]) by smf-spamd v1.3.1 - http://smfs.sf.net/ References: <483C72B8.3090709@sun.com> <483C7892.5090309@sun.com> <20080527212443.GF1039@Sun.COM> User-Agent: nail 11.22 3/20/05 X-OriginalArrivalTime: 28 May 2008 09:52:12.0973 (UTC) FILETIME=[80E725D0:01C8C0A8] Status: RO Content-Length: 778 Nicolas Williams wrote: > I think too that it will help to promote SID-aware getXbyY functions > that could be standardized. We plan to work on those, eventually, but > perhaps our priority for those should be higher? I would be interested to know what happens if e.g. star tried to archive files with such UID's. What will getpwuid(uid) return? Will strlen(pw->pw_name) > 32? What happens if someone unpacks such an archive on another machine? Jörg -- EMail:joerg@schily.isdn.cs.tu-berlin.de (home) Jörg Schilling D-13353 Berlin js@cs.tu-berlin.de (uni) schilling@fokus.fraunhofer.de (work) Blog: http://schily.blogspot.com/ URL: http://cdrecord.berlios.de/old/private/ ftp://ftp.berlios.de/pub/schily From Joerg.Schilling@fokus.fraunhofer.de Wed May 28 03:03:37 2008 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m4SA3asF025171 for ; Wed, 28 May 2008 03:03:36 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id m4SA3ONE018716; Wed, 28 May 2008 18:03:28 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K1K00D01P9R8V00@nwk-avmta-2.sfbay.sun.com>; Wed, 28 May 2008 03:03:27 -0700 (PDT) Received: from brmea-mail-2.sun.com ([192.18.98.43]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K1K00CV0P9QH500@nwk-avmta-2.sfbay.sun.com>; Wed, 28 May 2008 03:03:27 -0700 (PDT) Received: from relay23.sun.com (relay23.sun.com [192.12.251.54] (may be forged)) by brmea-mail-2.sun.com (8.13.6+Sun/8.12.9) with ESMTP id m4SA3QLY002609; Wed, 28 May 2008 10:03:26 +0000 (GMT) Received: from mms22es.mms.us.syntegra.com ([150.143.232.30] [150.143.232.30]) by relay23i.sun.com with ESMTP id BT-MMP-30062; Wed, 28 May 2008 10:03:26 +0000 (Z) Received: from relay21.sun.com (relay21.sun.com [192.12.251.24]) by mms22es.mms.us.syntegra.com with ESMTP id BT-MMP-800587; Wed, 28 May 2008 10:00:56 +0000 (Z) Received: from mailgw1.fraunhofer.de ([153.96.1.17] [153.96.1.17]) by relay21i.sun.com with ESMTP id BT-MMP-837631; Wed, 28 May 2008 10:00:56 +0000 (Z) Received: from mailgw1.fraunhofer.de (localhost [127.0.0.1]) by mailgw1.fraunhofer.de[host mailgw27] (8.14.2+/8.14.2) with ESMTP id m4S9sFl9020604; Wed, 28 May 2008 11:54:15 +0200 (CEST) Received: from pluto.fokus.fraunhofer.de (pluto.fokus.fraunhofer.de [195.37.77.164]) by mailgw1.fraunhofer.de (8.14.2+/8.14.2) with ESMTP id m4S9sFaV020590 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Wed, 28 May 2008 11:54:15 +0200 (CEST) Received: from EXCHSRV.fokus.fraunhofer.de (bohr [10.147.9.231]) by pluto.fokus.fraunhofer.de (8.13.7/8.13.7) with SMTP id m4S9sFmx012930; Wed, 28 May 2008 11:54:15 +0200 (MEST) Received: from rigel ([10.147.65.195]) by EXCHSRV.fokus.fraunhofer.de with Microsoft SMTPSVC(6.0.3790.3959); Wed, 28 May 2008 11:54:15 +0200 Date: Wed, 28 May 2008 11:54:15 +0200 From: Joerg.Schilling@fokus.fraunhofer.de (Joerg Schilling) Subject: Re: Further SID support [PSARC/2008/342 FastTrack timeout 06/03/2008] In-reply-to: <483C82F9.4090900@sun.com> To: Andrew.Gabriel@sun.com, Alan.Coopersmith@sun.com Cc: Timothy.Haley@sun.com, PSARC-ext@sun.com, Mark.Shellenbaum@sun.com, Alan.M.Wright@sun.com, Afshin.Ardakani@sun.com Message-id: <483d2bc7.NarKPuw8PVxPzbI0%Joerg.Schilling@fokus.fraunhofer.de> MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1 Content-transfer-encoding: 8BIT X-PMX-Version: 5.4.1.325704 X-Brightmail-Tracker: AAAAAA== X-Fraunhofer-Email-Policy: accepted X-Antispam: No, score=0.0/5.0, scanned in 0.067sec at (localhost [127.0.0.1]) by smf-spamd v1.3.1 - http://smfs.sf.net/ References: <483C72B8.3090709@sun.com> <483C7892.5090309@sun.com> <483C82F9.4090900@sun.com> User-Agent: nail 11.22 3/20/05 X-OriginalArrivalTime: 28 May 2008 09:54:15.0617 (UTC) FILETIME=[CA012310:01C8C0A8] Status: RO Content-Length: 834 Andrew Gabriel wrote: > That seems to me like a bad idea, as they won't be gnu any more. > If it's felt desirable to have the changes in the gnu toolchain, > then the team should be persuaded to get them accepted upstream, > and then update the gnu tools in /usr/gnu/bin when that's been > done. In contrary to e.g. star, gtar does not implement a single Linux specific feature. I would asume that there is low probability that someone will be able to convince the authors to add Solaris specific features. Jörg -- EMail:joerg@schily.isdn.cs.tu-berlin.de (home) Jörg Schilling D-13353 Berlin js@cs.tu-berlin.de (uni) schilling@fokus.fraunhofer.de (work) Blog: http://schily.blogspot.com/ URL: http://cdrecord.berlios.de/old/private/ ftp://ftp.berlios.de/pub/schily From Mark.Shellenbaum@Sun.COM Wed May 28 07:07:03 2008 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m4SE72M5003982 for ; Wed, 28 May 2008 07:07:02 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id m4SE71O4010812 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Wed, 28 May 2008 22:07:01 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K1L001030JO1800@nwk-avmta-2.sfbay.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 28 May 2008 07:07:00 -0700 (PDT) Received: from brmea-mail-1.sun.com ([192.18.98.31]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K1L00CEL0JNHBC0@nwk-avmta-2.sfbay.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 28 May 2008 07:07:00 -0700 (PDT) Received: from fe-amer-09.sun.com ([192.18.109.79]) by brmea-mail-1.sun.com (8.13.6+Sun/8.12.9) with ESMTP id m4SE6xmL021445 for ; Wed, 28 May 2008 14:06:59 +0000 (GMT) Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0K1K00D01ZBGYO00@mail-amer.sun.com> (original mail from Mark.Shellenbaum@Sun.COM) for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 28 May 2008 08:06:59 -0600 (MDT) Received: from [172.20.25.34] by mail-amer.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0K1L005T40JLIH20@mail-amer.sun.com>; Wed, 28 May 2008 08:06:58 -0600 (MDT) Date: Wed, 28 May 2008 08:05:37 -0600 From: Mark Shellenbaum Subject: Re: Further SID support [PSARC/2008/342 FastTrack timeout 06/03/2008] In-reply-to: <483CAC46.1090507@Sun.COM> Sender: Mark.Shellenbaum@Sun.COM To: Gary Winiger Cc: PSARC-ext@Sun.COM, Timothy.Haley@Sun.COM, Afshin.Ardakani@Sun.COM, Alan.M.Wright@Sun.COM Message-id: <483D66B1.5050508@Sun.COM> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200805280009.m4S094bo006115@marduk.eng.sun.com> <483CA3AE.7080509@Sun.COM> <483CAC46.1090507@Sun.COM> User-Agent: Thunderbird 2.0.0.12 (X11/20080422) Status: RO Content-Length: 3423 Mark Shellenbaum wrote: > Mark Shellenbaum wrote: >> Gary Winiger wrote: >>>>> How will this affect audit of chown(2), acl(2)? In particular >>>>> when >>>>> the audit trail file is processed on another system, or after a >>>>> reboot? Will ephermeral uid's be stored in the audit trail file? >>>>> How will praudit(1M), auditreduce(1M) be changed by this project? >>>>> >>>>> Gary.. >>>> This change doesn't change any syscalls. All it does is allow a >>>> user to specify SIDs and then uses the idmap(1M) API to convert >>>> those to ephemeral IDs. >>> >>> Right and doesn't it store ephemeral IDs in the audit trail file? >>> IIRC, ephemeral IDs were never supposed to survive reboots or >>> be transfered to other systems. Audit trail files can be moved >>> from the machine on which they were created; they can be processed >>> after the system has been rebooted. How are ephemeral IDs >>> processed in >>> those environments? That is, "How will praudit(1M), auditreduce(1M) >>> be changed by this project?" praudit translates user/group IDs to >>> user/group names. auditreduce selects files based on fileowner >>> and or filegroup. >>> >>> Gary.. >> >> It probably does store ephemeral IDs in audit trails today. That >> sounds like a bug that has been then since >> >> PSARC 2007/064 Unified POSIX and Windows Credentials for Solaris >> >> added support for ephemeral IDs. >> >> -Mark >> > > I will run a test and see what currently gets audited with ephemeral IDs. > > -Mark > > With stock Nevada bits I have a system with a few ephemeral IDs that are available from some previously accessed files that were created by the CIFS server. # idmap dump usid:S-1-5-21-940912991-1138591764-871648236-1119 == uid:2147483649 usid:S-1-5-21-940912991-1138591764-871648236-1138 == uid:2147483650 gsid:S-1-5-21-940912991-1138591764-871648236-1127 == gid:2147483650 gsid:S-1-5-21-940912991-1138591764-871648236-513 == gid:2147483651 Then I created a special testuser which has priv_file_chown and priv_file_chown_self and then I used this command to change the ownership of a file to an ephemeral id $ chown 2147483650 file.1 This results in the following audit record header,196,2,chown(2),sp,hidenseek,2008-05-28 07:55:02.896 -06:00 argument,2,0x80000002,new file uid argument,3,0xffffffff,new file gid path,/sandbox/test1/file.1 Now within ZFS the file ownership is changed to the following. This output comes from zdb. This will show what the real FUID inside ZFS is. # zdb -vvv sandbox/test1 ... Object lvl iblk dblk lsize asize type 5 1 16K 512 512 0 ZFS plain file 264 bonus ZFS znode path /file.1 uid 100000472 [S-1-5-21-940912991-1138591764-871648236-1138] gid 1 atime Wed May 28 07:54:43 2008 mtime Wed May 28 07:54:43 2008 ctime Wed May 28 07:55:02 2008 crtime Wed May 28 07:54:43 2008 gen 23424 mode 100644 size 0 parent 3 links 1 xattr 0 rdev 0x0000000000000000 Indirect blocks: If ephemeral Ids are not suppose to be in the audit trail then I would suggest you open a bug. Changing the way ephemeral IDs are audited is not part of this case. -Mark From Mark.Shellenbaum@sun.com Wed May 28 07:18:56 2008 Received: from sunmail2sca.sfbay.sun.com (sunmail2sca.SFBay.Sun.COM [129.145.155.234]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m4SEIu8R004872 for ; Wed, 28 May 2008 07:18:56 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail2sca.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id m4SEItG1024347 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Wed, 28 May 2008 07:18:56 -0700 (PDT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K1L00J0513K5Y00@brm-avmta-1.central.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 28 May 2008 08:18:56 -0600 (MDT) Received: from brmea-mail-3.sun.com ([192.18.98.34]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K1L00E1L13JL350@brm-avmta-1.central.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 28 May 2008 08:18:55 -0600 (MDT) Received: from fe-amer-10.sun.com ([192.18.109.80]) by brmea-mail-3.sun.com (8.13.6+Sun/8.12.9) with ESMTP id m4SEItiP008274 for ; Wed, 28 May 2008 14:18:55 +0000 (GMT) Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0K1L00G010UPV900@mail-amer.sun.com> (original mail from Mark.Shellenbaum@Sun.COM) for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 28 May 2008 08:18:55 -0600 (MDT) Received: from [172.20.25.34] by mail-amer.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0K1L004I712R5QB0@mail-amer.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 28 May 2008 08:18:27 -0600 (MDT) Date: Wed, 28 May 2008 08:17:07 -0600 From: Mark Shellenbaum Subject: Re: Further SID support [PSARC/2008/342 FastTrack timeout 06/03/2008] In-reply-to: <20080527211637.GE1039@Sun.COM> Sender: Mark.Shellenbaum@sun.com To: Tim Haley , PSARC-ext@sun.com, Afshin Salek , Alan Wright , Mark Shellenbaum Message-id: <483D6963.8010802@Sun.COM> MIME-version: 1.0 Content-type: multipart/mixed; boundary="Boundary_(ID_7f8YEZZ83ss3ohR6134aow)" X-PMX-Version: 5.4.1.325704 References: <483C72B8.3090709@sun.com> <20080527211637.GE1039@Sun.COM> User-Agent: Thunderbird 2.0.0.12 (X11/20080422) Status: RO Content-Length: 8538 This is a multi-part message in MIME format. --Boundary_(ID_7f8YEZZ83ss3ohR6134aow) Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT Nico and I discussed his issues yesterday and I am attaching a new spec that incorporates the changes Nico requested. Summary of the changes: - name@domain will be supported in addition to raw sid format - sid: can be used when user doesn't care whether a sid is a user or a group - ACL_SID_FMT will only use the raw sid format when necessary. It will first try and construct a name@domain format. -Mark Nicolas Williams wrote: > On Tue, May 27, 2008 at 02:44:40PM -0600, Tim Haley wrote: >> usersid/groupsid ACE types. These are aliases for user and group, >> but instead of an id a windows SID is specified instead. >> >> usersid:S-1-5-4343545-34534-44354-23:rwxp:allow >> groupsid:S-1-5-438473-58347567-4848-55:rwx:allow >> >> The acl_fromtext() interface will use idmap to convert the SID >> string into an ephemeral id. > > You can also use idmap interfaces to perform name-to-SID lookup + ID > mapping. So you could allow "usersid:foo@domain:rwxp:allow"... > > Do, please, make sure that there's a way to distinguish between Unix > user/group names and Windows user/group names. In the future we'll be > adding an nss_ad module that will make the two namespaces equal, but it > isn't necessarily the case that the customer will configure their system > to use nss_ad, thus the need for distinguishing between namespaces. > >> The acl_totext() interface will introduce a new flag bit >> ACL_SID_FMT that will be used to instruct acl_totext() to use >> the usersid, or groupsid format when constructing textual >> ACLs when the "id" field is an ephemeral id and the flag >> parameter requests "sid" format. > > I think we'll need a flag to request the use of Windows names vs. plain > SIDs. See above. > >> acl_totext(aclp, ACL_SID_FMT); >> >> Both chown(1) and chgrp(1) will have a -s option added to allow >> changing the owner/group by SID string. >> >> For example: >> >> chown -s S-1-5-4343545-34534-44354-23:S-1-5-438473-58347567-4848-55 >> file >> chgrp -s S-1-5-438473-58347567-4848-55 file >> >> All of the normal options to chown(1)/chgrp(1) will still >> apply, the -s argument simply tells the utility to treat the >> owner/group argument as a SID rather than a user or >> groupname. > > My comments re: chmod apply here as well. > > Nico --Boundary_(ID_7f8YEZZ83ss3ohR6134aow) Content-type: text/plain; name=acl.fasttrack Content-transfer-encoding: 7BIT Content-disposition: inline; filename=acl.fasttrack SUMMARY: This proposal is to provide several enhancements for setting NFSv4 ACLs and changing the owner and group ownership of files. Permission aliases will be added to allow a "set" of permissions to be specified. The sets to be provided are full_set, modify_set, read_set and write_set. Three special ACE types will be added to allow a user to specify a Windows SID in place of an ephemeral uid/gid. Both chown(1) and chgrp(1) will be enhanced to allow setting the owner and or group of files by SID rather than ephemeral id. PROBLEM: Users of the CIFS service often want to specify permissions on ZFS directories that map to the windows aliases. For completeness we should also allow a user to specify file owner ship via a SID and also allow ACEs to be specified by SID rather than uid/gid. PROPOSED SOLUTION: acl_totext() and acl_fromtext() will be enhanced to understand permission aliases and the special usersid, groupsid or sid ACE types. The following special permissions aliases will be added full_set = all permissions modify_set = all permissions except write_acl and write_owner read_set = read_data, read_attributes, read_xattr and read_acl write_set = write_data, append_data, write_attributes, write_xattr usage example: chmod A+user:joe:full_set:allow chmod A+user:tom:modify_set:fd:allow chmod A+user:frank:read_set/write_set:allow usersid/groupsid/sid ACE types. These are aliases for user and group, but instead of an id a windows SID or is specified instead. The final form "sid" is used when the user doesn't care whether its a user or group sid. In addition to raw SID format the user can also specify the windows user or group via name@domain syntax. usersid:S-1-5-4343545-34534-44354-23:rwxp:allow groupsid:S-1-5-438473-58347567-4848-55:rwx:allow sid:S-1-5-438473-58347567-4848-55:rwx:allow usersid:joe@domain:rwxp:allow sid:admins@domain:rwxp:allow The acl_fromtext() interface will use idmap to convert the SID or Wwindows name string into an id. The acl_totext() interface will introduce a new flag bit ACL_SID_FMT that will be used to instruct acl_totext() to use the usersid, or groupsid format when constructing textual ACLs when the "id" field is an ephemeral id and the flag parameter requests "sid" format. The raw format will only be used when the ephemeral ID can't be mapped to a name such as joe@domain. acl_totext(aclp, ACL_SID_FMT); Both chown(1) and chgrp(1) will have a -s option added to allow changing the owner/group by SID string. For example: chown -s S-1-5-4343545-34534-44354-23:S-1-5-438473-58347567-4848-55 file chown -s tom@domain:admin@domain chgrp -s S-1-5-438473-58347567-4848-55 file chgrp -s admin@domain All of the normal options to chown(1)/chgrp(1) will still apply, the -s argument simply tells the utility to treat the owner/group argument as a SID rather than a user or groupname. MANPAGE DIFFS chmod(1) 580a581 > usersid::[:inheritance flags]: 581a583,584 > Permissions for a specific user, but user is specified by SID > 585a589 > groupsid::[:inheritance flags]: 586a591 > Permissions for a specific group, but user is specified by SID 590a596,597 > > 703,704d709 < < 746a752,754 > Several special permission sets or aliases are also supported. > The following permission sets are used the same way that verbose > permissions are specified. 747a756 > full_set all permissions. 748a758,766 > modify_set all permissions except write_acl and write_owner. > > read_set read_data, read_acl, read_attributes, and > read_xattr > > write_set write_data, append_data, write_attributes, and > write_xattr > > acl_totext(3sec) 54a57,62 > ACL_SID_FMT For NFSv4 ACLs, the ACL entries for user or > group entries will use the usersid or groupsid > format when the "id" field in the ACL entry > is an ephemeral uid or gid. The raw sid format > will only be used when the "id" can't be resolved > to a windows name. 104a113,115 > usersid This ACL entry with a SID or Windows name specifies > the access granted to a Windows user. > This type of entry is for a CIFS server created file. 108a120,122 > groupsid This ACL entry with a SID or Windows name specifies > the access granted to a Windows group. This type of > entry is for a CIFS server created file. 109a124,125 > sid This ACL entry with a SID or Windows name when the entry > could be either a group or a user. 110a127 > chown(1) 13a14 > /usr/bin/chown -s [-fhR] ownersid[:groupsid] file... 16a18 > /usr/bin/chown -s -R [-f] [-H | -L | -P] ownersid[:groupsid] file... 20a23 > /usr/xpg4/bin/chown -s [-fhR] ownersid[:groupsid] file... 23a27 > /usr/xpg4/bin/chown -s -R [-f] [-H | -L | -P] ownersid[:groupsid] file... 105a110,112 > -s The owner and or group arguments are Windows SID strings. > This option requires a file system that supports storing SIDS, > such as ZFS. chgrp(1) 12a13 > chgrp -s [-fhR] groupsid file... 15a17 > chgrp -s -R [f] [-H | -L | -P] groupsid file... 88a91,92 > -s The specified group is a Windows SID. This option requires > a file system that supports storing SIDs, such as ZFS.. --Boundary_(ID_7f8YEZZ83ss3ohR6134aow)-- From Timothy.Haley@sun.com Wed Jun 4 11:09:36 2008 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m54I9ZM1007609 for ; Wed, 4 Jun 2008 11:09:36 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m54I9Tp8022400 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Wed, 4 Jun 2008 19:09:35 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K1Y00C09AFYEQ00@nwk-avmta-2.sfbay.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 04 Jun 2008 11:09:34 -0700 (PDT) Received: from brmea-mail-1.sun.com ([192.18.98.31]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K1Y00CE5AFX1E10@nwk-avmta-2.sfbay.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 04 Jun 2008 11:09:33 -0700 (PDT) Received: from fe-amer-09.sun.com ([192.18.109.79]) by brmea-mail-1.sun.com (8.13.6+Sun/8.12.9) with ESMTP id m54I9XRH026498 for ; Wed, 04 Jun 2008 18:09:33 +0000 (GMT) Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0K1Y00M01A29N600@mail-amer.sun.com> (original mail from Timothy.Haley@Sun.COM) for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 04 Jun 2008 12:09:33 -0600 (MDT) Received: from [172.20.25.27] by mail-amer.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0K1Y00JHQAFP5X60@mail-amer.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 04 Jun 2008 12:09:30 -0600 (MDT) Date: Wed, 04 Jun 2008 12:09:27 -0600 From: Tim Haley Subject: Re: Further SID support [PSARC/2008/342 FastTrack timeout 06/03/2008] In-reply-to: <483C72B8.3090709@sun.com> Sender: Timothy.Haley@sun.com To: PSARC-ext@sun.com Cc: Afshin Salek , Alan Wright , Mark Shellenbaum Message-id: <4846DA57.7090507@sun.com> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <483C72B8.3090709@sun.com> User-Agent: Thunderbird 2.0.0.14 (X11/20080507) Status: RO Content-Length: 59 This case was approved during today's PSARC meeting. -tim