From darrenm@sac.sfbay.sun.com Tue Jun 10 07:17:02 2008 Received: from sunmail3mpk.sfbay.sun.com (sunmail3mpk.SFBay.Sun.COM [129.146.11.52]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m5AEH2w3021460 for ; Tue, 10 Jun 2008 07:17:02 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail3mpk.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id m5AEGxvU020230; Tue, 10 Jun 2008 07:17:02 -0700 (PDT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K2900A1B3ODK400@brm-avmta-1.central.sun.com>; Tue, 10 Jun 2008 08:17:01 -0600 (MDT) Received: from dm-sfbay-01.sfbay.sun.com ([129.145.155.118]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K2900FNP3OC8HC0@brm-avmta-1.central.sun.com>; Tue, 10 Jun 2008 08:17:01 -0600 (MDT) Received: from sac.sfbay.sun.com (new-sac.SFBay.Sun.COM [129.146.175.65]) by dm-sfbay-01.sfbay.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m5AEGxXO053336; Tue, 10 Jun 2008 07:16:59 -0700 (PDT) Received: from sac.sfbay.sun.com (localhost [127.0.0.1]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m5AEGwJN021455; Tue, 10 Jun 2008 07:16:58 -0700 (PDT) Received: (from darrenm@localhost) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8/Submit) id m5AEGvj4021451; Tue, 10 Jun 2008 07:16:57 -0700 (PDT) Date: Tue, 10 Jun 2008 07:16:57 -0700 (PDT) From: Darren J Moffat Subject: sudo [PSARC/2008/370 FastTrack timeout 06/17/2008] To: PSARC-ext@sun.com Cc: Joep.Vesseur@sun.com, Tony.Nguyen@sun.com Message-id: <200806101416.m5AEGvj4021451@sac.sfbay.sun.com> Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 Status: RO Content-Length: 6387 Template Version: @(#)sac_nextcase 1.66 04/17/08 SMI This information is Copyright 2008 Sun Microsystems 1. Introduction 1.1. Project/Component Working Name: sudo 1.2. Name of Document Author/Supplier: Author: Joep Vesseur 1.3 Date of This Document: 10 June, 2008 4. Technical Description Release binding: minor Target Consolidation: SFW 1. Summary sudo(1) is a popular, cross platform administrative utility that allows an organization to define adminis- trative tasks and assign them to specific (groups) of users while defining the context the tasks will operate with. The purpose of sudo(1) is much like the purpose of RBAC. This case proposes to integrate the current stable ver- sion of sudo(1) in Solaris (at the time of writing, this is 1.6.9p16). 2. Details While, from a Solaris perspective, there are a number of features that sudo(1) lacks, this case proposes to integrate it anyway. The main reason to provide sudo(1) on Solaris is to enable administrators to adopt Solaris more easily and bring it under control of the heteroge- neous environment they are currently maintaining using sudo(1) on other platforms. For this case, we propose to integrate the current ver- sion of sudo as is. We acknowledge that Solaris spe- cific additions to sudo(1) would make sudo(1) a better Solaris citizen, but we defer those additions to future projects based on the willingness of the community to invest in Solaris specific features. 2.1. Auditing sudo(1) currently does not use any of the Solaris Auditing functionality. For this case, we do not pro- pose to add this functionality, based on our believe that the current demand for sudo(1) is from users with- out any auditing infrastructure (in the Solaris Audit- ing sense). sudo(1) will be explicitly left out of the CC evalua- tion target. We will engage with the community to see if they are willing to develop/accept Solaris specific auditing changes in the future, but we believe the current project is complete without these additions. We there- fore refer any auditing enhancements to a possible future project. 2.2. Extending sudoers with privilege specifications Another Solaris-specific extension to sudo(1) would be to allow it to use privilege specifications inside its sudoers-file. This would allow one to specify addi- tional privileges for some administrative tasks, instead of assigning the full root privileges, much like we allow for in exec_attr(4). Again, we will engage with the community to see if they are willing to accept this kind of Solaris specific changes upstream, but for now, we believe this case is complete without this additional Solaris-ism. 2.3. Merging sudo/RBAC In the long run, based on a "runs best on Solaris"-principle, we would like to merge the benefits from sudo(1) and RBAC allowing sudo(1) users to benefit from the RBAC framework, and allowing RBAC users to benefit from sudo-specific features. That is not this case, however. 3. Compilation options sudo(1) will be configured with the following options --with-CC=cc --prefix=/usr --with-ldap --with-project --with-privileges --with-pam These options will allow administrators to make use of Solaris-specific project features (part of standard sudo), and to store the sudoers(4) configuration in an LDAP database if they wish to do so. Since the LDAP schema to use differs from LDAP server to LDAP server, we intend to deliver example schema files for OpenLDAP based servers and SunONE based servers in /usr/share/doc, together with a conversion utility to create ldif files. These extra files are part of the normal sudo-package, but normally only available in the source package. 4. Interface table This case delivers the following files +---------------------------------------------------------------+ |Exported Interfaces Classification| |---------------------------------------------------------------| |SUNWsudo Committed | |/etc/sudoers Uncommitted | |/usr/bin/sudo Uncommitted | |/usr/bin/sudoedit Uncommitted | |/usr/lib/sudo_noexec.so Project Private | |/usr/lib/sparcv9/sudo_noexec.so Project Private | |/usr/lib/amd64/sudo_noexec.so Project Private | |/usr/sbin/visudo Uncommitted | |/usr/share/doc/sudo-/ Uncommitted | |/usr/share/doc/sudo-/BUGS Uncommitted | |/usr/share/doc/sudo-/CHANGES Uncommitted | |/usr/share/doc/sudo-/HISTORY Uncommitted | |/usr/share/doc/sudo-/LICENSE Uncommitted | |/usr/share/doc/sudo-/README Uncommitted | |/usr/share/doc/sudo-/README.LDAP Uncommitted | |/usr/share/doc/sudo-/TROUBLESHOOTING Uncommitted | |/usr/share/doc/sudo-/UPGRADE Uncommitted | |/usr/share/doc/sudo-/sample.sudoers Uncommitted | |/usr/share/doc/sudo-/sample.syslog.conf Uncommitted | |/usr/share/lib/ldif/sudo-schema.OpenLDAP Uncommitted | |/usr/share/lib/ldif/sudo-schema.iPlanet Uncommitted | |/usr/share/lib/ldif/sudoers2ldif Uncommitted | |/usr/share/man/man1m/sudo.1m Uncommitted | |/usr/share/man/man1m/sudoedit.1m Uncommitted | |/usr/share/man/man1m/visudo.1m Uncommitted | |/usr/share/man/man4/sudoers.4 Uncommitted | +---------------------------------------------------------------+ 6. Resources and Schedule 6.4. Steering Committee requested information 6.4.1. Consolidation C-team Name: SFW 6.5. ARC review type: FastTrack 6.6. ARC Exposure: open From gdamore@sun.com Tue Jun 10 08:47:41 2008 Received: from sunmail3mpk.sfbay.sun.com (sunmail3mpk.SFBay.Sun.COM [129.146.11.52]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m5AFlfri024148 for ; Tue, 10 Jun 2008 08:47:41 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail3mpk.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id m5AFlbUx026097 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Tue, 10 Jun 2008 08:47:41 -0700 (PDT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K2900D0F7VDOJ00@nwk-avmta-2.sfbay.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@Sun.COM); Tue, 10 Jun 2008 08:47:37 -0700 (PDT) Received: from sca-es-mail-2.sun.com ([192.18.43.133]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K2900D3K7VD5410@nwk-avmta-2.sfbay.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@Sun.COM); Tue, 10 Jun 2008 08:47:37 -0700 (PDT) Received: from fe-sfbay-09.sun.com ([192.18.43.129]) by sca-es-mail-2.sun.com (8.13.7+Sun/8.12.9) with ESMTP id m5AFlbYb022222 for ; Tue, 10 Jun 2008 08:47:37 -0700 (PDT) Received: from conversion-daemon.fe-sfbay-09.sun.com by fe-sfbay-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0K29004017RAGN00@fe-sfbay-09.sun.com> (original mail from gdamore@sun.com) for PSARC-ext@Sun.COM (ORCPT PSARC-ext@Sun.COM); Tue, 10 Jun 2008 08:47:36 -0700 (PDT) Received: from [192.168.251.106] ([76.174.83.55]) by fe-sfbay-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0K29005UI7VA6S80@fe-sfbay-09.sun.com>; Tue, 10 Jun 2008 08:47:35 -0700 (PDT) Date: Tue, 10 Jun 2008 08:46:44 -0700 From: "Garrett D'Amore" Subject: Re: sudo [PSARC/2008/370 FastTrack timeout 06/17/2008] In-reply-to: <200806101416.m5AEGvj4021451@sac.sfbay.sun.com> Sender: Garrett.Damore@sun.com To: Darren J Moffat Cc: PSARC-ext@sun.com, Joep.Vesseur@sun.com, Tony.Nguyen@sun.com Message-id: <484EA1E4.4020007@sun.com> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200806101416.m5AEGvj4021451@sac.sfbay.sun.com> User-Agent: Thunderbird 2.0.0.6 (X11/20071023) Status: RO Content-Length: 8178 Its been a while since I looked at sudo (brain long since rewired to pfexec), but IIRC sudo had some kind of support for kerberos. I don't see any compilation of kerberos in the flags below. Can you provide a one-or-two sentence description of rationale and impact? (I *suspect* I know what the reasonable answers are, but I'd like the answers from the project team directly, and I think it would be good to have the record in the case log.) Second, I notice that the package SUNWsudo is Committed, while everything else is Uncommitted. This may be ignorance on my part, but if the entire contents of the package are Uncommitted, then what value is there in having the package itself be Committed? Third, given that this project lacks Solaris auditing features, I'd really like to see an explicit statement of this limitation in the versions of the man pages we ship, perhaps with a recommendation. Something like: "sudo(1M) does not audit activities. Sites that require auditing information might consider using pfexec(1)." Finally, how will an unconfigured sudo installation behave? (More to the point, will the "default" installation of sudo create a hole in the auditing infrastructure, for sites that care to have auditing information preserved?) - Garrett PS: The case largely looks good to me. I don't think any of the answers to the questions above will be surprises, but I do think it is important to capture the information the case log. Darren J Moffat wrote: > Template Version: @(#)sac_nextcase 1.66 04/17/08 SMI > This information is Copyright 2008 Sun Microsystems > 1. Introduction > 1.1. Project/Component Working Name: > sudo > 1.2. Name of Document Author/Supplier: > Author: Joep Vesseur > 1.3 Date of This Document: > 10 June, 2008 > 4. Technical Description > > Release binding: minor > > Target Consolidation: SFW > > > 1. Summary > > sudo(1) is a popular, cross platform administrative > utility that allows an organization to define adminis- > trative tasks and assign them to specific (groups) of > users while defining the context the tasks will operate > with. The purpose of sudo(1) is much like the purpose > of RBAC. > > This case proposes to integrate the current stable ver- > sion of sudo(1) in Solaris (at the time of writing, > this is 1.6.9p16). > > > 2. Details > > While, from a Solaris perspective, there are a number > of features that sudo(1) lacks, this case proposes to > integrate it anyway. The main reason to provide sudo(1) > on Solaris is to enable administrators to adopt Solaris > more easily and bring it under control of the heteroge- > neous environment they are currently maintaining using > sudo(1) on other platforms. > > > For this case, we propose to integrate the current ver- > sion of sudo as is. We acknowledge that Solaris spe- > cific additions to sudo(1) would make sudo(1) a better > Solaris citizen, but we defer those additions to future > projects based on the willingness of the community to > invest in Solaris specific features. > > > 2.1. Auditing > > sudo(1) currently does not use any of the Solaris > Auditing functionality. For this case, we do not pro- > pose to add this functionality, based on our believe > that the current demand for sudo(1) is from users with- > out any auditing infrastructure (in the Solaris Audit- > ing sense). > > sudo(1) will be explicitly left out of the CC evalua- > tion target. > > We will engage with the community to see if they are > willing to develop/accept Solaris specific auditing > changes in the future, but we believe the current > project is complete without these additions. We there- > fore refer any auditing enhancements to a possible > future project. > > > 2.2. Extending sudoers with privilege specifications > > Another Solaris-specific extension to sudo(1) would be > to allow it to use privilege specifications inside its > sudoers-file. This would allow one to specify addi- > tional privileges for some administrative tasks, > instead of assigning the full root privileges, much > like we allow for in exec_attr(4). > > Again, we will engage with the community to see if they > are willing to accept this kind of Solaris specific > changes upstream, but for now, we believe this case is > complete without this additional Solaris-ism. > > > 2.3. Merging sudo/RBAC > > In the long run, based on a "runs best on > Solaris"-principle, we would like to merge the benefits > from sudo(1) and RBAC allowing sudo(1) users to benefit > from the RBAC framework, and allowing RBAC users to > benefit from sudo-specific features. That is not this > case, however. > > > 3. Compilation options > > sudo(1) will be configured with the following options > > --with-CC=cc --prefix=/usr --with-ldap --with-project > --with-privileges --with-pam > > These options will allow administrators to make use of > Solaris-specific project features (part of standard > sudo), and to store the sudoers(4) configuration in an > LDAP database if they wish to do so. Since the LDAP > schema to use differs from LDAP server to LDAP server, > we intend to deliver example schema files for OpenLDAP > based servers and SunONE based servers in > /usr/share/doc, together with a conversion utility to > create ldif files. These extra files are part of the > normal sudo-package, but normally only available in the > source package. > > 4. Interface table > > This case delivers the following files > > +---------------------------------------------------------------+ > |Exported Interfaces Classification| > |---------------------------------------------------------------| > |SUNWsudo Committed | > |/etc/sudoers Uncommitted | > |/usr/bin/sudo Uncommitted | > |/usr/bin/sudoedit Uncommitted | > |/usr/lib/sudo_noexec.so Project Private | > |/usr/lib/sparcv9/sudo_noexec.so Project Private | > |/usr/lib/amd64/sudo_noexec.so Project Private | > |/usr/sbin/visudo Uncommitted | > |/usr/share/doc/sudo-/ Uncommitted | > |/usr/share/doc/sudo-/BUGS Uncommitted | > |/usr/share/doc/sudo-/CHANGES Uncommitted | > |/usr/share/doc/sudo-/HISTORY Uncommitted | > |/usr/share/doc/sudo-/LICENSE Uncommitted | > |/usr/share/doc/sudo-/README Uncommitted | > |/usr/share/doc/sudo-/README.LDAP Uncommitted | > |/usr/share/doc/sudo-/TROUBLESHOOTING Uncommitted | > |/usr/share/doc/sudo-/UPGRADE Uncommitted | > |/usr/share/doc/sudo-/sample.sudoers Uncommitted | > |/usr/share/doc/sudo-/sample.syslog.conf Uncommitted | > |/usr/share/lib/ldif/sudo-schema.OpenLDAP Uncommitted | > |/usr/share/lib/ldif/sudo-schema.iPlanet Uncommitted | > |/usr/share/lib/ldif/sudoers2ldif Uncommitted | > |/usr/share/man/man1m/sudo.1m Uncommitted | > |/usr/share/man/man1m/sudoedit.1m Uncommitted | > |/usr/share/man/man1m/visudo.1m Uncommitted | > |/usr/share/man/man4/sudoers.4 Uncommitted | > +---------------------------------------------------------------+ > > 6. Resources and Schedule > 6.4. Steering Committee requested information > 6.4.1. Consolidation C-team Name: > SFW > 6.5. ARC review type: FastTrack > 6.6. ARC Exposure: open > > From Darren.Moffat@sun.com Tue Jun 10 10:07:45 2008 Received: from sunmail3mpk.sfbay.sun.com (sunmail3mpk.SFBay.Sun.COM [129.146.11.52]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m5AH7jYp001004 for ; Tue, 10 Jun 2008 10:07:45 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail3mpk.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id m5AH7gvK027388 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Tue, 10 Jun 2008 10:07:44 -0700 (PDT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K2900M27BKTFT00@brm-avmta-1.central.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 10 Jun 2008 11:07:41 -0600 (MDT) Received: from gmp-eb-inf-2.sun.com ([192.18.6.24]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K2900DAKBKSQV60@brm-avmta-1.central.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 10 Jun 2008 11:07:40 -0600 (MDT) Received: from fe-emea-09.sun.com (gmp-eb-lb-2-fe1.eu.sun.com [192.18.6.10]) by gmp-eb-inf-2.sun.com (8.13.7+Sun/8.12.9) with ESMTP id m5AH7dqu012577 for ; Tue, 10 Jun 2008 17:07:39 +0000 (GMT) Received: from conversion-daemon.fe-emea-09.sun.com by fe-emea-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0K2900901BD7R400@fe-emea-09.sun.com> (original mail from Darren.Moffat@Sun.COM) for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 10 Jun 2008 18:07:39 +0100 (BST) Received: from [129.156.173.21] by fe-emea-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0K29000EQBKRWV40@fe-emea-09.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 10 Jun 2008 18:07:39 +0100 (BST) Date: Tue, 10 Jun 2008 18:07:38 +0100 From: Darren J Moffat Subject: Re: sudo [PSARC/2008/370 FastTrack timeout 06/17/2008] In-reply-to: <484EA1E4.4020007@sun.com> Sender: Darren.Moffat@sun.com To: "Garrett D'Amore" Cc: PSARC-ext@sun.com, Joep.Vesseur@sun.com, Tony.Nguyen@sun.com Message-id: <484EB4DA.2040602@Sun.COM> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200806101416.m5AEGvj4021451@sac.sfbay.sun.com> <484EA1E4.4020007@sun.com> User-Agent: Thunderbird 2.0.0.14 (X11/20080507) Status: RO Content-Length: 3273 Garrett D'Amore wrote: > Its been a while since I looked at sudo (brain long since rewired to > pfexec), but IIRC sudo had some kind of support for kerberos. I don't > see any compilation of kerberos in the flags below. Can you provide a > one-or-two sentence description of rationale and impact? (I *suspect* I > know what the reasonable answers are, but I'd like the answers from the > project team directly, and I think it would be good to have the record > in the case log.) sudo's Kerberos and PAM support are compile time mutually exclusive. The Solaris pam_krb5 module has been tested with sudo and is known to work. Personally I think having to make the choice between PAM and Kerberos at compile time is unfortunate but that is how the upstream code works. Since Kerberos is not (unfortunately in my opinion) not mandatory to use on Solaris PAM is the only sensible choice from that mutually exclusive set. > Second, I notice that the package SUNWsudo is Committed, while > everything else is Uncommitted. This may be ignorance on my part, but > if the entire contents of the package are Uncommitted, then what value > is there in having the package itself be Committed? The fact that sudo willl always be delivered from the SUNWsudo package ? > Third, given that this project lacks Solaris auditing features, I'd > really like to see an explicit statement of this limitation in the > versions of the man pages we ship, perhaps with a recommendation. > Something like: "sudo(1M) does not audit activities. Sites that > require auditing information might consider using pfexec(1)." With my ARC hat on I don't think we shouldn't be vandalising upstream man pages like this in my opinion. This case is to ship sudo as is and the case explictly says so. We don't list all the other things that don't do auditing yet authenticate users, for example webmin authenticates users but doesn't audit, Apache has modules to authenticate unix users and doesn't audit. We didn't change those other components documentation to say they don't audit so I don't think we should ask this project to to that to the sudo ones. > Finally, how will an unconfigured sudo installation behave? (More to The default case isn't actually unconfigured. This case ships the default /etc/sudoers file (in the materials dir). The default sudoers file only allows root to use sudo. > the point, will the "default" installation of sudo create a hole in the > auditing infrastructure, for sites that care to have auditing > information preserved?) Auditing is off by default on Solaris and because of the default sudoers file I don't believe that is an issue. Note that using sudo *will* still cause audit records to be written and the will still have the correct audit id in the records (because sudo doesn't do anything to change that - and shouldn't either). It is still possible to get audit records of what commands were executed and what their arguments were using the ex class. The only real missing part of Solaris audit integration is the equivalent of what pfexec does as application level auditing which is in addition to the syscall auditing. Personally I don't think that is much of a big deal. -- Darren J Moffat From carlsonj@phorcys.east.sun.com Tue Jun 10 10:21:01 2008 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m5AHL0Yn001282 for ; Tue, 10 Jun 2008 10:21:01 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id m5AHKmrw025646; Wed, 11 Jun 2008 01:20:53 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K2900H0BC6Q7400@nwk-avmta-2.sfbay.sun.com>; Tue, 10 Jun 2008 10:20:50 -0700 (PDT) Received: from phorcys.east.sun.com ([129.148.174.143]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K2900DDLC6P4X80@nwk-avmta-2.sfbay.sun.com>; Tue, 10 Jun 2008 10:20:50 -0700 (PDT) Received: from phorcys.east.sun.com (localhost [127.0.0.1]) by phorcys.east.sun.com (8.14.3+Sun/8.14.3) with ESMTP id m5AHKnsm015216; Tue, 10 Jun 2008 13:20:49 -0400 (EDT) Received: (from carlsonj@localhost) by phorcys.east.sun.com (8.14.3+Sun/8.14.3/Submit) id m5AHKndh015213; Tue, 10 Jun 2008 13:20:49 -0400 (EDT) Date: Tue, 10 Jun 2008 13:20:49 -0400 From: James Carlson Subject: Re: sudo [PSARC/2008/370 FastTrack timeout 06/17/2008] In-reply-to: <484EB4DA.2040602@Sun.COM> To: Darren J Moffat Cc: "Garrett D'Amore" , Tony.Nguyen@sun.com, PSARC-ext@sun.com, Joep.Vesseur@sun.com Message-id: <18510.47089.229407.987305@gargle.gargle.HOWL> MIME-version: 1.0 X-Mailer: VM 7.01 under Emacs 21.3.1 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200806101416.m5AEGvj4021451@sac.sfbay.sun.com> <484EA1E4.4020007@sun.com> <484EB4DA.2040602@Sun.COM> Status: RO Content-Length: 828 Darren J Moffat writes: > Garrett D'Amore wrote: > > Finally, how will an unconfigured sudo installation behave? (More to > > The default case isn't actually unconfigured. This case ships the > default /etc/sudoers file (in the materials dir). > > The default sudoers file only allows root to use sudo. Possibly dumb question time: is that safe? What if root's privileges are configured to be less than "everything?" Won't installation of this package (by way of its setuid bit on sudo and its default configuration) then allow the previously-restricted root user to gain privileges by default? -- James Carlson, Solaris Networking Sun Microsystems / 35 Network Drive 71.232W Vox +1 781 442 2084 MS UBUR02-212 / Burlington MA 01803-2757 42.496N Fax +1 781 442 1677 From Alan.Coopersmith@Sun.COM Tue Jun 10 10:29:58 2008 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m5AHTv5Q001638 for ; Tue, 10 Jun 2008 10:29:58 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m5AHTkwW029913 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Tue, 10 Jun 2008 18:29:57 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K2900J0HCLUGU00@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 10 Jun 2008 10:29:54 -0700 (PDT) Received: from sca-es-mail-2.sun.com ([192.18.43.133]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K2900HOICLUUJ80@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 10 Jun 2008 10:29:54 -0700 (PDT) Received: from fe-sfbay-09.sun.com ([192.18.43.129]) by sca-es-mail-2.sun.com (8.13.7+Sun/8.12.9) with ESMTP id m5AHTs3Q006541 for ; Tue, 10 Jun 2008 10:29:54 -0700 (PDT) Received: from conversion-daemon.fe-sfbay-09.sun.com by fe-sfbay-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0K2900J01CG4H500@fe-sfbay-09.sun.com> (original mail from Alan.Coopersmith@Sun.COM) for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 10 Jun 2008 10:29:54 -0700 (PDT) Received: from [10.6.102.118] by fe-sfbay-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0K290023ZCLHE960@fe-sfbay-09.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 10 Jun 2008 10:29:42 -0700 (PDT) Date: Tue, 10 Jun 2008 10:29:41 -0700 From: Alan Coopersmith Subject: Re: sudo [PSARC/2008/370 FastTrack timeout 06/17/2008] In-reply-to: <484EB4DA.2040602@Sun.COM> Sender: Alan.Coopersmith@Sun.COM To: Darren J Moffat Cc: "Garrett D'Amore" , PSARC-ext@Sun.COM, Joep.Vesseur@Sun.COM, Tony.Nguyen@Sun.COM Message-id: <484EBA05.2000707@sun.com> MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 X-Enigmail-Version: 0.95.1 References: <200806101416.m5AEGvj4021451@sac.sfbay.sun.com> <484EA1E4.4020007@sun.com> <484EB4DA.2040602@Sun.COM> User-Agent: Thunderbird 2.0.0.6 (X11/20071119) Status: RO Content-Length: 873 Darren J Moffat wrote: > Garrett D'Amore wrote: >> Second, I notice that the package SUNWsudo is Committed, while >> everything else is Uncommitted. This may be ignorance on my part, but >> if the entire contents of the package are Uncommitted, then what value >> is there in having the package itself be Committed? > > The fact that sudo willl always be delivered from the SUNWsudo package ? Where "always" means "until we finish the conversion to IPS and the associated package renaming/refactoring." Though that could still be Committed, if you consider the change of packaging systems & package names to be the point at which a Major Release Binding occurs. (And given how many package names are already Committed, it probably will have to be.) -- -Alan Coopersmith- alan.coopersmith@sun.com Sun Microsystems, Inc. - X Window System Engineering From gdamore@Sun.COM Tue Jun 10 10:32:05 2008 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m5AHW5lr001680 for ; Tue, 10 Jun 2008 10:32:05 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id m5AHW5eb051300 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Tue, 10 Jun 2008 11:32:05 -0600 (MDT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K2900H0TCPGMD00@nwk-avmta-2.sfbay.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 10 Jun 2008 10:32:04 -0700 (PDT) Received: from sca-es-mail-2.sun.com ([192.18.43.133]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K2900D39CPF5A90@nwk-avmta-2.sfbay.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 10 Jun 2008 10:32:04 -0700 (PDT) Received: from fe-sfbay-09.sun.com ([192.18.43.129]) by sca-es-mail-2.sun.com (8.13.7+Sun/8.12.9) with ESMTP id m5AHW3S6006877 for ; Tue, 10 Jun 2008 10:32:03 -0700 (PDT) Received: from conversion-daemon.fe-sfbay-09.sun.com by fe-sfbay-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0K2900J01CG4H500@fe-sfbay-09.sun.com> (original mail from gdamore@sun.com) for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 10 Jun 2008 10:32:03 -0700 (PDT) Received: from [192.168.251.106] ([76.174.83.55]) by fe-sfbay-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0K29002CGCP7E970@fe-sfbay-09.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 10 Jun 2008 10:31:56 -0700 (PDT) Date: Tue, 10 Jun 2008 10:31:03 -0700 From: "Garrett D'Amore" Subject: Re: sudo [PSARC/2008/370 FastTrack timeout 06/17/2008] In-reply-to: <484EB4DA.2040602@Sun.COM> Sender: Garrett.Damore@Sun.COM To: Darren J Moffat Cc: PSARC-ext@Sun.COM, Joep.Vesseur@Sun.COM, Tony.Nguyen@Sun.COM Message-id: <484EBA57.2020103@sun.com> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200806101416.m5AEGvj4021451@sac.sfbay.sun.com> <484EA1E4.4020007@sun.com> <484EB4DA.2040602@Sun.COM> User-Agent: Thunderbird 2.0.0.6 (X11/20071023) Status: RO Content-Length: 5520 Darren J Moffat wrote: > Garrett D'Amore wrote: >> Its been a while since I looked at sudo (brain long since rewired to >> pfexec), but IIRC sudo had some kind of support for kerberos. I >> don't see any compilation of kerberos in the flags below. Can you >> provide a one-or-two sentence description of rationale and impact? >> (I *suspect* I know what the reasonable answers are, but I'd like the >> answers from the project team directly, and I think it would be good >> to have the record in the case log.) > > sudo's Kerberos and PAM support are compile time mutually exclusive. > The Solaris pam_krb5 module has been tested with sudo and is known to > work. Personally I think having to make the choice between PAM and > Kerberos at compile time is unfortunate but that is how the upstream > code works. Since Kerberos is not (unfortunately in my opinion) not > mandatory to use on Solaris PAM is the only sensible choice from that > mutually exclusive set. Pretty much what I expected, but pam_krb5 was (to me) a little surprise bonus. Just to set my understanding straight: does the pam_krb5 module combined with sudo's pam support provide full Kerberos functionality? Are there any feature gaps from sudo's native Kerberos support? > >> Second, I notice that the package SUNWsudo is Committed, while >> everything else is Uncommitted. This may be ignorance on my part, >> but if the entire contents of the package are Uncommitted, then what >> value is there in having the package itself be Committed? > > The fact that sudo willl always be delivered from the SUNWsudo package ? But if the path name of the sudo binary can't be relied upon, then what is the point of knowing the package name? It seems (and really this is at most a nit) like an empty promise. > >> Third, given that this project lacks Solaris auditing features, I'd >> really like to see an explicit statement of this limitation in the >> versions of the man pages we ship, perhaps with a recommendation. >> Something like: "sudo(1M) does not audit activities. Sites that >> require auditing information might consider using pfexec(1)." > > With my ARC hat on I don't think we shouldn't be vandalising upstream > man pages like this in my opinion. This case is to ship sudo as is > and the case explictly says so. We don't list all the other things > that don't do auditing yet authenticate users, for example webmin > authenticates users but doesn't audit, Apache has modules to > authenticate unix users and doesn't audit. We didn't change those > other components documentation to say they don't audit so I don't > think we should ask this project to to that to the sudo ones. I humbly disagree that making the problem worse is a good idea. However, I will defer to the larger ARC majority on the issue. > >> Finally, how will an unconfigured sudo installation behave? (More to > > The default case isn't actually unconfigured. This case ships the > default /etc/sudoers file (in the materials dir). > > The default sudoers file only allows root to use sudo. It was the contents of the default sudoers file I was after. It sounds to me like this doesn't necessarily represent any more of a backdoor for auditing than, say, the /bin/sh does. Thanks for the clarification. > >> the point, will the "default" installation of sudo create a hole in >> the auditing infrastructure, for sites that care to have auditing >> information preserved?) > > Auditing is off by default on Solaris and because of the default > sudoers file I don't believe that is an issue. > > Note that using sudo *will* still cause audit records to be written > and the will still have the correct audit id in the records (because > sudo doesn't do anything to change that - and shouldn't either). It > is still possible to get audit records of what commands were executed > and what their arguments were using the ex class. The only real > missing part of Solaris audit integration is the equivalent of what > pfexec does as application level auditing which is in addition to the > syscall auditing. Personally I don't think that is much of a big deal. I'm happy with the answers supplied, modulo small disagreement over the man page issue. However, I'm definitely willing to stand aside and hold my nose on that issue if the other ARC members are as well. One of the clarifications I'd like to see from the gang-of-four is guidance for how we handle cases like this, where the familiarity benefits directly conflict with Solaris technological superiority. (E.g. sudo versus pfexec.) From a marketing standpoint, it seems like we should do what we can to push Solaris users towards technologies that are optimized for Solaris when we can. There are very few opportunities (IMO) to do that for users of familiarity commands like sudo, and product documentation seems like one of the opportunities we could be taking better advantage of. (Put another way, if someone comes from linux land, and is used to sudo, once they start using it, how do they ever learn about the existence of pfexec, or even that there may be something better than sudo. Some might argue that if sudo works well enough the user, then why should he look further. I think though, that if we really want to increase uptake we need to avoid missing opportunities to point out areas where Solaris can offer superior functionality to its competitors.) - Garrett From Darren.Moffat@Sun.COM Tue Jun 10 10:38:32 2008 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m5AHcVHO001926 for ; Tue, 10 Jun 2008 10:38:32 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m5AHcUqU004068 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Tue, 10 Jun 2008 18:38:30 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K2900H03D06UR00@nwk-avmta-2.sfbay.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 10 Jun 2008 10:38:30 -0700 (PDT) Received: from gmp-eb-inf-2.sun.com ([192.18.6.24]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K2900D1ED044Y90@nwk-avmta-2.sfbay.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 10 Jun 2008 10:38:29 -0700 (PDT) Received: from fe-emea-09.sun.com (gmp-eb-lb-2-fe3.eu.sun.com [192.18.6.12]) by gmp-eb-inf-2.sun.com (8.13.7+Sun/8.12.9) with ESMTP id m5AHcSnE013976 for ; Tue, 10 Jun 2008 17:38:28 +0000 (GMT) Received: from conversion-daemon.fe-emea-09.sun.com by fe-emea-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0K2900D01CU5ZT00@fe-emea-09.sun.com> (original mail from Darren.Moffat@Sun.COM) for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 10 Jun 2008 18:38:28 +0100 (BST) Received: from [129.156.173.21] by fe-emea-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0K29000RQCZPWV40@fe-emea-09.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 10 Jun 2008 18:38:14 +0100 (BST) Date: Tue, 10 Jun 2008 18:38:13 +0100 From: Darren J Moffat Subject: Re: sudo [PSARC/2008/370 FastTrack timeout 06/17/2008] In-reply-to: <484EBA57.2020103@sun.com> Sender: Darren.Moffat@Sun.COM To: "Garrett D'Amore" Cc: PSARC-ext@Sun.COM, Joep.Vesseur@Sun.COM, Tony.Nguyen@Sun.COM Message-id: <484EBC05.3080700@Sun.COM> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200806101416.m5AEGvj4021451@sac.sfbay.sun.com> <484EA1E4.4020007@sun.com> <484EB4DA.2040602@Sun.COM> <484EBA57.2020103@sun.com> User-Agent: Thunderbird 2.0.0.14 (X11/20080507) Status: RO Content-Length: 1285 Garrett D'Amore wrote: > > One of the clarifications I'd like to see from the gang-of-four is > guidance for how we handle cases like this, where the familiarity > benefits directly conflict with Solaris technological superiority. > (E.g. sudo versus pfexec.) From a marketing standpoint, it seems like > we should do what we can to push Solaris users towards technologies that > are optimized for Solaris when we can. There are very few opportunities > (IMO) to do that for users of familiarity commands like sudo, and > product documentation seems like one of the opportunities we could be > taking better advantage of. (Put another way, if someone comes from > linux land, and is used to sudo, once they start using it, how do they > ever learn about the existence of pfexec, or even that there may be > something better than sudo. Some might argue that if sudo works well > enough the user, then why should he look further. I think though, that > if we really want to increase uptake we need to avoid missing > opportunities to point out areas where Solaris can offer superior > functionality to its competitors.) That assumes that said person who is used to using sudo would actually read the Solaris provided man page. -- Darren J Moffat From Darren.Moffat@sun.com Tue Jun 10 10:48:29 2008 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m5AHmS4L002139 for ; Tue, 10 Jun 2008 10:48:28 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id m5AHmPsK006480 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Wed, 11 Jun 2008 01:48:27 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K2900I0VDGR8600@nwk-avmta-2.sfbay.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 10 Jun 2008 10:48:27 -0700 (PDT) Received: from gmp-eb-inf-1.sun.com ([192.18.6.21]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K2900DTRDGP5990@nwk-avmta-2.sfbay.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 10 Jun 2008 10:48:26 -0700 (PDT) Received: from fe-emea-09.sun.com (gmp-eb-lb-2-fe2.eu.sun.com [192.18.6.11]) by gmp-eb-inf-1.sun.com (8.13.7+Sun/8.12.9) with ESMTP id m5AHmP0W004754 for ; Tue, 10 Jun 2008 17:48:25 +0000 (GMT) Received: from conversion-daemon.fe-emea-09.sun.com by fe-emea-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0K2900M01DBBF300@fe-emea-09.sun.com> (original mail from Darren.Moffat@Sun.COM) for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 10 Jun 2008 18:48:25 +0100 (BST) Received: from [129.156.173.21] by fe-emea-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0K29000V8DGNWV40@fe-emea-09.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 10 Jun 2008 18:48:25 +0100 (BST) Date: Tue, 10 Jun 2008 18:48:23 +0100 From: Darren J Moffat Subject: Re: sudo [PSARC/2008/370 FastTrack timeout 06/17/2008] In-reply-to: <18510.47089.229407.987305@gargle.gargle.HOWL> Sender: Darren.Moffat@sun.com To: James Carlson Cc: "Garrett D'Amore" , Tony.Nguyen@sun.com, PSARC-ext@sun.com, Joep.Vesseur@sun.com Message-id: <484EBE67.5040008@Sun.COM> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200806101416.m5AEGvj4021451@sac.sfbay.sun.com> <484EA1E4.4020007@sun.com> <484EB4DA.2040602@Sun.COM> <18510.47089.229407.987305@gargle.gargle.HOWL> User-Agent: Thunderbird 2.0.0.14 (X11/20080507) Status: RO Content-Length: 1264 James Carlson wrote: > Darren J Moffat writes: >> Garrett D'Amore wrote: >>> Finally, how will an unconfigured sudo installation behave? (More to >> The default case isn't actually unconfigured. This case ships the >> default /etc/sudoers file (in the materials dir). >> >> The default sudoers file only allows root to use sudo. > > Possibly dumb question time: is that safe? What if root's privileges > are configured to be less than "everything?" I don't believe we actually support such a configuration, I'm not even sure if the system works properly I know that Glenn Faden did do some investigation of this but I don't know the final outcome. I'll ask him to comment. > Won't installation of > this package (by way of its setuid bit on sudo and its default > configuration) then allow the previously-restricted root user to gain > privileges by default? To do this you would set the limitpriv set for root (modulo the above comment), if you didn't then you haven't actually restricted the set of privielges the root user could gain by running setuid programs anyway. The limit set is enforced even over setuid - that is after all the point of it - as is documented in user_attr(4) and privileges(5). So yes it is safe. -- Darren J Moffat From jek3@sun.com Tue Jun 10 10:55:14 2008 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m5AHtDUq002586 for ; Tue, 10 Jun 2008 10:55:14 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m5AHt47S010958; Tue, 10 Jun 2008 18:55:11 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K2900I05DRYHQ00@nwk-avmta-2.sfbay.sun.com>; Tue, 10 Jun 2008 10:55:10 -0700 (PDT) Received: from jurassic-x4600.sfbay.sun.com ([129.146.17.59]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K2900DPXDRX5AA0@nwk-avmta-2.sfbay.sun.com>; Tue, 10 Jun 2008 10:55:09 -0700 (PDT) Received: from [129.150.13.200] (vpn-129-150-13-200.SFBay.Sun.COM [129.150.13.200]) by jurassic-x4600.sfbay.sun.com (8.14.3+Sun/8.14.3) with ESMTP id m5AHt8Vs586840; Tue, 10 Jun 2008 10:55:09 -0700 (PDT) Date: Tue, 10 Jun 2008 07:57:47 -1000 From: Joseph Kowalski Subject: Re: sudo [PSARC/2008/370 FastTrack timeout 06/17/2008] In-reply-to: <200806101416.m5AEGvj4021451@sac.sfbay.sun.com> To: Darren J Moffat Cc: PSARC-ext@sun.com, Joep.Vesseur@sun.com, Tony.Nguyen@sun.com Message-id: <484EC09B.4080509@sun.com> MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200806101416.m5AEGvj4021451@sac.sfbay.sun.com> User-Agent: Thunderbird 2.0.0.9 (X11/20080225) Status: RO Content-Length: 454 Mostly for curiosity... Darren J Moffat wrote: > This case proposes to integrate the current stable ver- > sion of sudo(1) in Solaris (at the time of writing, > this is 1.6.9p16). > Is there any way for a mortal to read that string as meaning "stable"? > sudo(1) will be explicitly left out of the CC evalua- > tion target. > I probably should know what this means... Help me Mr. Wizard... - thanks, - jek3 From Darren.Moffat@Sun.COM Tue Jun 10 11:33:51 2008 Received: from sunmail3mpk.sfbay.sun.com (sunmail3mpk.SFBay.Sun.COM [129.146.11.52]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m5AIXpnF003569 for ; Tue, 10 Jun 2008 11:33:51 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail3mpk.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id m5AIXppa026605 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Tue, 10 Jun 2008 11:33:51 -0700 (PDT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K2900523FKCGA00@brm-avmta-1.central.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 10 Jun 2008 12:33:48 -0600 (MDT) Received: from gmp-eb-inf-2.sun.com ([192.18.6.24]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K2900DEGFKBQQC0@brm-avmta-1.central.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 10 Jun 2008 12:33:48 -0600 (MDT) Received: from fe-emea-09.sun.com (gmp-eb-lb-2-fe3.eu.sun.com [192.18.6.12]) by gmp-eb-inf-2.sun.com (8.13.7+Sun/8.12.9) with ESMTP id m5AIXle4015859 for ; Tue, 10 Jun 2008 18:33:47 +0000 (GMT) Received: from conversion-daemon.fe-emea-09.sun.com by fe-emea-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0K2900I01FHRIG00@fe-emea-09.sun.com> (original mail from Darren.Moffat@Sun.COM) for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 10 Jun 2008 19:33:47 +0100 (BST) Received: from [129.156.173.21] by fe-emea-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0K290004XFK8WV50@fe-emea-09.sun.com>; Tue, 10 Jun 2008 19:33:46 +0100 (BST) Date: Tue, 10 Jun 2008 19:33:44 +0100 From: Darren J Moffat Subject: Re: sudo [PSARC/2008/370 FastTrack timeout 06/17/2008] In-reply-to: <484EC09B.4080509@sun.com> Sender: Darren.Moffat@Sun.COM To: Joseph Kowalski Cc: Darren J Moffat , PSARC-ext@Sun.COM, Joep.Vesseur@Sun.COM, Tony.Nguyen@Sun.COM Message-id: <484EC908.10905@Sun.COM> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200806101416.m5AEGvj4021451@sac.sfbay.sun.com> <484EC09B.4080509@sun.com> User-Agent: Thunderbird 2.0.0.14 (X11/20080507) Status: RO Content-Length: 733 Joseph Kowalski wrote: > > Mostly for curiosity... > > Darren J Moffat wrote: >> This case proposes to integrate the current stable ver- >> sion of sudo(1) in Solaris (at the time of writing, >> this is 1.6.9p16). >> > > Is there any way for a mortal to read that string as meaning "stable"? Yes: http://www.sudo.ws/sudo/stable.html [Note that the page is slightly wrong it says p15 is current but links to p16 which is the current version]. >> sudo(1) will be explicitly left out of the CC evalua- >> tion target. >> > > I probably should know what this means... Help me Mr. Wizard... Common Criteria evaluation. sudo will be outside of the Target of Evaluation. -- Darren J Moffat From Darren.Moffat@Sun.COM Tue Jun 10 11:34:13 2008 Received: from sunmail3mpk.sfbay.sun.com (sunmail3mpk.SFBay.Sun.COM [129.146.11.52]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m5AIYDL5003583 for ; Tue, 10 Jun 2008 11:34:13 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail3mpk.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id m5AIYCdo026783 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Tue, 10 Jun 2008 11:34:12 -0700 (PDT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K2900203FL0XD00@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 10 Jun 2008 11:34:12 -0700 (PDT) Received: from gmp-eb-inf-2.sun.com ([192.18.6.24]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K2900K05FKZP7E0@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 10 Jun 2008 11:34:12 -0700 (PDT) Received: from fe-emea-09.sun.com (gmp-eb-lb-2-fe1.eu.sun.com [192.18.6.10]) by gmp-eb-inf-2.sun.com (8.13.7+Sun/8.12.9) with ESMTP id m5AIYBVd015870 for ; Tue, 10 Jun 2008 18:34:11 +0000 (GMT) Received: from conversion-daemon.fe-emea-09.sun.com by fe-emea-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0K2900I01FHRIG00@fe-emea-09.sun.com> (original mail from Darren.Moffat@Sun.COM) for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 10 Jun 2008 19:34:11 +0100 (BST) Received: from [129.156.173.21] by fe-emea-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0K290004ZFKYWV50@fe-emea-09.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 10 Jun 2008 19:34:11 +0100 (BST) Date: Tue, 10 Jun 2008 19:34:10 +0100 From: Darren J Moffat Subject: Re: sudo [PSARC/2008/370 FastTrack timeout 06/17/2008] In-reply-to: <484EBA57.2020103@sun.com> Sender: Darren.Moffat@Sun.COM To: "Garrett D'Amore" Cc: PSARC-ext@Sun.COM, Joep.Vesseur@Sun.COM, Tony.Nguyen@Sun.COM Message-id: <484EC922.3070004@Sun.COM> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200806101416.m5AEGvj4021451@sac.sfbay.sun.com> <484EA1E4.4020007@sun.com> <484EB4DA.2040602@Sun.COM> <484EBA57.2020103@sun.com> User-Agent: Thunderbird 2.0.0.14 (X11/20080507) Status: RO Content-Length: 867 Garrett D'Amore wrote: > Just to set my understanding straight: does the pam_krb5 module combined > with sudo's pam support provide full Kerberos functionality? Are there > any feature gaps from sudo's native Kerberos support? The Kerberos support doesn't appear to be well documented (it isn't mentioned at all in the man page) so that is hard for me to tell. However it doesn't even build on Solaris, it compiles but fails to link against our libkrb5 due to missing symbols: krb5_get_init_creds_opt_alloc krb5_get_init_creds_opt_free. I believe that the following in /etc/pam.conf is equivalent (actually it is in some ways better because of pam_unix_cred) to building sudo with Kerberos support but I'm not completely sure (and I'm not the project team either). sudo auth required pam_unix_cred.so sudo auth required pam_krb5.so. -- Darren J Moffat From jek3@sun.com Tue Jun 10 11:36:22 2008 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m5AIaMF7003714 for ; Tue, 10 Jun 2008 11:36:22 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id m5AIaJZx008021; Tue, 10 Jun 2008 12:36:20 -0600 (MDT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K2900301FOK5P00@nwk-avmta-1.sfbay.Sun.COM>; Tue, 10 Jun 2008 11:36:20 -0700 (PDT) Received: from jurassic-x4600.sfbay.sun.com ([129.146.17.59]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K2900KURFOJP4D0@nwk-avmta-1.sfbay.Sun.COM>; Tue, 10 Jun 2008 11:36:19 -0700 (PDT) Received: from [129.150.13.200] (vpn-129-150-13-200.SFBay.Sun.COM [129.150.13.200]) by jurassic-x4600.sfbay.sun.com (8.14.3+Sun/8.14.3) with ESMTP id m5AIaIn6595688; Tue, 10 Jun 2008 11:36:18 -0700 (PDT) Date: Tue, 10 Jun 2008 08:38:57 -1000 From: Joseph Kowalski Subject: Re: sudo [PSARC/2008/370 FastTrack timeout 06/17/2008] In-reply-to: <484EA1E4.4020007@sun.com> To: "Garrett D'Amore" Cc: Darren J Moffat , PSARC-ext@sun.com, Joep.Vesseur@sun.com, Tony.Nguyen@sun.com Message-id: <484ECA41.6040700@sun.com> MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200806101416.m5AEGvj4021451@sac.sfbay.sun.com> <484EA1E4.4020007@sun.com> User-Agent: Thunderbird 2.0.0.9 (X11/20080225) Status: RO Content-Length: 440 Garrett D'Amore wrote: > Second, I notice that the package SUNWsudo is Committed, while > everything else is Uncommitted. This may be ignorance on my part, but > if the entire contents of the package are Uncommitted, then what value > is there in having the package itself be Committed? I can take this one. Its so packages can use this name in their dependencies. For this reason, there are more than a few empty packages. - jek3 From gdamore@Sun.COM Tue Jun 10 11:39:52 2008 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m5AIdpOO003778 for ; Tue, 10 Jun 2008 11:39:52 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id m5AIdfB3023927 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Wed, 11 Jun 2008 02:39:51 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K290030DFUCIC00@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 10 Jun 2008 11:39:48 -0700 (PDT) Received: from sca-es-mail-2.sun.com ([192.18.43.133]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K2900KXEFUBP4E0@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 10 Jun 2008 11:39:47 -0700 (PDT) Received: from fe-sfbay-09.sun.com ([192.18.43.129]) by sca-es-mail-2.sun.com (8.13.7+Sun/8.12.9) with ESMTP id m5AIdlEk017606 for ; Tue, 10 Jun 2008 11:39:47 -0700 (PDT) Received: from conversion-daemon.fe-sfbay-09.sun.com by fe-sfbay-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0K2900701F0CXU00@fe-sfbay-09.sun.com> (original mail from gdamore@sun.com) for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 10 Jun 2008 11:39:47 -0700 (PDT) Received: from [192.168.251.106] ([76.174.83.55]) by fe-sfbay-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0K2900GCGFUAG670@fe-sfbay-09.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 10 Jun 2008 11:39:47 -0700 (PDT) Date: Tue, 10 Jun 2008 11:38:54 -0700 From: "Garrett D'Amore" Subject: Re: sudo [PSARC/2008/370 FastTrack timeout 06/17/2008] In-reply-to: <484EC922.3070004@Sun.COM> Sender: garrett.damore@Sun.COM To: Darren J Moffat Cc: PSARC-ext@Sun.COM, Joep.Vesseur@Sun.COM, Tony.Nguyen@Sun.COM Message-id: <484ECA3E.4030108@sun.com> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200806101416.m5AEGvj4021451@sac.sfbay.sun.com> <484EA1E4.4020007@sun.com> <484EB4DA.2040602@Sun.COM> <484EBA57.2020103@sun.com> <484EC922.3070004@Sun.COM> User-Agent: Thunderbird 2.0.0.6 (X11/20071023) Status: RO Content-Length: 1031 Darren J Moffat wrote: > Garrett D'Amore wrote: >> Just to set my understanding straight: does the pam_krb5 module >> combined with sudo's pam support provide full Kerberos >> functionality? Are there any feature gaps from sudo's native >> Kerberos support? > > The Kerberos support doesn't appear to be well documented (it isn't > mentioned at all in the man page) so that is hard for me to tell. > However it doesn't even build on Solaris, it compiles but fails to > link against our libkrb5 due to missing symbols: > krb5_get_init_creds_opt_alloc krb5_get_init_creds_opt_free. > > I believe that the following in /etc/pam.conf is equivalent (actually > it is in some ways better because of pam_unix_cred) to building sudo > with Kerberos support but I'm not completely sure (and I'm not the > project team either). > > sudo auth required pam_unix_cred.so > sudo auth required pam_krb5.so. > Thanks for the clarification. Sounds like just using PAM is definitely the right approach for Solaris. :-) -- Garrett From jek3@sun.com Tue Jun 10 12:18:07 2008 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m5AJI7PV005872 for ; Tue, 10 Jun 2008 12:18:07 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m5AJHtBq018633; Tue, 10 Jun 2008 20:17:59 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K29006MOHLYSK00@nwk-avmta-1.sfbay.Sun.COM>; Tue, 10 Jun 2008 12:17:58 -0700 (PDT) Received: from jurassic-x4600.sfbay.sun.com ([129.146.17.59]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K29003JLHKESA30@nwk-avmta-1.sfbay.Sun.COM>; Tue, 10 Jun 2008 12:17:02 -0700 (PDT) Received: from [129.150.13.200] (vpn-129-150-13-200.SFBay.Sun.COM [129.150.13.200]) by jurassic-x4600.sfbay.sun.com (8.14.3+Sun/8.14.3) with ESMTP id m5AJH1FN604633; Tue, 10 Jun 2008 12:17:01 -0700 (PDT) Date: Tue, 10 Jun 2008 09:19:40 -1000 From: Joseph Kowalski Subject: Re: sudo [PSARC/2008/370 FastTrack timeout 06/17/2008] In-reply-to: <484EB4DA.2040602@Sun.COM> To: Darren J Moffat Cc: "Garrett D'Amore" , PSARC-ext@sun.com, Joep.Vesseur@sun.com, Tony.Nguyen@sun.com Message-id: <484ED3CC.8070102@sun.com> MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200806101416.m5AEGvj4021451@sac.sfbay.sun.com> <484EA1E4.4020007@sun.com> <484EB4DA.2040602@Sun.COM> User-Agent: Thunderbird 2.0.0.9 (X11/20080225) Status: RO Content-Length: 1511 Darren J Moffat wrote: > With my ARC hat on I don't think we shouldn't be vandalising upstream > man pages like this in my opinion. This case is to ship sudo as is > and the case explictly says so. We don't list all the other things > that don't do auditing yet authenticate users, for example webmin > authenticates users but doesn't audit, Apache has modules to > authenticate unix users and doesn't audit. We didn't change those > other components documentation to say they don't audit so I don't > think we should ask this project to to that to the sudo ones. I'm not sure I agree with this. We understand that we have little control about the content of the actual binaries. The only thing we can control is the documentation (more exactly, supplement the documentation). We should *never* make subjective statements in the documentation, but factual "Danger Will Robertson" NOTES seem quite appropriate. (Note, there is a minor discussion about this on OpenSolaris.... A community member would like to add such NOTES, but doesn't want to because it means "unzipping - editing - zipping" the upstream "tar/zip file.) Also, we know that many things don't audit. We know that su does audit. The expectation would be that "When in Rome, act like a Roman" (where have I heard that before?). Because su does auditing, the expectation would be that sudo would do auditing. Since it doesn't (for reasonable reasons - future directions), we should address that expectation. - jek3 From jek3@sun.com Tue Jun 10 12:26:02 2008 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m5AJQ1lO005931 for ; Tue, 10 Jun 2008 12:26:02 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id m5AJPclo013536; Wed, 11 Jun 2008 03:25:54 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K2900805HZ43L00@nwk-avmta-1.sfbay.Sun.COM>; Tue, 10 Jun 2008 12:25:52 -0700 (PDT) Received: from jurassic-x4600.sfbay.sun.com ([129.146.17.63]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K29003EXHZ4SA40@nwk-avmta-1.sfbay.Sun.COM>; Tue, 10 Jun 2008 12:25:52 -0700 (PDT) Received: from [129.150.13.200] (vpn-129-150-13-200.SFBay.Sun.COM [129.150.13.200]) by jurassic-x4600.sfbay.sun.com (8.14.3+Sun/8.14.3) with ESMTP id m5AJPp8J605575; Tue, 10 Jun 2008 12:25:51 -0700 (PDT) Date: Tue, 10 Jun 2008 09:28:30 -1000 From: Joseph Kowalski Subject: Re: sudo [PSARC/2008/370 FastTrack timeout 06/17/2008] In-reply-to: <484EBC05.3080700@Sun.COM> To: Darren J Moffat Cc: "Garrett D'Amore" , PSARC-ext@sun.com, Joep.Vesseur@sun.com, Tony.Nguyen@sun.com Message-id: <484ED5DE.1090308@sun.com> MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200806101416.m5AEGvj4021451@sac.sfbay.sun.com> <484EA1E4.4020007@sun.com> <484EB4DA.2040602@Sun.COM> <484EBA57.2020103@sun.com> <484EBC05.3080700@Sun.COM> User-Agent: Thunderbird 2.0.0.9 (X11/20080225) Status: RO Content-Length: 505 Darren J Moffat wrote: > That assumes that said person who is used to using sudo would actually > read the Solaris provided man page. Something about being to "lead a horse to water, but ...". :-) I actually think this is a "call reduction" issue. "said person" doesn't proactively read the Solaris man page. "said person" runs into something "said person" doesn't expect. "said person" *then* reads the Solaris man page and realizes that he should *not* call Sun Support. - jek3 From Alan.Coopersmith@sun.com Tue Jun 10 12:46:11 2008 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m5AJkAGA006853 for ; Tue, 10 Jun 2008 12:46:11 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id m5AJk55v020616 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Wed, 11 Jun 2008 03:46:09 +0800 (SGT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K2900A0LIWVUQ00@brm-avmta-1.central.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 10 Jun 2008 13:46:07 -0600 (MDT) Received: from sca-es-mail-1.sun.com ([192.18.43.132]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K2900867IWTBF20@brm-avmta-1.central.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 10 Jun 2008 13:46:05 -0600 (MDT) Received: from fe-sfbay-10.sun.com ([192.18.43.129]) by sca-es-mail-1.sun.com (8.13.7+Sun/8.12.9) with ESMTP id m5AJk5UA008686 for ; Tue, 10 Jun 2008 12:46:05 -0700 (PDT) Received: from conversion-daemon.fe-sfbay-10.sun.com by fe-sfbay-10.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0K2900501ISSSA00@fe-sfbay-10.sun.com> (original mail from Alan.Coopersmith@Sun.COM) for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 10 Jun 2008 12:46:05 -0700 (PDT) Received: from almas.sfbay.sun.com ([129.146.106.93]) by fe-sfbay-10.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0K2900FOZIWOHVG0@fe-sfbay-10.sun.com>; Tue, 10 Jun 2008 12:46:05 -0700 (PDT) Date: Tue, 10 Jun 2008 12:46:00 -0700 From: Alan Coopersmith Subject: Re: sudo [PSARC/2008/370 FastTrack timeout 06/17/2008] In-reply-to: <484ED3CC.8070102@sun.com> Sender: Alan.Coopersmith@sun.com To: Joseph Kowalski Cc: Darren J Moffat , "Garrett D'Amore" , PSARC-ext@sun.com, Joep.Vesseur@sun.com, Tony.Nguyen@sun.com Message-id: <484ED9F8.8000104@sun.com> MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 X-Enigmail-Version: 0.95.1 References: <200806101416.m5AEGvj4021451@sac.sfbay.sun.com> <484EA1E4.4020007@sun.com> <484EB4DA.2040602@Sun.COM> <484ED3CC.8070102@sun.com> User-Agent: Thunderbird 2.0.0.6 (X11/20071203) Status: RO Content-Length: 746 Joseph Kowalski wrote: > We understand that we have little control about the content of the > actual binaries. The only thing we can control is the documentation > (more exactly, supplement the documentation). We should *never* make > subjective statements in the documentation, but factual "Danger Will > Robertson" NOTES seem quite appropriate. We already add an Attributes table to many (most?) upstream man pages, so "Does Solaris Auditing?" could be just another line we start adding to the table. (Is there something more useful to administrators than a boolean there? Like an audit record type which may be "none"?) -- -Alan Coopersmith- alan.coopersmith@sun.com Sun Microsystems, Inc. - X Window System Engineering From Jyri.Virkki@sun.com Tue Jun 10 13:08:33 2008 Received: from sunmail2sca.sfbay.sun.com (sunmail2sca.SFBay.Sun.COM [129.145.155.234]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m5AK8X9p008396 for ; Tue, 10 Jun 2008 13:08:33 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail2sca.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id m5AK8Wwc021473; Tue, 10 Jun 2008 13:08:33 -0700 (PDT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K2900C1KJY7QU00@nwk-avmta-1.sfbay.Sun.COM>; Tue, 10 Jun 2008 13:08:31 -0700 (PDT) Received: from brmea-mail-4.sun.com ([192.18.98.36]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K29003UMJY5SE80@nwk-avmta-1.sfbay.Sun.COM>; Tue, 10 Jun 2008 13:08:30 -0700 (PDT) Received: from dm-usca15-11.red.iplanet.com (host-185-56-18-192.iplanet.com [192.18.56.185] (may be forged)) by brmea-mail-4.sun.com (8.13.6+Sun/8.12.9) with ESMTP id m5AK8TOw021837; Tue, 10 Jun 2008 20:08:29 +0000 (GMT) Received: from buye.red.iplanet.com (buye [192.18.65.224]) by dm-usca15-11.red.iplanet.com (8.11.7p1+Sun/8.11.7/IPLANET,v1.2) with ESMTP id m5AK8Tm00535; Tue, 10 Jun 2008 13:08:29 -0700 (PDT) Received: from buye.red.iplanet.com (localhost [127.0.0.1]) by buye.red.iplanet.com (8.13.7+Sun/8.13.7) with ESMTP id m5AK8TEB004389; Tue, 10 Jun 2008 13:08:29 -0700 (PDT) Received: (from jyri@localhost) by buye.red.iplanet.com (8.13.7+Sun/8.13.7/Submit) id m5AK8TaQ004388; Tue, 10 Jun 2008 13:08:29 -0700 (PDT) Date: Tue, 10 Jun 2008 13:08:29 -0700 From: Jyri Virkki Subject: Re: sudo [PSARC/2008/370 FastTrack timeout 06/17/2008] In-reply-to: <484ED3CC.8070102@sun.com> To: Joseph Kowalski Cc: PSARC-ext@sun.com Message-id: <20080610200829.GD3812@sun.com> MIME-version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-disposition: inline X-PMX-Version: 5.4.1.325704 References: <200806101416.m5AEGvj4021451@sac.sfbay.sun.com> <484EA1E4.4020007@sun.com> <484EB4DA.2040602@Sun.COM> <484ED3CC.8070102@sun.com> User-Agent: Mutt/1.5.11 Status: RO Content-Length: 1453 Joseph Kowalski wrote: > > Darren J Moffat wrote: > >With my ARC hat on I don't think we shouldn't be vandalising upstream > >man pages like this in my opinion. This case is to ship sudo as is [...] > I'm not sure I agree with this. +1.. where truly applicable, adding OpenSolaris-specific section in manpages to document things users *must* know when running the given tool on OpenSolaris is vital. There can be many reasons why there's some vital piece of info that needs to be documented about running a tool on OpenSolaris that's not necessarily there on the generic manpage so I'm leaving the statement broad. Such changes need to be minimal and truly vital to justify, or don't bother, but sometimes they are needed. [I don't know if this case really needs it, haven't read enough. Just responding to the general principle of providing documentation that addresses the needs of OpenSolaris.] > (Note, there is a minor discussion about this on OpenSolaris.... A > community member would like to add such NOTES, but doesn't want to > because it means "unzipping - editing - zipping" the upstream "tar/zip > file.) If nothing else, they'll be adding the ubiquiteous "Source for ____ is available on http://opensolaris.org." so it's a given they need a manpage patch (unless writing it from scratch). So it's not impossible to add other vital info, if needed, while in there. -- Jyri J. Virkki - jyri.virkki@sun.com - Sun Microsystems From Joep.Vesseur@Sun.COM Tue Jun 10 13:15:55 2008 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m5AKFsSN009245 for ; Tue, 10 Jun 2008 13:15:55 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id m5AKFpPE001454; Wed, 11 Jun 2008 04:15:52 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K290000DKADYO00@nwk-avmta-2.sfbay.sun.com>; Tue, 10 Jun 2008 13:15:49 -0700 (PDT) Received: from sunnl.Holland.Sun.COM ([129.159.237.90]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K2900LQMKA9IT20@nwk-avmta-2.sfbay.sun.com>; Tue, 10 Jun 2008 13:15:46 -0700 (PDT) Received: from [10.16.117.32] (enigma.Holland.Sun.COM [10.16.117.32]) by sunnl.Holland.Sun.COM (8.13.8+Sun/8.13.8) with ESMTP id m5AKFjlw028449; Tue, 10 Jun 2008 22:15:45 +0200 (MEST) Date: Tue, 10 Jun 2008 22:15:45 +0200 From: Joep Vesseur Subject: Re: sudo [PSARC/2008/370 FastTrack timeout 06/17/2008] In-reply-to: <484ED9F8.8000104@sun.com> To: PSARC-ext@Sun.COM Cc: Tony.Nguyen@Sun.COM Message-id: <484EE0F1.5070905@Sun.COM> MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 X-Enigmail-Version: 0.95.1 References: <200806101416.m5AEGvj4021451@sac.sfbay.sun.com> <484EA1E4.4020007@sun.com> <484EB4DA.2040602@Sun.COM> <484ED3CC.8070102@sun.com> <484ED9F8.8000104@sun.com> User-Agent: Thunderbird 2.0.0.14 (X11/20080519) Status: RO Content-Length: 1041 On 06/10/08 21:46, Alan Coopersmith wrote: > Joseph Kowalski wrote: >> We understand that we have little control about the content of the >> actual binaries. The only thing we can control is the documentation >> (more exactly, supplement the documentation). We should *never* make >> subjective statements in the documentation, but factual "Danger Will >> Robertson" NOTES seem quite appropriate. > > We already add an Attributes table to many (most?) upstream man pages, > so "Does Solaris Auditing?" could be just another line we start adding > to the table. (Is there something more useful to administrators than > a boolean there? Like an audit record type which may be "none"?) > We'll take the suggestion of adding some words to the manpage with us in this phase. I like the suggestion of adding to the table, but it wouldn't make sense to do this for just this command. I'll ping the audit and doc folks to see if we can put a stick in the sand here, or whether we'll just go verbal and explain it in a NOTES section. Joep From jek3@Sun.COM Tue Jun 10 13:18:52 2008 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m5AKIpej009691 for ; Tue, 10 Jun 2008 13:18:51 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m5AKIjDJ015190; Tue, 10 Jun 2008 21:18:48 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K2900103KFA2L00@nwk-avmta-2.sfbay.sun.com>; Tue, 10 Jun 2008 13:18:46 -0700 (PDT) Received: from jurassic-x4600.sfbay.sun.com ([129.146.17.63]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K2900LZBKFAIT20@nwk-avmta-2.sfbay.sun.com>; Tue, 10 Jun 2008 13:18:46 -0700 (PDT) Received: from [129.150.13.200] (vpn-129-150-13-200.SFBay.Sun.COM [129.150.13.200]) by jurassic-x4600.sfbay.sun.com (8.14.3+Sun/8.14.3) with ESMTP id m5AKIjic613880; Tue, 10 Jun 2008 13:18:45 -0700 (PDT) Date: Tue, 10 Jun 2008 10:21:24 -1000 From: Joseph Kowalski Subject: Re: sudo [PSARC/2008/370 FastTrack timeout 06/17/2008] In-reply-to: <484ED9F8.8000104@sun.com> To: Alan Coopersmith Cc: Darren J Moffat , "Garrett D'Amore" , PSARC-ext@Sun.COM, Joep.Vesseur@Sun.COM, Tony.Nguyen@Sun.COM Message-id: <484EE244.2060104@sun.com> MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200806101416.m5AEGvj4021451@sac.sfbay.sun.com> <484EA1E4.4020007@sun.com> <484EB4DA.2040602@Sun.COM> <484ED3CC.8070102@sun.com> <484ED9F8.8000104@sun.com> User-Agent: Thunderbird 2.0.0.9 (X11/20080225) Status: RO Content-Length: 862 Alan Coopersmith wrote: > Joseph Kowalski wrote: > >> We understand that we have little control about the content of the >> actual binaries. The only thing we can control is the documentation >> (more exactly, supplement the documentation). We should *never* make >> subjective statements in the documentation, but factual "Danger Will >> Robertson" NOTES seem quite appropriate. >> > > We already add an Attributes table to many (most?) upstream man pages, > so "Does Solaris Auditing?" could be just another line we start adding > to the table. (Is there something more useful to administrators than > a boolean there? Like an audit record type which may be "none"?) > Hummm,... at first look, I liked this, but the more I thought about it it isn't that easy. Do we want to add an "auditable" entry to a couple of dozen man pages? - jek3 From gdamore@sun.com Tue Jun 10 14:23:40 2008 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m5ALNdmw012188 for ; Tue, 10 Jun 2008 14:23:39 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id m5ALNUNc025114 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Wed, 11 Jun 2008 05:23:38 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K290030BNFCSR00@nwk-avmta-2.sfbay.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 10 Jun 2008 14:23:36 -0700 (PDT) Received: from sca-es-mail-1.sun.com ([192.18.43.132]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K2900LHTNFBII70@nwk-avmta-2.sfbay.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 10 Jun 2008 14:23:35 -0700 (PDT) Received: from fe-sfbay-10.sun.com ([192.18.43.129]) by sca-es-mail-1.sun.com (8.13.7+Sun/8.12.9) with ESMTP id m5ALNZkV024343 for ; Tue, 10 Jun 2008 14:23:35 -0700 (PDT) Received: from conversion-daemon.fe-sfbay-10.sun.com by fe-sfbay-10.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0K2900G01MUIA100@fe-sfbay-10.sun.com> (original mail from gdamore@sun.com) for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 10 Jun 2008 14:23:35 -0700 (PDT) Received: from [192.168.251.106] ([76.174.83.55]) by fe-sfbay-10.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0K29003C0NF5X630@fe-sfbay-10.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 10 Jun 2008 14:23:30 -0700 (PDT) Date: Tue, 10 Jun 2008 14:22:37 -0700 From: "Garrett D'Amore" Subject: Re: sudo [PSARC/2008/370 FastTrack timeout 06/17/2008] In-reply-to: <484EE0F1.5070905@Sun.COM> Sender: Garrett.Damore@sun.com To: Joep Vesseur Cc: PSARC-ext@sun.com, Tony.Nguyen@sun.com Message-id: <484EF09D.7010505@sun.com> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200806101416.m5AEGvj4021451@sac.sfbay.sun.com> <484EA1E4.4020007@sun.com> <484EB4DA.2040602@Sun.COM> <484ED3CC.8070102@sun.com> <484ED9F8.8000104@sun.com> <484EE0F1.5070905@Sun.COM> User-Agent: Thunderbird 2.0.0.6 (X11/20071023) Status: RO Content-Length: 1281 Joep Vesseur wrote: > On 06/10/08 21:46, Alan Coopersmith wrote: > >> Joseph Kowalski wrote: >> >>> We understand that we have little control about the content of the >>> actual binaries. The only thing we can control is the documentation >>> (more exactly, supplement the documentation). We should *never* make >>> subjective statements in the documentation, but factual "Danger Will >>> Robertson" NOTES seem quite appropriate. >>> >> We already add an Attributes table to many (most?) upstream man pages, >> so "Does Solaris Auditing?" could be just another line we start adding >> to the table. (Is there something more useful to administrators than >> a boolean there? Like an audit record type which may be "none"?) >> >> > > We'll take the suggestion of adding some words to the manpage with us > in this phase. > > I like the suggestion of adding to the table, but it wouldn't make sense to do > this for just this command. I'll ping the audit and doc folks to see if we can > put a stick in the sand here, or whether we'll just go verbal and explain it > in a NOTES section. > To the ARC at large: Does creation of new "Attribute" warrant a case on its own? (Could be an easy fast track, if not controversial.) -- Garrett > Joep > From jek3@sun.com Tue Jun 10 14:46:34 2008 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m5ALkXs3013581 for ; Tue, 10 Jun 2008 14:46:33 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m5ALkQ8N024134; Tue, 10 Jun 2008 22:46:30 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K290040DOHFRP00@nwk-avmta-2.sfbay.sun.com>; Tue, 10 Jun 2008 14:46:27 -0700 (PDT) Received: from jurassic-x4600.sfbay.sun.com ([129.146.17.63]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K2900LF7OHEIC90@nwk-avmta-2.sfbay.sun.com>; Tue, 10 Jun 2008 14:46:26 -0700 (PDT) Received: from [129.150.13.200] (vpn-129-150-13-200.SFBay.Sun.COM [129.150.13.200]) by jurassic-x4600.sfbay.sun.com (8.14.3+Sun/8.14.3) with ESMTP id m5ALkQwB630188; Tue, 10 Jun 2008 14:46:26 -0700 (PDT) Date: Tue, 10 Jun 2008 11:49:05 -1000 From: Joseph Kowalski Subject: Re: sudo [PSARC/2008/370 FastTrack timeout 06/17/2008] In-reply-to: <484EF09D.7010505@sun.com> To: "Garrett D'Amore" Cc: Joep Vesseur , PSARC-ext@sun.com, Tony.Nguyen@sun.com Message-id: <484EF6D1.9050601@sun.com> MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200806101416.m5AEGvj4021451@sac.sfbay.sun.com> <484EA1E4.4020007@sun.com> <484EB4DA.2040602@Sun.COM> <484ED3CC.8070102@sun.com> <484ED9F8.8000104@sun.com> <484EE0F1.5070905@Sun.COM> <484EF09D.7010505@sun.com> User-Agent: Thunderbird 2.0.0.9 (X11/20080225) Status: RO Content-Length: 676 Garrett D'Amore wrote: > To the ARC at large: Does creation of new "Attribute" warrant a case > on its own? (Could be an easy fast track, if not controversial.) 1) Don't burden this case with it. 2) Find out if there is anything close to the resources to do this (I doubt it.) There is no reason to define an "interface" (which the man pages are), if there isn't a project to implement this. ENOBUSYWORK. If there is interest, yes, I would suggest a fast track. Its not about the entries an the man pages. Its about the paragraph in intro(X) which gives it a clear semantic. The one about standards is much more complicated than one might expect. - jek3 From gdamore@Sun.COM Tue Jun 10 14:51:17 2008 Received: from sunmail2sca.sfbay.sun.com (sunmail2sca.SFBay.Sun.COM [129.145.155.234]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m5ALpHYU013851 for ; Tue, 10 Jun 2008 14:51:17 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail2sca.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id m5ALpH73017662 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Tue, 10 Jun 2008 14:51:17 -0700 (PDT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K290000BOPHRF00@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 10 Jun 2008 14:51:17 -0700 (PDT) Received: from sca-es-mail-2.sun.com ([192.18.43.133]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K290039OOPGS5E0@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 10 Jun 2008 14:51:16 -0700 (PDT) Received: from fe-sfbay-09.sun.com ([192.18.43.129]) by sca-es-mail-2.sun.com (8.13.7+Sun/8.12.9) with ESMTP id m5ALpGrF018568 for ; Tue, 10 Jun 2008 14:51:16 -0700 (PDT) Received: from conversion-daemon.fe-sfbay-09.sun.com by fe-sfbay-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0K2900D01ON9UR00@fe-sfbay-09.sun.com> (original mail from gdamore@sun.com) for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 10 Jun 2008 14:51:16 -0700 (PDT) Received: from [192.168.251.106] ([76.174.83.55]) by fe-sfbay-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0K2900FBUOPF7N90@fe-sfbay-09.sun.com>; Tue, 10 Jun 2008 14:51:15 -0700 (PDT) Date: Tue, 10 Jun 2008 14:50:22 -0700 From: "Garrett D'Amore" Subject: Re: sudo [PSARC/2008/370 FastTrack timeout 06/17/2008] In-reply-to: <484EF6D1.9050601@sun.com> Sender: Garrett.Damore@Sun.COM To: Joseph Kowalski Cc: Joep Vesseur , PSARC-ext@Sun.COM, Tony.Nguyen@Sun.COM Message-id: <484EF71E.6040608@sun.com> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200806101416.m5AEGvj4021451@sac.sfbay.sun.com> <484EA1E4.4020007@sun.com> <484EB4DA.2040602@Sun.COM> <484ED3CC.8070102@sun.com> <484ED9F8.8000104@sun.com> <484EE0F1.5070905@Sun.COM> <484EF09D.7010505@sun.com> <484EF6D1.9050601@sun.com> User-Agent: Thunderbird 2.0.0.6 (X11/20071023) Status: RO Content-Length: 1111 Joseph Kowalski wrote: > Garrett D'Amore wrote: >> To the ARC at large: Does creation of new "Attribute" warrant a case >> on its own? (Could be an easy fast track, if not controversial.) > > 1) Don't burden this case with it. > > 2) Find out if there is anything close to the resources to do this > (I doubt it.) There is no reason to define an "interface" (which the > man pages are), if there isn't a project to implement this. ENOBUSYWORK. > > > If there is interest, yes, I would suggest a fast track. Its not > about the entries an the man pages. Its about the paragraph in > intro(X) which gives it a clear semantic. The one about standards is > much more complicated than one might expect. I totally agree. If the team just adds a NOTES section comment or somesuch, then its much simpler. I just wanted to make sure if they were going to add a new entry to the Attributes table instead, that any appropriate background work is done. I suspect its not worth it, and not this case. (Though if they went that route, this case could depend on it.) -- Garrett > > > - jek3 > From lists@mcintyreweb.com Wed Jun 11 01:26:08 2008 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m5B8Q4Yc003073 for ; Wed, 11 Jun 2008 01:26:08 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id m5B8PkqR006714; Wed, 11 Jun 2008 16:25:57 +0800 (SGT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K2A00209I37PP00@brm-avmta-1.central.sun.com>; Wed, 11 Jun 2008 02:25:55 -0600 (MDT) Received: from sca-ea-mail-4.sun.com ([192.18.43.22]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K2A0081II36NAA0@brm-avmta-1.central.sun.com>; Wed, 11 Jun 2008 02:25:54 -0600 (MDT) Received: from relay22.sun.com (relay22.sun.com [192.12.251.34] (may be forged)) by sca-ea-mail-4.sun.com (8.13.6+Sun/8.12.9) with ESMTP id m5B8NU7q022321; Wed, 11 Jun 2008 08:25:54 +0000 (GMT) Received: from mms25es.mms.us.syntegra.com ([150.143.232.90] [150.143.232.90]) by relay22i.sun.com with ESMTP id BT-MMP-891722; Wed, 11 Jun 2008 08:25:53 +0000 (Z) Received: from relay22.sun.com (relay22.sun.com [192.12.251.34]) by mms25es.mms.us.syntegra.com with ESMTP id BT-MMP-26901106; Wed, 11 Jun 2008 08:25:53 +0000 (Z) Received: from partslist.i.mcintyreweb.com ([64.166.3.74] [64.166.3.74]) by relay22i.sun.com with ESMTP id BT-MMP-33304198; Wed, 11 Jun 2008 08:25:53 +0000 (Z) Received: from [127.0.0.1] (localhost [127.0.0.1]) by partslist.i.mcintyreweb.com (8.13.8+Sun/8.13.8) with ESMTP id m5B8PlhJ022885; Wed, 11 Jun 2008 01:25:47 -0700 (PDT) Date: Wed, 11 Jun 2008 01:25:47 -0700 From: Hugh McIntyre Subject: Re: sudo [PSARC/2008/370 FastTrack timeout 06/17/2008] In-reply-to: <484ED9F8.8000104@sun.com> To: Alan Coopersmith Cc: Joseph Kowalski , Tony.Nguyen@sun.com, PSARC-ext@sun.com, Joep.Vesseur@sun.com, "Garrett D'Amore" Message-id: <484F8C0B.7090106@mcintyreweb.com> MIME-version: 1.0 Content-type: text/plain; charset=us-ascii; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 X-Brightmail-Tracker: AAAAAA== X-Antispam: No, score=0.0/5.0, scanned in 0.080sec at (localhost [127.0.0.1]) by smf-spamd v1.3.1 - http://smfs.sf.net/ References: <200806101416.m5AEGvj4021451@sac.sfbay.sun.com> <484EA1E4.4020007@sun.com> <484EB4DA.2040602@Sun.COM> <484ED3CC.8070102@sun.com> <484ED9F8.8000104@sun.com> User-Agent: Thunderbird 2.0.0.9 (X11/20071119) Status: RO Content-Length: 1092 Alan Coopersmith wrote: > Joseph Kowalski wrote: >> We understand that we have little control about the content of the >> actual binaries. The only thing we can control is the documentation >> (more exactly, supplement the documentation). We should *never* make >> subjective statements in the documentation, but factual "Danger Will >> Robertson" NOTES seem quite appropriate. > > We already add an Attributes table to many (most?) upstream man pages, > so "Does Solaris Auditing?" could be just another line we start adding > to the table. (Is there something more useful to administrators than > a boolean there? Like an audit record type which may be "none"?) It seems to me that this is the type of thing there used to be a BUGS section in manpages for. Before BUGS got sadly renamed to NOTES. More specifically, a spelled out statement under NOTES that "sudo does not do Solaris auditing; if you need auditing, disable sudo and use RBAC instead." is more likely to be noticed and useful than an item in an attributes table of "Auditing: None" without explanation. Hugh. From darrenm@opensolaris.org Wed Jun 11 02:04:45 2008 Received: from sunmail3mpk.sfbay.sun.com (sunmail3mpk.SFBay.Sun.COM [129.146.11.52]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m5B94ifk003736 for ; Wed, 11 Jun 2008 02:04:45 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail3mpk.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id m5B94iBQ004235 for <@sunmail2sca.sfbay.sun.com:PSARC-EXT@sun.com>; Wed, 11 Jun 2008 02:04:44 -0700 (PDT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K2A00E03JVWLP00@nwk-avmta-2.sfbay.sun.com> for PSARC-EXT@sun.com (ORCPT PSARC-EXT@sun.com); Wed, 11 Jun 2008 02:04:44 -0700 (PDT) Received: from gmp-eb-inf-2.sun.com ([192.18.6.24]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K2A0093MJVSKA70@nwk-avmta-2.sfbay.sun.com> for PSARC-EXT@sun.com (ORCPT PSARC-EXT@sun.com); Wed, 11 Jun 2008 02:04:44 -0700 (PDT) Received: from fe-emea-09.sun.com (gmp-eb-lb-2-fe2.eu.sun.com [192.18.6.11]) by gmp-eb-inf-2.sun.com (8.13.7+Sun/8.12.9) with ESMTP id m5B94dN4021085 for ; Wed, 11 Jun 2008 09:04:39 +0000 (GMT) Received: from conversion-daemon.fe-emea-09.sun.com by fe-emea-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0K2A00C01J43K500@fe-emea-09.sun.com> (original mail from darrenm@opensolaris.org) for PSARC-EXT@sun.com (ORCPT PSARC-EXT@sun.com); Wed, 11 Jun 2008 10:04:39 +0100 (BST) Received: from [129.156.173.21] by fe-emea-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0K2A00M4GJV7BC10@fe-emea-09.sun.com> for PSARC-EXT@sun.com (ORCPT PSARC-EXT@sun.com); Wed, 11 Jun 2008 10:04:20 +0100 (BST) Date: Wed, 11 Jun 2008 10:04:19 +0100 From: Darren J Moffat Subject: Re: sudo [PSARC/2008/370 FastTrack timeout 06/17/2008] In-reply-to: <3578049.1213153343640.JavaMail.Twebapp@oss-app1> Sender: Darren.Moffat@sun.com To: "Richard L. Hamilton" Cc: PSARC-EXT@sun.com Message-id: <484F9513.9010002@opensolaris.org> Organization: OpenSolaris MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <3578049.1213153343640.JavaMail.Twebapp@oss-app1> User-Agent: Thunderbird 2.0.0.14 (X11/20080507) Status: RO Content-Length: 1107 Richard L. Hamilton wrote: > [...] >>>> sudo(1) will be explicitly left out of the >> CC evalua- >>> tion target. >>>> >>> I probably should know what this means... Help me >> Mr. Wizard... >> >> Common Criteria evaluation. sudo will be outside of >> the Target of >> Evaluation. >> > > Is there documentation or meta-packaging (to be updated for such as this) > which will collect such disclaimers or constraints, so that sites may replicate > an evaluated configuration, or at any rate limit themselves to packages that > were part of an evaluated configuration? Preferably in a single place, not > spread across a multitude of man pages... That is what the Target of Evaluation document describes. The ToE documents and certificates as well as any other needed information (such as patch lists) are published here: http://www.sun.com/software/security/securitycert/ It is also published on the common criteria evaluation website for the appropriate product, for example for Solaris 10. http://www.commoncriteriaportal.org/files/epfiles/solaris10-sec-e.pdf -- Darren J Moffat From Darren.Moffat@sun.com Wed Jun 11 02:33:17 2008 Received: from sunmail2sca.sfbay.sun.com (sunmail2sca.SFBay.Sun.COM [129.145.155.234]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m5B9XHDd003851 for ; Wed, 11 Jun 2008 02:33:17 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail2sca.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id m5B9XFdn011235 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Wed, 11 Jun 2008 02:33:16 -0700 (PDT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K2A00C0VL7GX100@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 11 Jun 2008 02:33:16 -0700 (PDT) Received: from gmp-eb-inf-1.sun.com ([192.18.6.21]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K2A00829L7EEJ30@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 11 Jun 2008 02:33:15 -0700 (PDT) Received: from fe-emea-10.sun.com (gmp-eb-lb-2-fe2.eu.sun.com [192.18.6.11]) by gmp-eb-inf-1.sun.com (8.13.7+Sun/8.12.9) with ESMTP id m5B9XEsU022892 for ; Wed, 11 Jun 2008 09:33:14 +0000 (GMT) Received: from conversion-daemon.fe-emea-10.sun.com by fe-emea-10.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0K2A00001KS7NW00@fe-emea-10.sun.com> (original mail from Darren.Moffat@Sun.COM) for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 11 Jun 2008 10:33:14 +0100 (BST) Received: from [129.156.173.21] by fe-emea-10.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0K2A001JML7CEO10@fe-emea-10.sun.com>; Wed, 11 Jun 2008 10:33:13 +0100 (BST) Date: Wed, 11 Jun 2008 10:33:12 +0100 From: Darren J Moffat Subject: Re: sudo [PSARC/2008/370 FastTrack timeout 06/17/2008] In-reply-to: <484ED9F8.8000104@sun.com> Sender: Darren.Moffat@sun.com To: Alan Coopersmith Cc: Joseph Kowalski , "Garrett D'Amore" , PSARC-ext@sun.com, Joep.Vesseur@sun.com, Tony.Nguyen@sun.com Message-id: <484F9BD8.2060102@Sun.COM> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200806101416.m5AEGvj4021451@sac.sfbay.sun.com> <484EA1E4.4020007@sun.com> <484EB4DA.2040602@Sun.COM> <484ED3CC.8070102@sun.com> <484ED9F8.8000104@sun.com> User-Agent: Thunderbird 2.0.0.14 (X11/20080507) Status: RO Content-Length: 974 Alan Coopersmith wrote: > Joseph Kowalski wrote: >> We understand that we have little control about the content of the >> actual binaries. The only thing we can control is the documentation >> (more exactly, supplement the documentation). We should *never* make >> subjective statements in the documentation, but factual "Danger Will >> Robertson" NOTES seem quite appropriate. > > We already add an Attributes table to many (most?) upstream man pages, > so "Does Solaris Auditing?" could be just another line we start adding > to the table. (Is there something more useful to administrators than > a boolean there? Like an audit record type which may be "none"?) That is actually a really good suggestion of where to document auditing capabilities and is something that would be good to do for many existing Solaris components (like su, login, pfexec, smf etc etc). I'll investigate this with the audit project team offline from this case. -- Darren J Moffat From John.Plocher@sun.com Wed Jun 11 07:06:57 2008 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m5BE6uQ9008793 for ; Wed, 11 Jun 2008 07:06:57 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m5BE6phY023414 for <@sunmail2sca.sfbay.sun.com:PSARC-EXT@sun.com>; Wed, 11 Jun 2008 15:06:55 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K2A00J0DXVIG600@nwk-avmta-1.sfbay.Sun.COM> for PSARC-EXT@sun.com (ORCPT PSARC-EXT@Sun.COM); Wed, 11 Jun 2008 07:06:54 -0700 (PDT) Received: from sca-es-mail-1.sun.com ([192.18.43.132]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K2A00H7AXVI3IC0@nwk-avmta-1.sfbay.Sun.COM> for PSARC-EXT@sun.com (ORCPT PSARC-EXT@Sun.COM); Wed, 11 Jun 2008 07:06:54 -0700 (PDT) Received: from fe-sfbay-09.sun.com ([192.18.43.129]) by sca-es-mail-1.sun.com (8.13.7+Sun/8.12.9) with ESMTP id m5BE6slJ013866 for ; Wed, 11 Jun 2008 07:06:54 -0700 (PDT) Received: from conversion-daemon.fe-sfbay-09.sun.com by fe-sfbay-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0K2A00F01XTEXY00@fe-sfbay-09.sun.com> (original mail from John.Plocher@Sun.COM) for PSARC-EXT@Sun.COM (ORCPT PSARC-EXT@Sun.COM); Wed, 11 Jun 2008 07:06:54 -0700 (PDT) Received: from [192.168.168.4] ([208.74.177.212]) by fe-sfbay-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0K2A000BNXVG1F50@fe-sfbay-09.sun.com> for PSARC-EXT@Sun.COM (ORCPT PSARC-EXT@Sun.COM); Wed, 11 Jun 2008 07:06:52 -0700 (PDT) Date: Wed, 11 Jun 2008 07:06:52 -0700 From: John Plocher Subject: Re: sudo [PSARC/2008/370 FastTrack timeout 06/17/2008] In-reply-to: <484F9513.9010002@opensolaris.org> Sender: John.Plocher@sun.com To: Darren J Moffat Cc: "Richard L. Hamilton" , PSARC-EXT@sun.com Message-id: <484FDBFC.5050601@Sun.Com> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <3578049.1213153343640.JavaMail.Twebapp@oss-app1> <484F9513.9010002@opensolaris.org> User-Agent: Thunderbird 2.0.0.14 (Macintosh/20080421) Status: RO Content-Length: 763 Darren J Moffat wrote: > That is what the Target of Evaluation document describes. The TOE is a reactive document that says "here is what we used". The question here is proactive - how do we mark things in OpenSolaris with something that says: Hey Evaluation Project Team, When you finally get around to doing the next evaluated version OpenSolaris, you probably do not want to include [this] in the TOE because [... reason...]. We know *now* that sudo should not be part of such a system. How do we formally record that info now so it does not have to be reinvented at TOE-creation time? Furthermore, how do "other distro builders" get access to that label so that they can stay in sync with the "official" OpenSolaris TOE? -John From darrenm@opensolaris.org Wed Jun 11 08:20:09 2008 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m5BFK8qt010126 for ; Wed, 11 Jun 2008 08:20:08 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id m5BFK85r012618 for <@sunmail2sca.sfbay.sun.com:PSARC-EXT@sun.com>; Wed, 11 Jun 2008 09:20:08 -0600 (MDT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K2B00A0319JBT00@brm-avmta-1.central.sun.com> for PSARC-EXT@sun.com (ORCPT PSARC-EXT@Sun.COM); Wed, 11 Jun 2008 09:20:07 -0600 (MDT) Received: from gmp-eb-inf-1.sun.com ([192.18.6.21]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K2B0057P19HGY40@brm-avmta-1.central.sun.com> for PSARC-EXT@sun.com (ORCPT PSARC-EXT@Sun.COM); Wed, 11 Jun 2008 09:20:06 -0600 (MDT) Received: from fe-emea-10.sun.com (gmp-eb-lb-2-fe3.eu.sun.com [192.18.6.12]) by gmp-eb-inf-1.sun.com (8.13.7+Sun/8.12.9) with ESMTP id m5BFK5rv018296 for ; Wed, 11 Jun 2008 15:20:05 +0000 (GMT) Received: from conversion-daemon.fe-emea-10.sun.com by fe-emea-10.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0K2B009010DEJ600@fe-emea-10.sun.com> (original mail from darrenm@opensolaris.org) for PSARC-EXT@Sun.COM (ORCPT PSARC-EXT@Sun.COM); Wed, 11 Jun 2008 16:20:04 +0100 (BST) Received: from [129.156.173.21] by fe-emea-10.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0K2B00L1E195K490@fe-emea-10.sun.com> for PSARC-EXT@Sun.COM (ORCPT PSARC-EXT@Sun.COM); Wed, 11 Jun 2008 16:19:54 +0100 (BST) Date: Wed, 11 Jun 2008 16:19:53 +0100 From: Darren J Moffat Subject: Re: sudo [PSARC/2008/370 FastTrack timeout 06/17/2008] In-reply-to: <484FDBFC.5050601@Sun.Com> Sender: Darren.Moffat@sun.com To: John Plocher Cc: "Richard L. Hamilton" , PSARC-ext@sun.com Message-id: <484FED19.40903@opensolaris.org> Organization: OpenSolaris MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <3578049.1213153343640.JavaMail.Twebapp@oss-app1> <484F9513.9010002@opensolaris.org> <484FDBFC.5050601@Sun.Com> User-Agent: Thunderbird 2.0.0.14 (X11/20080507) Status: RO Content-Length: 1699 John Plocher wrote: > Darren J Moffat wrote: >> That is what the Target of Evaluation document describes. > > The TOE is a reactive document that says "here is what we used". > > The question here is proactive - how do we mark things in OpenSolaris > with something that says: > > Hey Evaluation Project Team, > When you finally get around to doing the next evaluated version > OpenSolaris, you probably do not want to include [this] in the > TOE because [... reason...]. > > We know *now* that sudo should not be part of such a system. How do > we formally record that info now so it does not have to be reinvented > at TOE-creation time? Is that actually important for us to solve to getting this case approved ? Please don't invent new process requires to this case. sudo is the number 1 requested component from the pkg.opensolaris.org repository. Why should it be a requirement for this case when it hasn't been a requirement for any other case that adds security relevant components ? I doubt most ARC members or listeners would have even known about this issue if we hadn't chosen to write it in the ARC material. > Furthermore, how do "other distro builders" get access to that > label so that they can stay in sync with the "official" OpenSolaris > TOE? The don't. The Sun Microsystems Solaris security team that does the Common Criteria evaluations is not funded to help other distributions do their evaluation. The evaluation of Solaris is not performed by the OpenSolaris community and is not an open process. I also don't see how any of this is relevant to ARC review. The TOE is not reviewed by ARC and not produced by ARC. -- Darren J Moffat From John.Plocher@sun.com Wed Jun 11 08:48:16 2008 Received: from sunmail3mpk.sfbay.sun.com (sunmail3mpk.SFBay.Sun.COM [129.146.11.52]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m5BFmGZa010599 for ; Wed, 11 Jun 2008 08:48:16 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail3mpk.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id m5BFm9Tc000229 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Wed, 11 Jun 2008 08:48:15 -0700 (PDT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K2B00C0H2KDAP00@brm-avmta-1.central.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 11 Jun 2008 09:48:13 -0600 (MDT) Received: from sca-es-mail-2.sun.com ([192.18.43.133]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K2B005252KAGX70@brm-avmta-1.central.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 11 Jun 2008 09:48:10 -0600 (MDT) Received: from fe-sfbay-09.sun.com ([192.18.43.129]) by sca-es-mail-2.sun.com (8.13.7+Sun/8.12.9) with ESMTP id m5BFmAbP005729 for ; Wed, 11 Jun 2008 08:48:10 -0700 (PDT) Received: from conversion-daemon.fe-sfbay-09.sun.com by fe-sfbay-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0K2B00G012789E00@fe-sfbay-09.sun.com> (original mail from John.Plocher@Sun.COM) for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 11 Jun 2008 08:48:10 -0700 (PDT) Received: from wp668.SFBay.Sun.COM ([129.146.226.219]) by fe-sfbay-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0K2B00IC82JZW8H0@fe-sfbay-09.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 11 Jun 2008 08:47:59 -0700 (PDT) Date: Wed, 11 Jun 2008 08:47:57 -0700 From: John Plocher Subject: Re: sudo [PSARC/2008/370 FastTrack timeout 06/17/2008] In-reply-to: <484FED19.40903@opensolaris.org> Sender: John.Plocher@sun.com To: Darren J Moffat Cc: "Richard L. Hamilton" , PSARC-ext@sun.com Message-id: <484FF3AD.8080606@Sun.Com> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <3578049.1213153343640.JavaMail.Twebapp@oss-app1> <484F9513.9010002@opensolaris.org> <484FDBFC.5050601@Sun.Com> <484FED19.40903@opensolaris.org> User-Agent: Thunderbird 2.0.0.14 (Macintosh/20080421) Status: RO Content-Length: 814 Darren J Moffat wrote: > I also don't see how any of this is relevant to ARC review. The "job" of the ARC is to look at things with a proactive eye towards things that might impact our ability to build systems and sets of systems that contain the project under review. As such, some of the outputs of the ARC process are a set of advice and findings that will help us avoid problems down the line. Obviously, interface stability and dependencies are a big part of this, but it is becoming clear that with all this FOSS stuff flowing in, tags like "This is not well integrated with the Solaris way of doing things" will have tremendous value as well. I don't give a rats ass about the TOE; I do care passionately about retaining our ability to build certifiable systems economically and efficiently. -John From carlsonj@phorcys.east.sun.com Wed Jun 11 09:05:34 2008 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m5BG5XMW011579 for ; Wed, 11 Jun 2008 09:05:34 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m5BG5P55017984; Wed, 11 Jun 2008 17:05:32 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K2B008093D57U00@nwk-avmta-1.sfbay.Sun.COM>; Wed, 11 Jun 2008 09:05:29 -0700 (PDT) Received: from phorcys.east.sun.com ([129.148.174.143]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K2B002V53D4C080@nwk-avmta-1.sfbay.Sun.COM>; Wed, 11 Jun 2008 09:05:29 -0700 (PDT) Received: from phorcys.east.sun.com (localhost [127.0.0.1]) by phorcys.east.sun.com (8.14.3+Sun/8.14.3) with ESMTP id m5BFoJap008475; Wed, 11 Jun 2008 11:50:19 -0400 (EDT) Received: (from carlsonj@localhost) by phorcys.east.sun.com (8.14.3+Sun/8.14.3/Submit) id m5BFoDN0008468; Wed, 11 Jun 2008 11:50:13 -0400 (EDT) Date: Wed, 11 Jun 2008 11:50:13 -0400 From: James Carlson Subject: Re: sudo [PSARC/2008/370 FastTrack timeout 06/17/2008] In-reply-to: <484FED19.40903@opensolaris.org> To: Darren J Moffat Cc: John Plocher , PSARC-ext@sun.com, "Richard L. Hamilton" Message-id: <18511.62517.4600.681604@gargle.gargle.HOWL> MIME-version: 1.0 X-Mailer: VM 7.01 under Emacs 21.3.1 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <3578049.1213153343640.JavaMail.Twebapp@oss-app1> <484F9513.9010002@opensolaris.org> <484FDBFC.5050601@Sun.Com> <484FED19.40903@opensolaris.org> Status: RO Content-Length: 694 Darren J Moffat writes: > I also don't see how any of this is relevant to ARC review. The TOE is > not reviewed by ARC and not produced by ARC. The interesting thing for this case, though, is that we're apparently making decisions about what architectural features are necessary based on whether something will ultimately show up in the TOE. If it's there, then it needs careful scrutiny for auditing and the like. If it's not, then that no longer applies. Right? -- James Carlson, Solaris Networking Sun Microsystems / 35 Network Drive 71.232W Vox +1 781 442 2084 MS UBUR02-212 / Burlington MA 01803-2757 42.496N Fax +1 781 442 1677 From darrenm@opensolaris.org Thu Jun 12 02:17:13 2008 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m5C9HCH2029827 for ; Thu, 12 Jun 2008 02:17:13 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id m5C9H7Ua022387 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Thu, 12 Jun 2008 17:17:11 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K2C0070HF4LGW00@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Thu, 12 Jun 2008 02:17:09 -0700 (PDT) Received: from gmp-eb-inf-2.sun.com ([192.18.6.24]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K2C001HTF4KHYB0@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Thu, 12 Jun 2008 02:17:09 -0700 (PDT) Received: from fe-emea-10.sun.com (gmp-eb-lb-2-fe3.eu.sun.com [192.18.6.12]) by gmp-eb-inf-2.sun.com (8.13.7+Sun/8.12.9) with ESMTP id m5C9H7KZ018779 for ; Thu, 12 Jun 2008 09:17:08 +0000 (GMT) Received: from conversion-daemon.fe-emea-10.sun.com by fe-emea-10.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0K2C00H01EBXGA00@fe-emea-10.sun.com> (original mail from darrenm@opensolaris.org) for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Thu, 12 Jun 2008 10:17:07 +0100 (BST) Received: from [129.156.173.21] by fe-emea-10.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0K2C00H1CF4H09B0@fe-emea-10.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Thu, 12 Jun 2008 10:17:07 +0100 (BST) Date: Thu, 12 Jun 2008 10:17:05 +0100 From: Darren J Moffat Subject: Re: sudo [PSARC/2008/370 FastTrack timeout 06/17/2008] In-reply-to: <18511.62517.4600.681604@gargle.gargle.HOWL> Sender: Darren.Moffat@sun.com To: James Carlson Cc: John Plocher , "Richard L. Hamilton" , PSARC-ext@sun.com Message-id: <4850E991.3040705@opensolaris.org> Organization: OpenSolaris MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <3578049.1213153343640.JavaMail.Twebapp@oss-app1> <484F9513.9010002@opensolaris.org> <484FDBFC.5050601@Sun.Com> <484FED19.40903@opensolaris.org> <18511.62517.4600.681604@gargle.gargle.HOWL> User-Agent: Thunderbird 2.0.0.14 (X11/20080507) Status: RO Content-Length: 2298 James Carlson wrote: > Darren J Moffat writes: >> I also don't see how any of this is relevant to ARC review. The TOE is >> not reviewed by ARC and not produced by ARC. > > The interesting thing for this case, though, is that we're apparently > making decisions about what architectural features are necessary based > on whether something will ultimately show up in the TOE. I don't think we (at least not the Solaris security group we) are, because if we were this case wouldn't exist because adding sudo isn't necessary for Common Criteria evaluation. sudo is necessary for familiarisation. In fact it is quite the opposite to that we are adding features that are security relevant that won't necessarily be in the TOE - just like we have been doing so for years. Yes there is an issue with all this upstream FOSS that is being added to Solaris and what the impact on the evaluation target for Common Criteria is. However that issue already exists regardless of any upstream FOSS just based on new code added to Solaris. For example zones had a big impact on evaluations, so does the crypto framework. I don't think this case should be held to fixing this long standing issue just because it did the correct thing. It is an important discussion to have but I don't think this case is the place to do it. On the other hand maybe sudo will be in the target of evaluation of some future OpenSolaris based distro if all the followon projects work out well. Or maybe some non Sun OpenSolaris distro finds the (huge) amount of money to do a common criteria eval and they choose to put sudo in. I'm really sorry I suggest the project team mention this in the case materials because otherwise I think this case would have just sailed through. > If it's > there, then it needs careful scrutiny for auditing and the like. If > it's not, then that no longer applies. Generation of audit records is mostly done by the kernel, sudo is purely a userland application. As I said in my other email it isn't that sudo will stop audit records it just won't add any new ones like pfexec does. I don't see an issue with that for the first integration and it is why the case says we will work with the upstream community to consider adding more auditing. -- Darren J Moffat From carlsonj@phorcys.east.sun.com Thu Jun 12 05:04:31 2008 Received: from sunmail3mpk.sfbay.sun.com (sunmail3mpk.SFBay.Sun.COM [129.146.11.52]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m5CC4Vtx002579 for ; Thu, 12 Jun 2008 05:04:31 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail3mpk.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id m5CC4UJM011330; Thu, 12 Jun 2008 05:04:30 -0700 (PDT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K2C00201MVIDN00@nwk-avmta-1.sfbay.Sun.COM>; Thu, 12 Jun 2008 05:04:30 -0700 (PDT) Received: from phorcys.east.sun.com ([129.148.174.143]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K2C00KG5MVITG20@nwk-avmta-1.sfbay.Sun.COM>; Thu, 12 Jun 2008 05:04:30 -0700 (PDT) Received: from phorcys.east.sun.com (localhost [127.0.0.1]) by phorcys.east.sun.com (8.14.3+Sun/8.14.3) with ESMTP id m5CBnUkt012254; Thu, 12 Jun 2008 07:49:30 -0400 (EDT) Received: (from carlsonj@localhost) by phorcys.east.sun.com (8.14.3+Sun/8.14.3/Submit) id m5CBnUmi012251; Thu, 12 Jun 2008 07:49:30 -0400 (EDT) Date: Thu, 12 Jun 2008 07:49:30 -0400 From: James Carlson Subject: Re: sudo [PSARC/2008/370 FastTrack timeout 06/17/2008] In-reply-to: <4850E991.3040705@opensolaris.org> To: Darren J Moffat Cc: John Plocher , "Richard L. Hamilton" , PSARC-ext@sun.com Message-id: <18513.3402.497621.177350@gargle.gargle.HOWL> MIME-version: 1.0 X-Mailer: VM 7.01 under Emacs 21.3.1 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <3578049.1213153343640.JavaMail.Twebapp@oss-app1> <484F9513.9010002@opensolaris.org> <484FDBFC.5050601@Sun.Com> <484FED19.40903@opensolaris.org> <18511.62517.4600.681604@gargle.gargle.HOWL> <4850E991.3040705@opensolaris.org> Status: RO Content-Length: 2978 Darren J Moffat writes: > James Carlson wrote: > > Darren J Moffat writes: > >> I also don't see how any of this is relevant to ARC review. The TOE is > >> not reviewed by ARC and not produced by ARC. > > > > The interesting thing for this case, though, is that we're apparently > > making decisions about what architectural features are necessary based > > on whether something will ultimately show up in the TOE. > > I don't think we (at least not the Solaris security group we) are, > because if we were this case wouldn't exist because adding sudo isn't > necessary for Common Criteria evaluation. sudo is necessary for Suppose (besides being "necessary") we decided we *wanted* to include sudo in the TOE. Would this project proposal look any different? If yes, then doesn't that mean that there's an architectural issue here with respect to the things that are deemed to be "necessary" for the TOE and those that are not? > Yes there is an issue with all this upstream FOSS that is being added to > Solaris and what the impact on the evaluation target for Common Criteria > is. However that issue already exists regardless of any upstream FOSS > just based on new code added to Solaris. For example zones had a big > impact on evaluations, so does the crypto framework. Sure; agreed. > I'm really sorry I suggest the project team mention this in the case > materials because otherwise I think this case would have just sailed > through. No need to be sorry. I'm asking questions so that I understand the boundaries and implications of the case. There are decisions being made here that appear to affect the way in which we integrate certain bits of software, and that are possibly architectural in nature, but that are not being expressed as architectural rules. That seems at least a bit confusing to me. > > If it's > > there, then it needs careful scrutiny for auditing and the like. If > > it's not, then that no longer applies. > > Generation of audit records is mostly done by the kernel, sudo is purely > a userland application. As I said in my other email it isn't that sudo > will stop audit records it just won't add any new ones like pfexec does. Right ... and wouldn't we include that additional auditing information, just like pfexec, if we were considering sudo for evaluation? In fact, wouldn't we _insist_ on it? > I don't see an issue with that for the first integration and it is why > the case says we will work with the upstream community to consider > adding more auditing. I'm not asking any such thing. I don't want auditing in sudo. I don't care whether it has it or not. I'm asking to understand the principle behind the decision being made, as it likely affects future cases. -- James Carlson, Solaris Networking Sun Microsystems / 35 Network Drive 71.232W Vox +1 781 442 2084 MS UBUR02-212 / Burlington MA 01803-2757 42.496N Fax +1 781 442 1677 From darrenm@opensolaris.org Thu Jun 12 07:46:06 2008 Received: from sunmail3mpk.sfbay.sun.com (sunmail3mpk.SFBay.Sun.COM [129.146.11.52]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m5CEk6Jt007286 for ; Thu, 12 Jun 2008 07:46:06 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail3mpk.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id m5CEk5hW029793 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Thu, 12 Jun 2008 07:46:06 -0700 (PDT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K2C00M0LUCSFM00@nwk-avmta-2.sfbay.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Thu, 12 Jun 2008 07:46:04 -0700 (PDT) Received: from gmp-eb-inf-2.sun.com ([192.18.6.24]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K2C00L0AUCPI820@nwk-avmta-2.sfbay.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Thu, 12 Jun 2008 07:46:02 -0700 (PDT) Received: from fe-emea-09.sun.com (gmp-eb-lb-2-fe1.eu.sun.com [192.18.6.10]) by gmp-eb-inf-2.sun.com (8.13.7+Sun/8.12.9) with ESMTP id m5CEk0pc009466 for ; Thu, 12 Jun 2008 14:46:01 +0000 (GMT) Received: from conversion-daemon.fe-emea-09.sun.com by fe-emea-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0K2C00A01TOH9X00@fe-emea-09.sun.com> (original mail from darrenm@opensolaris.org) for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Thu, 12 Jun 2008 15:45:59 +0100 (BST) Received: from [129.156.173.21] by fe-emea-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0K2C00CS6UBSAA30@fe-emea-09.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Thu, 12 Jun 2008 15:45:29 +0100 (BST) Date: Thu, 12 Jun 2008 15:45:27 +0100 From: Darren J Moffat Subject: Re: sudo [PSARC/2008/370 FastTrack timeout 06/17/2008] In-reply-to: <18513.3402.497621.177350@gargle.gargle.HOWL> Sender: Darren.Moffat@sun.com To: James Carlson Cc: John Plocher , "Richard L. Hamilton" , PSARC-ext@sun.com Message-id: <48513687.6070702@opensolaris.org> Organization: OpenSolaris MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <3578049.1213153343640.JavaMail.Twebapp@oss-app1> <484F9513.9010002@opensolaris.org> <484FDBFC.5050601@Sun.Com> <484FED19.40903@opensolaris.org> <18511.62517.4600.681604@gargle.gargle.HOWL> <4850E991.3040705@opensolaris.org> <18513.3402.497621.177350@gargle.gargle.HOWL> User-Agent: Thunderbird 2.0.0.14 (X11/20080507) Status: RO Content-Length: 4012 James Carlson wrote: > Darren J Moffat writes: >> James Carlson wrote: >>> Darren J Moffat writes: >>>> I also don't see how any of this is relevant to ARC review. The TOE is >>>> not reviewed by ARC and not produced by ARC. >>> The interesting thing for this case, though, is that we're apparently >>> making decisions about what architectural features are necessary based >>> on whether something will ultimately show up in the TOE. >> I don't think we (at least not the Solaris security group we) are, >> because if we were this case wouldn't exist because adding sudo isn't >> necessary for Common Criteria evaluation. sudo is necessary for > > Suppose (besides being "necessary") we decided we *wanted* to include > sudo in the TOE. Would this project proposal look any different? Depends how it was included and what claims we wanted to make about it. > If yes, then doesn't that mean that there's an architectural issue > here with respect to the things that are deemed to be "necessary" for > the TOE and those that are not? I suspect that to be properly included in the TOE we would want to add some additional auditing to sudo. However I don't think that has value for the vast majority of OpenSolaris users wondering where sudo is just now. That is the reason that this case listed out the things we are going to purse with the community. > There are decisions being made here that appear to affect the way in > which we integrate certain bits of software, and that are possibly > architectural in nature, but that are not being expressed as > architectural rules. That seems at least a bit confusing to me. I think at certain levels the TOE is architecture however it isn't something that has been dealt with via the Sun ARC process in the past. I'm not saying that ARC couldn't help just that I don't think we need to expand what this cases is doing nor make it the poster child or guinea pig. >> > If it's >>> there, then it needs careful scrutiny for auditing and the like. If >>> it's not, then that no longer applies. >> Generation of audit records is mostly done by the kernel, sudo is purely >> a userland application. As I said in my other email it isn't that sudo >> will stop audit records it just won't add any new ones like pfexec does. > > Right ... and wouldn't we include that additional auditing > information, just like pfexec, if we were considering sudo for > evaluation? In fact, wouldn't we _insist_ on it? Maybe, but as the case material said we want to work with the upstream community on that first but there is a need to get sudo delivered now. As sudo is is what the vast majority of people want and need. We don't actually know when we are starting the next evaluation that will cause us to write a new security target because we don't know when the minor release ships (note this case explicitly said minor not patch). >> I don't see an issue with that for the first integration and it is why >> the case says we will work with the upstream community to consider >> adding more auditing. > > I'm not asking any such thing. I don't want auditing in sudo. I > don't care whether it has it or not. Just like most people who want sudo, also there is the class of people that don't know that they could even have it. > I'm asking to understand the principle behind the decision being made, > as it likely affects future cases. The principle behind the decision being made is simple this: An unmodified sudo *now*, when it is the number one but not found pkg.opensolaris.org request, is more valuable that a possibly never sudo with sudo specific auditing or privileges support. sudo has been and still is good enough as is for many people including some of Sun's big enterprise customers. Lets just give them good enough (I'd say vanilla sudo is 90% there) rather than trying to do perfect (RBAC isn't perfect either and there are things sudo does much better that it could but doesn't do). -- Darren J Moffat From carlsonj@phorcys.east.sun.com Thu Jun 12 08:52:40 2008 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m5CFqdSS012219 for ; Thu, 12 Jun 2008 08:52:40 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m5CFqVLO019674; Thu, 12 Jun 2008 16:52:38 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K2C0010XXFM9F00@nwk-avmta-2.sfbay.sun.com>; Thu, 12 Jun 2008 08:52:34 -0700 (PDT) Received: from phorcys.east.sun.com ([129.148.174.143]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K2C00LM6XFMI770@nwk-avmta-2.sfbay.sun.com>; Thu, 12 Jun 2008 08:52:34 -0700 (PDT) Received: from phorcys.east.sun.com (localhost [127.0.0.1]) by phorcys.east.sun.com (8.14.3+Sun/8.14.3) with ESMTP id m5CFbYwX013630; Thu, 12 Jun 2008 11:37:34 -0400 (EDT) Received: (from carlsonj@localhost) by phorcys.east.sun.com (8.14.3+Sun/8.14.3/Submit) id m5CFbYeF013627; Thu, 12 Jun 2008 11:37:34 -0400 (EDT) Date: Thu, 12 Jun 2008 11:37:34 -0400 From: James Carlson Subject: Re: sudo [PSARC/2008/370 FastTrack timeout 06/17/2008] In-reply-to: <48513687.6070702@opensolaris.org> To: Darren J Moffat Cc: John Plocher , "Richard L. Hamilton" , PSARC-ext@sun.com Message-id: <18513.17086.830378.753193@gargle.gargle.HOWL> MIME-version: 1.0 X-Mailer: VM 7.01 under Emacs 21.3.1 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <3578049.1213153343640.JavaMail.Twebapp@oss-app1> <484F9513.9010002@opensolaris.org> <484FDBFC.5050601@Sun.Com> <484FED19.40903@opensolaris.org> <18511.62517.4600.681604@gargle.gargle.HOWL> <4850E991.3040705@opensolaris.org> <18513.3402.497621.177350@gargle.gargle.HOWL> <48513687.6070702@opensolaris.org> Status: RO Content-Length: 1525 Darren J Moffat writes: > Lets just give them good enough (I'd say vanilla sudo is 90% there) > rather than trying to do perfect (RBAC isn't perfect either and there > are things sudo does much better that it could but doesn't do). At no point was I arguing against that. None. I went out of my way to make sure that I wasn't asking for any change to sudo or any other impediment to releasing ancient and very familiar bits like that in Sun clothing. Since it's apparently unclear, I'll do so again: please don't change sudo. Don't change a hair. I'm also one of the people who use it. What I'm asking about is whether there's an architectural principle involved that determines what things do get this sort of extra scrutiny and what things do not. It sounds like the answer is that there _is_ one that's based on required components for administration, but that it's never been documented as architecture, and the Sun group that has the skill and authority to make these decisions on its own doesn't plan to make it an ARC policy any time in the near future. In that case, and assuming I've got that right, I don't think the ARC should be in the business of enforcing any rules on this, and that future projects should feel free to ignore the issue. At least until there is such a rule. -- James Carlson, Solaris Networking Sun Microsystems / 35 Network Drive 71.232W Vox +1 781 442 2084 MS UBUR02-212 / Burlington MA 01803-2757 42.496N Fax +1 781 442 1677 From darrenm@opensolaris.org Thu Jun 12 09:36:14 2008 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m5CGaETG013934 for ; Thu, 12 Jun 2008 09:36:14 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m5CGa8Bf011146 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Thu, 12 Jun 2008 17:36:13 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K2C00619ZGBH600@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Thu, 12 Jun 2008 09:36:11 -0700 (PDT) Received: from gmp-eb-inf-2.sun.com ([192.18.6.24]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K2C0033MZG8SG40@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Thu, 12 Jun 2008 09:36:09 -0700 (PDT) Received: from fe-emea-10.sun.com (gmp-eb-lb-2-fe1.eu.sun.com [192.18.6.10]) by gmp-eb-inf-2.sun.com (8.13.7+Sun/8.12.9) with ESMTP id m5CGa89e022733 for ; Thu, 12 Jun 2008 16:36:08 +0000 (GMT) Received: from conversion-daemon.fe-emea-10.sun.com by fe-emea-10.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0K2C00J01Z1GG200@fe-emea-10.sun.com> (original mail from darrenm@opensolaris.org) for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Thu, 12 Jun 2008 17:36:07 +0100 (BST) Received: from [129.156.173.21] by fe-emea-10.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0K2C00KGKZG5Y170@fe-emea-10.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Thu, 12 Jun 2008 17:36:07 +0100 (BST) Date: Thu, 12 Jun 2008 17:36:05 +0100 From: Darren J Moffat Subject: Re: sudo [PSARC/2008/370 FastTrack timeout 06/17/2008] In-reply-to: <18513.17086.830378.753193@gargle.gargle.HOWL> Sender: Darren.Moffat@sun.com To: James Carlson Cc: John Plocher , "Richard L. Hamilton" , PSARC-ext@sun.com Message-id: <48515075.2090307@opensolaris.org> Organization: OpenSolaris MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <3578049.1213153343640.JavaMail.Twebapp@oss-app1> <484F9513.9010002@opensolaris.org> <484FDBFC.5050601@Sun.Com> <484FED19.40903@opensolaris.org> <18511.62517.4600.681604@gargle.gargle.HOWL> <4850E991.3040705@opensolaris.org> <18513.3402.497621.177350@gargle.gargle.HOWL> <48513687.6070702@opensolaris.org> <18513.17086.830378.753193@gargle.gargle.HOWL> User-Agent: Thunderbird 2.0.0.14 (X11/20080507) Status: RO Content-Length: 1632 James Carlson wrote: > Darren J Moffat writes: >> Lets just give them good enough (I'd say vanilla sudo is 90% there) >> rather than trying to do perfect (RBAC isn't perfect either and there >> are things sudo does much better that it could but doesn't do). > > At no point was I arguing against that. None. I went out of my way > to make sure that I wasn't asking for any change to sudo or any other > impediment to releasing ancient and very familiar bits like that in > Sun clothing. > > Since it's apparently unclear, I'll do so again: please don't change > sudo. Don't change a hair. I'm also one of the people who use it. > > What I'm asking about is whether there's an architectural principle > involved that determines what things do get this sort of extra > scrutiny and what things do not. It sounds like the answer is that > there _is_ one that's based on required components for administration, > but that it's never been documented as architecture, and the Sun group > that has the skill and authority to make these decisions on its own > doesn't plan to make it an ARC policy any time in the near future. > > In that case, and assuming I've got that right, I don't think the ARC > should be in the business of enforcing any rules on this, and that > future projects should feel free to ignore the issue. At least until > there is such a rule. Agreed. This could change in the future though and there are some discussions happening with in the group of people involved in the common criteria evaluations to try and work out if the ARC can help in this process - but not this case. -- Darren J Moffat From Darren.Moffat@sun.com Wed Jun 18 09:27:33 2008 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m5IGRWY0006231 for ; Wed, 18 Jun 2008 09:27:32 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id m5IGRW6B035855 for <@sunmail2sca.sfbay.sun.com:PSARC-EXT@sun.com>; Wed, 18 Jun 2008 10:27:32 -0600 (MDT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K2O00I0J31WX800@nwk-avmta-2.sfbay.sun.com> for PSARC-EXT@sun.com (ORCPT PSARC-EXT@Sun.COM); Wed, 18 Jun 2008 09:27:32 -0700 (PDT) Received: from gmp-eb-inf-2.sun.com ([192.18.6.24]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K2O00H3231ULD70@nwk-avmta-2.sfbay.sun.com> for PSARC-EXT@sun.com (ORCPT PSARC-EXT@Sun.COM); Wed, 18 Jun 2008 09:27:31 -0700 (PDT) Received: from fe-emea-09.sun.com (gmp-eb-lb-2-fe1.eu.sun.com [192.18.6.10]) by gmp-eb-inf-2.sun.com (8.13.7+Sun/8.12.9) with ESMTP id m5IGRUOr002638 for ; Wed, 18 Jun 2008 16:27:30 +0000 (GMT) Received: from conversion-daemon.fe-emea-09.sun.com by fe-emea-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0K2O00J012VJW600@fe-emea-09.sun.com> (original mail from Darren.Moffat@Sun.COM) for PSARC-EXT@Sun.COM (ORCPT PSARC-EXT@Sun.COM); Wed, 18 Jun 2008 17:27:30 +0100 (BST) Received: from [129.156.173.21] by fe-emea-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0K2O00GIP31SVH30@fe-emea-09.sun.com> for PSARC-EXT@Sun.COM (ORCPT PSARC-EXT@Sun.COM); Wed, 18 Jun 2008 17:27:28 +0100 (BST) Date: Wed, 18 Jun 2008 17:27:28 +0100 From: Darren J Moffat Subject: PSARC/2008/370 sudo closed-approved Sender: Darren.Moffat@sun.com To: PSARC-EXT@sun.com, Joep.Vesseur@sun.com, Tony.Nguyen@sun.com Message-id: <48593770.8050304@Sun.COM> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 User-Agent: Thunderbird 2.0.0.14 (X11/20080507) Status: RO Content-Length: 176 I believe the conversation converged. There were changes to the spec required. The timer expired yesterday so I'm marking this case as closed-approved. -- Darren J Moffat From Darren.Moffat@sun.com Wed Jun 18 09:33:11 2008 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m5IGXAFK006734 for ; Wed, 18 Jun 2008 09:33:11 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m5IGX5ut000453 for <@sunmail2sca.sfbay.sun.com:PSARC-EXT@sun.com>; Wed, 18 Jun 2008 17:33:09 +0100 (BST) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K2O00M0X3B7W000@brm-avmta-1.central.sun.com> for PSARC-EXT@sun.com (ORCPT PSARC-EXT@Sun.COM); Wed, 18 Jun 2008 10:33:07 -0600 (MDT) Received: from gmp-eb-inf-1.sun.com ([192.18.6.21]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K2O00MGN3B30V10@brm-avmta-1.central.sun.com> for PSARC-EXT@sun.com (ORCPT PSARC-EXT@Sun.COM); Wed, 18 Jun 2008 10:33:04 -0600 (MDT) Received: from fe-emea-09.sun.com (gmp-eb-lb-2-fe3.eu.sun.com [192.18.6.12]) by gmp-eb-inf-1.sun.com (8.13.7+Sun/8.12.9) with ESMTP id m5IGX3XR009377 for ; Wed, 18 Jun 2008 16:33:03 +0000 (GMT) Received: from conversion-daemon.fe-emea-09.sun.com by fe-emea-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0K2O0050138RVK00@fe-emea-09.sun.com> (original mail from Darren.Moffat@Sun.COM) for PSARC-EXT@Sun.COM (ORCPT PSARC-EXT@Sun.COM); Wed, 18 Jun 2008 17:33:03 +0100 (BST) Received: from [129.156.173.21] by fe-emea-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0K2O00GOH3B2VH30@fe-emea-09.sun.com> for PSARC-EXT@Sun.COM (ORCPT PSARC-EXT@Sun.COM); Wed, 18 Jun 2008 17:33:03 +0100 (BST) Date: Wed, 18 Jun 2008 17:33:02 +0100 From: Darren J Moffat Subject: Re: PSARC/2008/370 sudo closed-approved In-reply-to: <48593770.8050304@Sun.COM> Sender: Darren.Moffat@sun.com To: PSARC-EXT@sun.com, Joep.Vesseur@sun.com, Tony.Nguyen@sun.com Message-id: <485938BE.7080402@Sun.COM> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <48593770.8050304@Sun.COM> User-Agent: Thunderbird 2.0.0.14 (X11/20080507) Status: RO Content-Length: 187 Darren J Moffat wrote: > I believe the conversation converged. There were changes to the spec ^ no > required. -- Darren J Moffat