Subject: Unresolvable SID mapping [PSARC/2008/408 Self Review]
To:      PSARC-record@sac.sfbay.sun.com
Cc:      Nicolas.Williams@Sun.COM, Afshin.Ardakani@Sun.COM
Bcc:     one-pager-list@sac.sfbay one-pager-log@sac.sfbay sac-bar@sac.sfbay

I'm sponsoring this self-approved case on behalf of the ID mapping
i-team.

BACKGROUND
----------

PSARC/2006/315 introduced an ID mapping service (svc:/system/idmap) for
Solaris that maps between Windows users and groups (identified by names
and "SIDs") and POSIX users and groups (identified by names and
UIDs/GIDs).

The idmap service only maps Windows entities that can be resolved (i.e.,
names that can be resolved to SIDs and vice-versa).  This means that
only users/groups which exist in a Windows domain can be referenced in
file security descriptors (file owner, group and ACL).  Contrast this to
POSIX IDs: chown(2), acl(2), facl(2) don't reject UIDs and GIDs that
cannot be resolved through Unix name services.

PROBLEM
-------

However, there are at least two cases where we need to be able to store
SIDs in file ACL entries (and as file owner/group) where the SID cannot
be resolved to a name at all.  Such SIDs can generally not appear in any
cred_t, therefore ACL entries referencing them have no effect.

The two known use cases are: a) Microsoft SQL Server, which creates
files with ACL entries that reference SIDs local to the system on which
SQL Server runs, and b) data migration, where it is common-place to
copy files first, then later change the SIDs referenced in their ACLs.

(a) is a pressing business issue.

Note that simply assigning ephemeral IDs to any unresolvable SID
referenced by a CIFS client allows for a denial of service (DoS) attack
where a client consumes all available ephemeral IDs (they number
slightly fewer than 2^31 UIDs and GIDs).  We will pursue a long-term
solution that does not enable such a DoS.  In the meantime we propose a
temporary, undocumented solution to enable ephemeral ID mapping of
unresolvable SIDs.

PROPOSAL
--------

Add a private property, config/map_unresolvable_sids, to the idmap
service which, when it exists, allows the service to perform ephemeral
ID mapping for unresolvable SIDs.

This feature and associated service property will be removed when a
long-term solution to the problem that does not create a DoS is
implemented.

An early version of one proposal for a long-term solution can be found
in the comments for:

6718001 stop-gap needed: ephemeral ID mapping for non-resolvable SIDs