From Sebastien.Roy@sun.com Wed Jul 23 21:51:02 2008 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m6O4p16O021127 for ; Wed, 23 Jul 2008 21:51:02 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id m6O4otZH009987 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Thu, 24 Jul 2008 12:51:01 +0800 (SGT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K4H00C05USZAT00@brm-avmta-1.central.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@Sun.COM); Wed, 23 Jul 2008 22:50:59 -0600 (MDT) Received: from brmea-mail-3.sun.com ([192.18.98.34]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K4H00G4NUSYZ1A0@brm-avmta-1.central.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@Sun.COM); Wed, 23 Jul 2008 22:50:59 -0600 (MDT) Received: from fe-amer-09.sun.com ([192.18.109.79]) by brmea-mail-3.sun.com (8.13.6+Sun/8.12.9) with ESMTP id m6O4owPY013669 for ; Thu, 24 Jul 2008 04:50:58 +0000 (GMT) Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0K4H00401ULVK500@mail-amer.sun.com> (original mail from Sebastien.Roy@Sun.COM) for PSARC-ext@Sun.COM (ORCPT PSARC-ext@Sun.COM); Wed, 23 Jul 2008 22:50:58 -0600 (MDT) Received: from [192.168.1.5] ([71.174.191.147]) by mail-amer.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0K4H0060QUSYBW00@mail-amer.sun.com> for PSARC-ext@Sun.COM (ORCPT PSARC-ext@Sun.COM); Wed, 23 Jul 2008 22:50:58 -0600 (MDT) Date: Thu, 24 Jul 2008 00:50:57 -0400 From: Sebastien Roy Subject: PSARC 2008/473 Fine-Grained Privileges for Datalink Administration Sender: Sebastien.Roy@sun.com To: psarc-ext Message-id: <1216875057.1211.7.camel@seb> Organization: Sun Microsystems MIME-version: 1.0 X-Mailer: Evolution 2.22.2 Content-type: text/plain Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 Status: RO Content-Length: 4945 I'm submitting this fast-track for myself, it times out on July 31st, 2008. Fine-Grained Privileges for Datalink Administration 1. Summary This case proposes to break down the privilege model for datalink administration through dladm(1M) in order to allow unprivileged users access to a subset of administrative operations. The stability level of dladm and its subcommands is Committed, and the release binding for this case is Patch. No incompatible changes are being introduced. 2. Background The dladm(1M) command currently contains an explicit and global check for the sys_net_config and net_rawaccess privileges. If these privileges are not in the effective set at the time the command is run, the command exits with an error claiming "insufficient privileges". This check is unnecessary since the kernel contains privilege checks for the various operations that dladm performs (detailed below), but nevertheless, it's there and is relevant to this case. Most kernel state is accessed (through libdladm.so) by issuing Project-Private ioctls to three pseudo device nodes in /devices/pseudo/ (dld@0:ctl, aggr@0:ctl, and vnic@0:ctl). These ioctls themselves do not have individual privilege requirements. Opening the dld and aggr control devices requires the sys_net_config privilege due to entries in /etc/security/device_policy, and the vnic control devices only allows root access by virtue of its device node's file permissions. WiFi-related kernel state is accessed by opening DLPI device nodes of interest in /dev/net and issuing ioctls. Opening DLPI nodes requires the net_rawaccess privilege, and WiFi drivers additionally require the sys_net_config privilege to issue WiFi ioctls. The result is that all dladm operations require the sys_net_config and net_rawaccess privileges. The vnic operations are currently private interfaces to xVM accessed through the project-private /usr/lib/vna command, and require the root user-id (all privileges). 3. Proposed Architectural Changes This case proposes a new sys_dl_config privilege that is a subset of the existing sys_net_config privilege. This privilege will be required to make modifications to datalink configuration, but will not be required to read datalink configuration. The /etc/security/exec_attr entries for the /sbin/dladm command will be modified to replace sys_net_config with sys_dl_config. With the exception of WiFi administration detailed in 3.1, no additional privileges will be required to interact with datalink configuration. The existing global privilege checks in the dladm command itself will be removed, as will the privilege checks for the aggr, vnic, and dld control devices currently in /etc/security/device_policy. Instead, all GLDv3 ioctls will go through a single /dev/dld control device which will require no privileges to open. The dld kernel module will perform a per-ioctl privilege check. The end result for users of dladm will be the following set of required privileges for each existing subcommand: show-link [none] rename-link sys_dl_config delete-phys sys_dl_config show-phys [none] show-dev [none] create-aggr sys_dl_config modify-aggr sys_dl_config delete-aggr sys_dl_config add-aggr sys_dl_config remove-aggr sys_dl_config show-aggr [none] create-vlan sys_dl_config delete-vlan sys_dl_config show-vlan [none] scan-wifi net_rawaccess, sys_dl_config * connect-wifi net_rawaccess, sys_dl_config * disconnect-wifi net_rawaccess, sys_dl_config * show-wifi net_rawaccess, sys_dl_config * set-linkprop sys_dl_config reset-linkprop sys_dl_config show-linkprop [none] create-secobj sys_dl_config, solaris.network.link.security delete-secobj sys_dl_config, solaris.network.link.security show-secobj sys_dl_config show-ether [none] * See section 3.1 ragarding WiFi subcommands. 3.1. WiFi Link Administration Breaking down the privileges required to administer WiFi links (using the WiFi-related dladm subcommands) is outside the scope of this case. The reason is simply that more work is needed to convert the driver ioctls issued through /dev/net to other operations that do not require the net_rawaccess privilege. That work will be done separately, and the architecture detailed in this case will make that work possible, but as a future case. This case does propose to relax the requirement for WiFi ioctls from sys_net_config to the new sys_dl_config privilege in order to be in-line with other GLDv3 datalink administration ioctls. The net_rawaccess privilege will still be required for WiFi operations, however, since libdladm.so still has to open /dev/net DLPI nodes in order to issue WiFi ioctls. From Darren.Moffat@sun.com Thu Jul 24 02:17:28 2008 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m6O9HSNP029345 for ; Thu, 24 Jul 2008 02:17:28 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id m6O9HR01060072 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Thu, 24 Jul 2008 03:17:28 -0600 (MDT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K4I00D0E753W400@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Thu, 24 Jul 2008 02:17:27 -0700 (PDT) Received: from gmp-eb-inf-2.sun.com ([192.18.6.24]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K4I008V6750OO70@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Thu, 24 Jul 2008 02:17:25 -0700 (PDT) Received: from fe-emea-10.sun.com (gmp-eb-lb-2-fe2.eu.sun.com [192.18.6.11]) by gmp-eb-inf-2.sun.com (8.13.7+Sun/8.12.9) with ESMTP id m6O9HOLI015037 for ; Thu, 24 Jul 2008 09:17:24 +0000 (GMT) Received: from conversion-daemon.fe-emea-10.sun.com by fe-emea-10.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0K4I00C016T77B00@fe-emea-10.sun.com> (original mail from Darren.Moffat@Sun.COM) for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Thu, 24 Jul 2008 10:17:24 +0100 (BST) Received: from [129.156.173.21] by fe-emea-10.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0K4I00K5A74VCI30@fe-emea-10.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Thu, 24 Jul 2008 10:17:19 +0100 (BST) Date: Thu, 24 Jul 2008 10:17:19 +0100 From: Darren J Moffat Subject: Re: PSARC 2008/473 Fine-Grained Privileges for Datalink Administration In-reply-to: <1216875057.1211.7.camel@seb> Sender: Darren.Moffat@sun.com To: Sebastien Roy Cc: psarc-ext Message-id: <4888489F.2040808@Sun.COM> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <1216875057.1211.7.camel@seb> User-Agent: Thunderbird 2.0.0.14 (X11/20080630) Status: RO Content-Length: 692 Sebastien Roy wrote: > 3. Proposed Architectural Changes > > This case proposes a new sys_dl_config privilege that is a subset of > the existing sys_net_config privilege. This privilege will be > required to make modifications to datalink configuration, but will > not be required to read datalink configuration. The Just to make it clear I believe this is really: "The sys_dl_config privilege OR the sys_net_config privilege will be required to make modifications to the datalink configuration". Which is what Seb means by "subset". The privilege framework has no real concept of privilege subsets so this has to be explicitly checked by the caller. -- Darren J Moffat From Sebastien.Roy@sun.com Thu Jul 24 05:08:19 2008 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m6OC8IRd002457 for ; Thu, 24 Jul 2008 05:08:18 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m6OC8FGO009624 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Thu, 24 Jul 2008 13:08:17 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K4I00C03F1RJN00@nwk-avmta-2.sfbay.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Thu, 24 Jul 2008 05:08:15 -0700 (PDT) Received: from brmea-mail-1.sun.com ([192.18.98.31]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K4I004E6F1RYQ70@nwk-avmta-2.sfbay.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Thu, 24 Jul 2008 05:08:15 -0700 (PDT) Received: from fe-amer-10.sun.com ([192.18.109.80]) by brmea-mail-1.sun.com (8.13.6+Sun/8.12.9) with ESMTP id m6OC8Fho021948 for ; Thu, 24 Jul 2008 12:08:15 +0000 (GMT) Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0K4I00D01EPPF800@mail-amer.sun.com> (original mail from Sebastien.Roy@Sun.COM) for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Thu, 24 Jul 2008 06:08:15 -0600 (MDT) Received: from [192.168.1.5] ([71.174.191.147]) by mail-amer.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0K4I00ANZF1QP1C0@mail-amer.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Thu, 24 Jul 2008 06:08:15 -0600 (MDT) Date: Thu, 24 Jul 2008 08:08:13 -0400 From: Sebastien Roy Subject: Re: PSARC 2008/473 Fine-Grained Privileges for Datalink Administration In-reply-to: <4888489F.2040808@Sun.COM> Sender: Sebastien.Roy@sun.com To: Darren J Moffat Cc: psarc-ext Message-id: <1216901293.1211.13.camel@seb> Organization: Sun Microsystems MIME-version: 1.0 X-Mailer: Evolution 2.22.2 Content-type: text/plain Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <1216875057.1211.7.camel@seb> <4888489F.2040808@Sun.COM> Status: RO Content-Length: 797 On Thu, 2008-07-24 at 10:17 +0100, Darren J Moffat wrote: > Sebastien Roy wrote: > > 3. Proposed Architectural Changes > > > > This case proposes a new sys_dl_config privilege that is a subset of > > the existing sys_net_config privilege. This privilege will be > > required to make modifications to datalink configuration, but will > > not be required to read datalink configuration. The > > Just to make it clear I believe this is really: "The sys_dl_config > privilege OR the sys_net_config privilege will be required to make > modifications to the datalink configuration". Which is what Seb means > by "subset". The privilege framework has no real concept of privilege > subsets so this has to be explicitly checked by the caller. Yes, your description is correct. -Seb From edward.pilatowicz@sun.com Thu Jul 24 10:38:21 2008 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m6OHcK0b012257 for ; Thu, 24 Jul 2008 10:38:21 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m6OHcGDu015012; Thu, 24 Jul 2008 18:38:17 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K4I00I07UBSTJ00@nwk-avmta-1.sfbay.Sun.COM>; Thu, 24 Jul 2008 10:38:16 -0700 (PDT) Received: from jurassic-x4600.sfbay.sun.com ([129.146.17.59]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K4I00109UBS5IF0@nwk-avmta-1.sfbay.Sun.COM>; Thu, 24 Jul 2008 10:38:16 -0700 (PDT) Received: from jurassic-x4600.sfbay.sun.com (localhost [127.0.0.1]) by jurassic-x4600.sfbay.sun.com (8.14.3+Sun/8.14.3) with ESMTP id m6OHcG3c218176 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Thu, 24 Jul 2008 10:38:16 -0700 (PDT) Received: (from edp@localhost) by jurassic-x4600.sfbay.sun.com (8.14.3+Sun/8.14.3/Submit) id m6OHcGjL218174; Thu, 24 Jul 2008 10:38:16 -0700 (PDT) Date: Thu, 24 Jul 2008 10:38:16 -0700 From: Edward Pilatowicz Subject: Re: PSARC 2008/473 Fine-Grained Privileges for Datalink Administration In-reply-to: <1216875057.1211.7.camel@seb> To: Sebastien Roy Cc: psarc-ext Message-id: <20080724173816.GA142035@eng.sun.com> MIME-version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-disposition: inline X-PMX-Version: 5.4.1.325704 References: <1216875057.1211.7.camel@seb> X-Authentication-warning: jurassic-x4600.sfbay.sun.com: edp set sender to edward.pilatowicz@sun.com using -f User-Agent: Mutt/1.5.17 (2007-11-01) Status: RO Content-Length: 5589 hey sebastien, could you please elaborate on how these changes impact native shared and exclusive stack zones? will exclusive stack zones have the sys_dl_config privilege by default? if so, will they be able to execute all the dladm subcommands? will zones without the sys_dl_config privilege be able to run show-* dladm subcommands (sans the show-wifi subcommand)? thanks ed On Thu, Jul 24, 2008 at 12:50:57AM -0400, Sebastien Roy wrote: > I'm submitting this fast-track for myself, it times out on July 31st, 2008. > > Fine-Grained Privileges for Datalink Administration > > 1. Summary > > This case proposes to break down the privilege model for datalink > administration through dladm(1M) in order to allow unprivileged > users access to a subset of administrative operations. > > The stability level of dladm and its subcommands is Committed, and > the release binding for this case is Patch. No incompatible changes > are being introduced. > > 2. Background > > The dladm(1M) command currently contains an explicit and global > check for the sys_net_config and net_rawaccess privileges. If these > privileges are not in the effective set at the time the command is > run, the command exits with an error claiming "insufficient > privileges". This check is unnecessary since the kernel contains > privilege checks for the various operations that dladm performs > (detailed below), but nevertheless, it's there and is relevant to > this case. > > Most kernel state is accessed (through libdladm.so) by issuing > Project-Private ioctls to three pseudo device nodes in > /devices/pseudo/ (dld@0:ctl, aggr@0:ctl, and vnic@0:ctl). These > ioctls themselves do not have individual privilege requirements. > Opening the dld and aggr control devices requires the sys_net_config > privilege due to entries in /etc/security/device_policy, and the > vnic control devices only allows root access by virtue of its device > node's file permissions. > > WiFi-related kernel state is accessed by opening DLPI device nodes > of interest in /dev/net and issuing ioctls. Opening DLPI nodes > requires the net_rawaccess privilege, and WiFi drivers additionally > require the sys_net_config privilege to issue WiFi ioctls. > > The result is that all dladm operations require the sys_net_config > and net_rawaccess privileges. The vnic operations are currently > private interfaces to xVM accessed through the project-private > /usr/lib/vna command, and require the root user-id (all privileges). > > 3. Proposed Architectural Changes > > This case proposes a new sys_dl_config privilege that is a subset of > the existing sys_net_config privilege. This privilege will be > required to make modifications to datalink configuration, but will > not be required to read datalink configuration. The > /etc/security/exec_attr entries for the /sbin/dladm command will be > modified to replace sys_net_config with sys_dl_config. With the > exception of WiFi administration detailed in 3.1, no additional > privileges will be required to interact with datalink configuration. > > The existing global privilege checks in the dladm command itself > will be removed, as will the privilege checks for the aggr, vnic, > and dld control devices currently in /etc/security/device_policy. > Instead, all GLDv3 ioctls will go through a single /dev/dld control > device which will require no privileges to open. The dld kernel > module will perform a per-ioctl privilege check. > > The end result for users of dladm will be the following set of > required privileges for each existing subcommand: > > show-link [none] > rename-link sys_dl_config > delete-phys sys_dl_config > show-phys [none] > show-dev [none] > create-aggr sys_dl_config > modify-aggr sys_dl_config > delete-aggr sys_dl_config > add-aggr sys_dl_config > remove-aggr sys_dl_config > show-aggr [none] > create-vlan sys_dl_config > delete-vlan sys_dl_config > show-vlan [none] > scan-wifi net_rawaccess, sys_dl_config * > connect-wifi net_rawaccess, sys_dl_config * > disconnect-wifi net_rawaccess, sys_dl_config * > show-wifi net_rawaccess, sys_dl_config * > set-linkprop sys_dl_config > reset-linkprop sys_dl_config > show-linkprop [none] > create-secobj sys_dl_config, solaris.network.link.security > delete-secobj sys_dl_config, solaris.network.link.security > show-secobj sys_dl_config > show-ether [none] > > * See section 3.1 ragarding WiFi subcommands. > > 3.1. WiFi Link Administration > > Breaking down the privileges required to administer WiFi links > (using the WiFi-related dladm subcommands) is outside the scope of > this case. The reason is simply that more work is needed to convert > the driver ioctls issued through /dev/net to other operations that > do not require the net_rawaccess privilege. That work will be done > separately, and the architecture detailed in this case will make > that work possible, but as a future case. > > This case does propose to relax the requirement for WiFi ioctls from > sys_net_config to the new sys_dl_config privilege in order to be > in-line with other GLDv3 datalink administration ioctls. The > net_rawaccess privilege will still be required for WiFi operations, > however, since libdladm.so still has to open /dev/net DLPI nodes in > order to issue WiFi ioctls. From Sebastien.Roy@sun.com Thu Jul 24 11:02:14 2008 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m6OI2EG9012914 for ; Thu, 24 Jul 2008 11:02:14 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m6OI297I026334 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Thu, 24 Jul 2008 19:02:13 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K4I00L01VFOAD00@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Thu, 24 Jul 2008 11:02:12 -0700 (PDT) Received: from brmea-mail-1.sun.com ([192.18.98.31]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K4I00K7VVFO1030@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Thu, 24 Jul 2008 11:02:12 -0700 (PDT) Received: from fe-amer-09.sun.com ([192.18.109.79]) by brmea-mail-1.sun.com (8.13.6+Sun/8.12.9) with ESMTP id m6OI2CxE021212 for ; Thu, 24 Jul 2008 18:02:12 +0000 (GMT) Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0K4I00A01VCFER00@mail-amer.sun.com> (original mail from Sebastien.Roy@Sun.COM) for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Thu, 24 Jul 2008 12:02:12 -0600 (MDT) Received: from [10.0.204.215] ([12.172.66.11]) by mail-amer.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0K4I002VHVFGEYB0@mail-amer.sun.com>; Thu, 24 Jul 2008 12:02:05 -0600 (MDT) Date: Thu, 24 Jul 2008 14:02:04 -0400 From: Sebastien Roy Subject: Re: PSARC 2008/473 Fine-Grained Privileges for Datalink Administration In-reply-to: <20080724173816.GA142035@eng.sun.com> Sender: Sebastien.Roy@sun.com To: Edward Pilatowicz Cc: psarc-ext Message-id: <1216922524.2638.10.camel@seb> Organization: Sun Microsystems MIME-version: 1.0 X-Mailer: Evolution 2.22.2 Content-type: text/plain Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <1216875057.1211.7.camel@seb> <20080724173816.GA142035@eng.sun.com> Status: RO Content-Length: 1322 Hi Ed, On Thu, 2008-07-24 at 10:38 -0700, Edward Pilatowicz wrote: > hey sebastien, > > could you please elaborate on how these changes impact > native shared and exclusive stack zones? Sure; These changes do not impact the current dladm administrative model from within non-global zones. > will exclusive stack zones have the sys_dl_config privilege > by default? if so, will they be able to execute all the dladm > subcommands? > > will zones without the sys_dl_config privilege be able to run > show-* dladm subcommands (sans the show-wifi subcommand)? Zones did not have sys_net_config before this change, and they won't have net_net_config nor sys_dl_config after this change. They will also not be able to execute dladm subcommands at all (including the show-* subcommands), as there is no zones-awareness at the datalink layer, and the /dev/dld control device will not be included in non-global zones for that reason. The dladm commands will not display any data from non-global zones (status-quo). That said, with this infrastructure in place a future project will be able to add zones-awareness to the kernel data-structures and the ioctls that access them, add /dev/dld to non-global zones, and thus provide a datalink management story from non-global zones. That, however, is not this case. -Seb From gww@sac.sfbay.sun.com Mon Jul 28 13:38:09 2008 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m6SKc8bj000747 for ; Mon, 28 Jul 2008 13:38:08 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id m6SKc0vJ027176 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Tue, 29 Jul 2008 04:38:07 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K4Q0010FHBIOG00@nwk-avmta-2.sfbay.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Mon, 28 Jul 2008 13:38:06 -0700 (PDT) Received: from dm-sfbay-01.sfbay.sun.com ([129.145.155.118]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K4Q00M43HBHUM30@nwk-avmta-2.sfbay.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Mon, 28 Jul 2008 13:38:05 -0700 (PDT) Received: from sac.sfbay.sun.com (new-sac.SFBay.Sun.COM [129.146.175.65]) by dm-sfbay-01.sfbay.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m6SKc41i029849; Mon, 28 Jul 2008 13:38:04 -0700 (PDT) Received: from sac.sfbay.sun.com (localhost [127.0.0.1]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m6SKc4kV000744; Mon, 28 Jul 2008 13:38:04 -0700 (PDT) Received: (from gww@localhost) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8/Submit) id m6SKc4T7000742; Mon, 28 Jul 2008 13:38:04 -0700 (PDT) Date: Mon, 28 Jul 2008 13:38:04 -0700 (PDT) From: Gary Winiger Subject: Re: PSARC 2008/473 Fine-Grained Privileges for Datalink Administration To: PSARC-ext@sun.com, Sebastien.Roy@sun.com Message-id: <200807282038.m6SKc4T7000742@sac.sfbay.sun.com> Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 Status: RO Content-Length: 568 > create-secobj sys_dl_config, solaris.network.link.security > delete-secobj sys_dl_config, solaris.network.link.security I don't undestand these lines in the proposal. sys_dl_config is the new proposed privilege and enforced by the kernel. solaris.network.link.security is an existing authorization. Authorizations are enforced by privileged programs, not by the kernel. Is this proposal saying that dladm for these operations will check the authorization and fail the operation if the authorization is not present? Please clarify. Gary.. From Sebastien.Roy@Sun.COM Mon Jul 28 13:43:13 2008 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m6SKhCiM000831 for ; Mon, 28 Jul 2008 13:43:13 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id m6SKhB8J002694 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Mon, 28 Jul 2008 14:43:12 -0600 (MDT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K4Q0010HHJZVA00@nwk-avmta-2.sfbay.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Mon, 28 Jul 2008 13:43:11 -0700 (PDT) Received: from brmea-mail-1.sun.com ([192.18.98.31]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K4Q00MBJHJYUD30@nwk-avmta-2.sfbay.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Mon, 28 Jul 2008 13:43:10 -0700 (PDT) Received: from fe-amer-10.sun.com ([192.18.109.80]) by brmea-mail-1.sun.com (8.13.6+Sun/8.12.9) with ESMTP id m6SKhApQ028452 for ; Mon, 28 Jul 2008 20:43:10 +0000 (GMT) Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0K4Q00401F3DE600@mail-amer.sun.com> (original mail from Sebastien.Roy@Sun.COM) for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Mon, 28 Jul 2008 14:43:10 -0600 (MDT) Received: from [129.148.174.103] by mail-amer.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0K4Q008AGHJXX0G0@mail-amer.sun.com>; Mon, 28 Jul 2008 14:43:10 -0600 (MDT) Date: Mon, 28 Jul 2008 16:43:09 -0400 From: Sebastien Roy Subject: Re: PSARC 2008/473 Fine-Grained Privileges for Datalink Administration In-reply-to: <200807282038.m6SKc4T7000742@sac.sfbay.sun.com> Sender: Sebastien.Roy@Sun.COM To: Gary Winiger Cc: PSARC-ext@Sun.COM Message-id: <1217277789.1129.26.camel@strat> Organization: Sun Microsystems MIME-version: 1.0 X-Mailer: Evolution 2.22.2 Content-type: text/plain Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200807282038.m6SKc4T7000742@sac.sfbay.sun.com> Status: RO Content-Length: 1146 On Mon, 2008-07-28 at 13:38 -0700, Gary Winiger wrote: > > create-secobj sys_dl_config, solaris.network.link.security > > delete-secobj sys_dl_config, solaris.network.link.security > > I don't undestand these lines in the proposal. sys_dl_config > is the new proposed privilege and enforced by the kernel. > solaris.network.link.security is an existing authorization. > Authorizations are enforced by privileged programs, not > by the kernel. That's right, and I probably shouldn't have included that information in the table. I was just trying to convey what dladm does today. It checks for the solaris.network.link.security authorization for these subcommands, and I'm not changing that. > Is this proposal saying that dladm for these operations > will check the authorization and fail the operation if > the authorization is not present? Please clarify. That is correct. It does check for that authorization, and it will still check for it. In addition to that, the kernel ioctl used to manipulate these security objects will require the sys_dl_config privilege. I hope this clears up the confusion. -Seb From gww@eng.sun.com Mon Jul 28 13:51:04 2008 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m6SKp4J2001126 for ; Mon, 28 Jul 2008 13:51:04 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id m6SKowlT005086 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Mon, 28 Jul 2008 14:51:03 -0600 (MDT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K4Q0021XHX36900@nwk-avmta-2.sfbay.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Mon, 28 Jul 2008 13:51:03 -0700 (PDT) Received: from dm-eng-02.sfbay.sun.com ([129.146.11.32]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K4Q00M0UHX2UP40@nwk-avmta-2.sfbay.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Mon, 28 Jul 2008 13:51:02 -0700 (PDT) Received: from marduk.eng.sun.com (marduk.SFBay.Sun.COM [129.146.108.224]) by dm-eng-02.sfbay.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m6SKp1nf053497; Mon, 28 Jul 2008 13:51:01 -0700 (PDT) Received: from marduk.eng.sun.com (localhost [127.0.0.1]) by marduk.eng.sun.com (8.13.6+Sun/8.12.11) with ESMTP id m6SKlwsf005814; Mon, 28 Jul 2008 13:47:58 -0700 (PDT) Received: (from gww@localhost) by marduk.eng.sun.com (8.13.6+Sun/8.12.11/Submit) id m6SKlwKG005813; Mon, 28 Jul 2008 13:47:58 -0700 (PDT) Date: Mon, 28 Jul 2008 13:47:58 -0700 (PDT) From: Gary Winiger Subject: Re: PSARC 2008/473 Fine-Grained Privileges for Datalink Administration To: gww@sac.sfbay.sun.com, Sebastien.Roy@sun.com Cc: PSARC-ext@sun.com Message-id: <200807282047.m6SKlwKG005813@marduk.eng.sun.com> Content-transfer-encoding: 7BIT X-Sun-Charset: US-ASCII X-PMX-Version: 5.4.1.325704 Status: RO Content-Length: 51 > I hope this clears up the confusion. +1 Gary.. From Kais.Belgaied@sun.com Mon Jul 28 15:23:05 2008 Received: from sunmail3mpk.sfbay.sun.com (sunmail3mpk.SFBay.Sun.COM [129.146.11.52]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m6SMN5Zm005468 for ; Mon, 28 Jul 2008 15:23:05 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail3mpk.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id m6SMN1vB011793; Mon, 28 Jul 2008 15:23:04 -0700 (PDT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K4Q00L0PM6FR200@brm-avmta-1.central.sun.com>; Mon, 28 Jul 2008 16:23:03 -0600 (MDT) Received: from jurassic-x4600.sfbay.sun.com ([129.146.17.59]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K4Q00BSGM6ESN90@brm-avmta-1.central.sun.com>; Mon, 28 Jul 2008 16:23:02 -0600 (MDT) Received: from [129.146.11.146] (sr1-jurassic-03.SFBay.Sun.COM [129.146.11.146]) by jurassic-x4600.sfbay.sun.com (8.14.3+Sun/8.14.3) with ESMTP id m6SMN1mJ720296; Mon, 28 Jul 2008 15:23:01 -0700 (PDT) Date: Mon, 28 Jul 2008 15:23:01 -0700 From: Kais Belgaied Subject: Re: PSARC 2008/473 Fine-Grained Privileges for Datalink Administration In-reply-to: <1216875057.1211.7.camel@seb> To: Sebastien Roy Cc: psarc-ext Reply-to: Kais.Belgaied@sun.com Message-id: <488E46C5.9010603@Sun.COM> MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <1216875057.1211.7.camel@seb> User-Agent: Thunderbird 2.0.0.12 (X11/20080228) Status: RO Content-Length: 140 could you include a delta of privileges(5) man page and the out-of-the-box exec_attr(4), and dladm(1m) as modified by this case? Kais From Sebastien.Roy@sun.com Mon Jul 28 15:54:43 2008 Received: from sunmail3mpk.sfbay.sun.com (sunmail3mpk.SFBay.Sun.COM [129.146.11.52]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m6SMshbX007706 for ; Mon, 28 Jul 2008 15:54:43 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail3mpk.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id m6SMsgOX020981 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Mon, 28 Jul 2008 15:54:43 -0700 (PDT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K4Q00607NN5Q800@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Mon, 28 Jul 2008 15:54:41 -0700 (PDT) Received: from brmea-mail-2.sun.com ([192.18.98.43]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K4Q00CVRNN4LHC0@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Mon, 28 Jul 2008 15:54:41 -0700 (PDT) Received: from fe-amer-10.sun.com ([192.18.109.80]) by brmea-mail-2.sun.com (8.13.6+Sun/8.12.9) with ESMTP id m6SMseja004363 for ; Mon, 28 Jul 2008 22:54:40 +0000 (GMT) Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0K4Q00A01NI8N200@mail-amer.sun.com> (original mail from Sebastien.Roy@Sun.COM) for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Mon, 28 Jul 2008 16:54:40 -0600 (MDT) Received: from [192.168.1.3] ([71.174.191.147]) by mail-amer.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0K4Q00D6NNN3ZD80@mail-amer.sun.com>; Mon, 28 Jul 2008 16:54:40 -0600 (MDT) Date: Mon, 28 Jul 2008 18:54:38 -0400 From: Sebastien Roy Subject: Re: PSARC 2008/473 Fine-Grained Privileges for Datalink Administration In-reply-to: <488E46C5.9010603@Sun.COM> Sender: Sebastien.Roy@sun.com To: Kais.Belgaied@sun.com Cc: psarc-ext Message-id: <1217285678.1187.8.camel@seb> Organization: Sun Microsystems MIME-version: 1.0 X-Mailer: Evolution 2.22.2 Content-type: text/plain Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <1216875057.1211.7.camel@seb> <488E46C5.9010603@Sun.COM> Status: RO Content-Length: 2382 On Mon, 2008-07-28 at 15:23 -0700, Kais Belgaied wrote: > could you include a delta of privileges(5) man page and the > out-of-the-box exec_attr(4), and dladm(1m) > as modified by this case? Here are the privileges(5) diffs. I'm not planning on making any changes to exec_attr(4) nor dladm(1M). Perhaps dladm(1M) could contain a short mention that subcommands that make modifications to the system require the sys_dl_config privileges (at a minimum). *** privileges-orig.5.txt Mon Jul 28 18:40:51 2008 --- privileges.5.txt Mon Jul 28 18:44:29 2008 *************** *** 492,514 **** would otherwise be restricted (that is, most filesystems except namefs). Allow a process to add and remove swap devices. PRIV_SYS_IP_CONFIG ! Allow a process to configure a system's network inter- faces and routes. Allow a process to configure network parameters for TCP/IP using ndd. Allow a process access to otherwise restricted TCP/IP information using ndd. Allow a process to configure IPsec. Allows a process to pop anchored STREAMs modules with matching zoneid. PRIV_SYS_NET_CONFIG Allow a process to do all that PRIV_SYS_IP_CONFIG ! allows, plus the following: push the rpcmod STREAMS module, INSERT/REMOVE STREAMS modules on locations other than the top of the module stack, and configure data- links (NICs). --- 492,521 ---- would otherwise be restricted (that is, most filesystems except namefs). Allow a process to add and remove swap devices. + PRIV_SYS_DL_CONFIG + + Allow a process to configure a system's datalink + interfaces. + + PRIV_SYS_IP_CONFIG ! Allow a process to configure a system's IP inter- faces and routes. Allow a process to configure network parameters for TCP/IP using ndd. Allow a process access to otherwise restricted TCP/IP information using ndd. Allow a process to configure IPsec. Allows a process to pop anchored STREAMs modules with matching zoneid. PRIV_SYS_NET_CONFIG Allow a process to do all that PRIV_SYS_IP_CONFIG ! and PRIV_SYS_DL_CONFIG ! allow, plus the following: push the rpcmod STREAMS module, INSERT/REMOVE STREAMS modules on locations other than the top of the module stack, and configure data- links (NICs). -Seb From Sebastien.Roy@Sun.COM Mon Jul 28 16:03:48 2008 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m6SN3lxx007842 for ; Mon, 28 Jul 2008 16:03:48 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id m6SN3g0C017951 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Tue, 29 Jul 2008 07:03:46 +0800 (SGT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K4Q00103O29KB00@brm-avmta-1.central.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Mon, 28 Jul 2008 17:03:45 -0600 (MDT) Received: from brmea-mail-1.sun.com ([192.18.98.31]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K4Q00BG6O28SLA0@brm-avmta-1.central.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Mon, 28 Jul 2008 17:03:45 -0600 (MDT) Received: from fe-amer-09.sun.com ([192.18.109.79]) by brmea-mail-1.sun.com (8.13.6+Sun/8.12.9) with ESMTP id m6SN3iac015376 for ; Mon, 28 Jul 2008 23:03:44 +0000 (GMT) Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0K4Q00A01NU47R00@mail-amer.sun.com> (original mail from Sebastien.Roy@Sun.COM) for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Mon, 28 Jul 2008 17:03:44 -0600 (MDT) Received: from [192.168.1.3] ([71.174.191.147]) by mail-amer.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0K4Q002AEO28B250@mail-amer.sun.com>; Mon, 28 Jul 2008 17:03:44 -0600 (MDT) Date: Mon, 28 Jul 2008 19:03:43 -0400 From: Sebastien Roy Subject: Re: PSARC 2008/473 Fine-Grained Privileges for Datalink Administration In-reply-to: <1217285678.1187.8.camel@seb> Sender: Sebastien.Roy@Sun.COM To: Kais.Belgaied@Sun.COM Cc: psarc-ext Message-id: <1217286223.1187.10.camel@seb> Organization: Sun Microsystems MIME-version: 1.0 X-Mailer: Evolution 2.22.2 Content-type: text/plain Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <1216875057.1211.7.camel@seb> <488E46C5.9010603@Sun.COM> <1217285678.1187.8.camel@seb> Status: RO Content-Length: 2511 On Mon, 2008-07-28 at 18:54 -0400, Sebastien Roy wrote: > On Mon, 2008-07-28 at 15:23 -0700, Kais Belgaied wrote: > > could you include a delta of privileges(5) man page and the > > out-of-the-box exec_attr(4), and dladm(1m) > > as modified by this case? > > Here are the privileges(5) diffs. Let's try that again, I neglected to edit the last sentence of the PRIV_SYS_NET_CONFIG description (I'll also place the diffs in the materials directory): *** privileges-orig.5.txt Mon Jul 28 18:40:51 2008 --- privileges.5.txt Mon Jul 28 19:01:25 2008 *************** *** 492,517 **** would otherwise be restricted (that is, most filesystems except namefs). Allow a process to add and remove swap devices. PRIV_SYS_IP_CONFIG ! Allow a process to configure a system's network inter- faces and routes. Allow a process to configure network parameters for TCP/IP using ndd. Allow a process access to otherwise restricted TCP/IP information using ndd. Allow a process to configure IPsec. Allows a process to pop anchored STREAMs modules with matching zoneid. PRIV_SYS_NET_CONFIG Allow a process to do all that PRIV_SYS_IP_CONFIG ! allows, plus the following: push the rpcmod STREAMS ! module, INSERT/REMOVE STREAMS modules on locations other ! than the top of the module stack, and configure data- ! links (NICs). PRIV_SYS_NFS Allow a process to provide NFS service: start NFS kernel --- 492,523 ---- would otherwise be restricted (that is, most filesystems except namefs). Allow a process to add and remove swap devices. + PRIV_SYS_DL_CONFIG + + Allow a process to configure a system's datalink + interfaces. + + PRIV_SYS_IP_CONFIG ! Allow a process to configure a system's IP inter- faces and routes. Allow a process to configure network parameters for TCP/IP using ndd. Allow a process access to otherwise restricted TCP/IP information using ndd. Allow a process to configure IPsec. Allows a process to pop anchored STREAMs modules with matching zoneid. PRIV_SYS_NET_CONFIG Allow a process to do all that PRIV_SYS_IP_CONFIG ! and PRIV_SYS_DL_CONFIG allow, plus the following: push ! the rpcmod STREAMS module and INSERT/REMOVE STREAMS ! modules on locations other than the top of the module ! stack. PRIV_SYS_NFS Allow a process to provide NFS service: start NFS kernel -Seb From Sebastien.Roy@sun.com Wed Jul 30 10:05:55 2008 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m6UH5sYm020189 for ; Wed, 30 Jul 2008 10:05:55 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id m6UH5on4009102 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Thu, 31 Jul 2008 01:05:54 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K4T00819WTTPN00@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@Sun.COM); Wed, 30 Jul 2008 10:05:53 -0700 (PDT) Received: from brmea-mail-2.sun.com ([192.18.98.43]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K4T0033VWTRFB40@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@Sun.COM); Wed, 30 Jul 2008 10:05:52 -0700 (PDT) Received: from fe-amer-10.sun.com ([192.18.109.80]) by brmea-mail-2.sun.com (8.13.6+Sun/8.12.9) with ESMTP id m6UH5pMs018510 for ; Wed, 30 Jul 2008 17:05:51 +0000 (GMT) Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0K4T00E01UQ08000@mail-amer.sun.com> (original mail from Sebastien.Roy@Sun.COM) for PSARC-ext@Sun.COM (ORCPT PSARC-ext@Sun.COM); Wed, 30 Jul 2008 11:05:51 -0600 (MDT) Received: from [129.148.174.103] by mail-amer.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0K4T00CAZWTO9970@mail-amer.sun.com> for PSARC-ext@Sun.COM (ORCPT PSARC-ext@Sun.COM); Wed, 30 Jul 2008 11:05:49 -0600 (MDT) Date: Wed, 30 Jul 2008 13:05:48 -0400 From: Sebastien Roy Subject: Re: PSARC 2008/473 Fine-Grained Privileges for Datalink Administration In-reply-to: <1216875057.1211.7.camel@seb> Sender: Sebastien.Roy@sun.com To: psarc-ext Message-id: <1217437548.5764.1.camel@strat> Organization: Sun Microsystems MIME-version: 1.0 X-Mailer: Evolution 2.22.2 Content-type: text/plain Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <1216875057.1211.7.camel@seb> Status: RO Content-Length: 252 On Thu, 2008-07-24 at 00:50 -0400, Sebastien Roy wrote: > I'm submitting this fast-track for myself, it times out on July 31st, 2008. > > Fine-Grained Privileges for Datalink Administration This case was approved during today's PSARC meeting. -Seb