From lianep@nihil.sfbay.sun.com Wed Nov 11 12:49:42 2009 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id nABKnes3005262 for ; Wed, 11 Nov 2009 12:49:40 -0800 (PST) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id nABKnTvu018772 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Thu, 12 Nov 2009 04:49:39 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KSY00G0HPUPQ300@nwk-avmta-2.sfbay.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 11 Nov 2009 12:49:37 -0800 (PST) Received: from dm-sfbay-02.sfbay.sun.com ([129.146.11.31]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KSY00CM3PUNC950@nwk-avmta-2.sfbay.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 11 Nov 2009 12:49:35 -0800 (PST) Received: from nihil.sfbay.sun.com (nihil.SFBay.Sun.COM [129.146.228.161]) by dm-sfbay-02.sfbay.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.4) with ESMTP id nABKnZBJ021747; Wed, 11 Nov 2009 12:49:35 -0800 (PST) Received: from nihil.sfbay.sun.com (localhost [127.0.0.1]) by nihil.sfbay.sun.com (8.14.3+Sun/8.14.3) with ESMTP id nABKg5NV006246; Wed, 11 Nov 2009 12:42:05 -0800 (PST) Received: (from lianep@localhost) by nihil.sfbay.sun.com (8.14.3+Sun/8.14.3/Submit) id nABKg58p006244; Wed, 11 Nov 2009 12:42:05 -0800 (PST) Date: Wed, 11 Nov 2009 12:42:05 -0800 (PST) From: Liane Praza Subject: snmp-notify: SNMP Notification Daemon for Software Events [PSARC/2009/618 FastTrack timeout 11/18/2009] To: PSARC-ext@sun.com Cc: robert.johnston@sun.com Message-id: <200911112042.nABKg58p006244@nihil.sfbay.sun.com> Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 Status: RO Content-Length: 4558 Template Version: @(#)sac_nextcase 1.68 02/23/09 SMI This information is Copyright 2009 Sun Microsystems 1. Introduction 1.1. Project/Component Working Name: snmp-notify: SNMP Notification Daemon for Software Events 1.2. Name of Document Author/Supplier: Author: Robert Johnston 1.3 Date of This Document: 11 November, 2009 4. Technical Description 1. Introduction 1.1. Project/Component Working Name: snmp-notify: SNMP Notification Daemon for Software Events 1.2. Name of Document Author/Supplier: Author: Robert Johnston 1.3. Date of This Document: 11/10/2009 1.5. Email Aliases: 1.5.1. Responsible Manager: sridhar.yedunuthula@sun.com 1.5.2. Responsible Engineer: robert.johnston@sun.com 1.5.4. Interest List: swfma@sun.com 4. Technical Description: 4.1. Details: This case introduces a new system daemon (snmp-notify) and a new SNMP MIB (SUN-SWEVENT-MIB.mib) snmp-notify is a small, lightweight daemon that is fully managed by the Service Management Facility (SMF). It uses the interfaces delivered in libfmevent to subscribe to both software and FMA problem lifecycle events. Upon receipt of an event, it produces an SNMP trap notification based on a set of notification preferences which are stored in the SMF service configuration repository. snmp-notify supports a single notification preference, which can be set per event class (and per service for SMF service transition (STN) events): name type descr ---- ---- ---- active boolean toggles SNMP notifications on/off For STN events, the preference is attached to the individual service instance. For all other software events and FMA events, the preferences are attached to the instance svc:/system/notify-params:default. A set of default notification preferences for FMA events will be delivered in the manifest for the notify-params service. Users will be able to set and query notification preferences using svccfg(1M). snmp-notify will generate one of two types of SNMP traps, based on the event class. For FMA events (list.* events), snmp-notify will generate the existing sunFmProblemTrap trap as defined in /etc/net-snmp/snmp/mibs/SUN-FM-MIB.mib. For software events (swevent.*), snmp-notify will generate a sunSweventTrap trap as defined in /etc/net-snmp/snmp/mibs/SUN-SWEVENT-MIB.mib. snmp-notify provides a superset of the functionality currently provded by the snmp-trapgen FM module (PSARC 2005/754) Thus this case also includes the removal of the snmp-trapgen module. SUN-SWEVENT-MIB.mib contains the definition of the SNMP trap that snmp-notify will generate in response to software events. The snmp-notify daemon and MIB will be delivered in the SUNWfmd and SUNWfmdr packages. This case has been approved by the FMA Portfolio committee. This case seeks a patch binding. 4.5. Interfaces: Interface Stability Binding --------------------------------------------------------------- service FMRI name Committed Patch SUN-SWEVENT-MIB Committed Patch 4.11. Security Impact: The snmp-notify daemon starts and runs as uid 0 so that any log files it creates can be secured in the /var filesystem. However, during daemon initialization, it does reduce it's privilege set to the minimum set. afsr# ppriv 103247 103247: /usr/lib/fm/notify/snmp-notify flags = PRIV_AWARE E: basic I: basic P: basic L: basic The case will introduce the following new authorization for management of the smtp-notify service: solaris.smf.manage.snmp-notify This call also introduces the "Event Notification Agent Management" profile which will include the above authroization as well as the new authorization being added for the smtp-notify service. 5. Reference Documents: snmp-notify(1M) man page and SUN-SMF-MIB definition are available in the case directory. libfmevent PSARC case (2009/573) http://arc.opensolaris.org/caselog/PSARC/2009/573/ Software Events Notification Parameters CLI (2009/617) http://arc.opensolaris.org/caselog/PSARC/2009/617/ 6. Resources and Schedule: 6.4. Product Approval Committee requested information: 6.4.1. Consolidation or Component Name: OS/Net 6.5. ARC review type: Fasttrack 6.6. ARC Exposure: open 6. Resources and Schedule 6.4. Steering Committee requested information 6.4.1. Consolidation C-team Name: ON 6.5. ARC review type: FastTrack 6.6. ARC Exposure: open From Nicolas.Williams@sun.com Wed Nov 11 12:55:22 2009 Received: from sunmail2sca.sfbay.sun.com (sunmail2sca.SFBay.Sun.COM [129.145.155.234]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id nABKtLc5005625 for ; Wed, 11 Nov 2009 12:55:21 -0800 (PST) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail2sca.sfbay.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.4) with ESMTP id nABKtLIP011751; Wed, 11 Nov 2009 12:55:21 -0800 (PST) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KSY00L0JQ49H100@nwk-avmta-1.sfbay.Sun.COM>; Wed, 11 Nov 2009 12:55:21 -0800 (PST) Received: from binky.Central.Sun.COM ([129.153.128.104]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KSY00DXDQ476P70@nwk-avmta-1.sfbay.Sun.COM>; Wed, 11 Nov 2009 12:55:19 -0800 (PST) Received: from binky.Central.Sun.COM (localhost [127.0.0.1]) by binky.Central.Sun.COM (8.14.3+Sun/8.14.3) with ESMTP id nABKpF88013885; Wed, 11 Nov 2009 14:51:15 -0600 (CST) Received: (from nw141292@localhost) by binky.Central.Sun.COM (8.14.3+Sun/8.14.3/Submit) id nABKpE6Y013884; Wed, 11 Nov 2009 14:51:14 -0600 (CST) Date: Wed, 11 Nov 2009 14:51:14 -0600 From: Nicolas Williams Subject: Re: snmp-notify: SNMP Notification Daemon for Software Events [PSARC/2009/618 FastTrack timeout 11/18/2009] In-reply-to: <200911112042.nABKg58p006244@nihil.sfbay.sun.com> To: Liane Praza Cc: PSARC-ext@sun.com, Robert.Johnston@sun.com Message-id: <20091111205114.GR1105@Sun.COM> MIME-version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-disposition: inline X-PMX-Version: 5.4.1.325704 References: <200911112042.nABKg58p006244@nihil.sfbay.sun.com> X-Authentication-warning: binky.Central.Sun.COM: nw141292 set sender to Nicolas.Williams@sun.com using -f User-Agent: Mutt/1.5.7i Status: RO Content-Length: 613 On Wed, Nov 11, 2009 at 12:42:05PM -0800, Liane Praza wrote: > 4.11. Security Impact: > > The snmp-notify daemon starts and runs as uid 0 so that any log files > it creates can be secured in the /var filesystem. However, during > daemon initialization, it does reduce it's privilege set to the > minimum set. > > afsr# ppriv 103247 > 103247: /usr/lib/fm/notify/snmp-notify > flags = PRIV_AWARE > E: basic > I: basic > P: basic > L: basic But it will retain euid == 0, yes? Also, won't this mean that the daemon itself will not be able to rotate logs? Nico -- From Robert.Johnston@sun.com Wed Nov 11 13:45:13 2009 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id nABLjCWE007873 for ; Wed, 11 Nov 2009 13:45:13 -0800 (PST) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id nABLj7DU019945 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Wed, 11 Nov 2009 21:45:12 GMT Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KSY00445SFAST00@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 11 Nov 2009 13:45:10 -0800 (PST) Received: from brmea-mail-2.sun.com ([192.18.98.43]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KSY00DP2SFA6UC0@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 11 Nov 2009 13:45:10 -0800 (PST) Received: from fe-amer-09.sun.com ([192.18.109.79]) by brmea-mail-2.sun.com (8.13.6+Sun/8.12.9) with ESMTP id nABLj9xg014162 for ; Wed, 11 Nov 2009 21:45:09 +0000 (GMT) Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7u2-7.04 64bit (built Jul 2 2009)) id <0KSY00200R3EG600@mail-amer.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 11 Nov 2009 14:45:09 -0700 (MST) Received: from [192.168.2.5] ([unknown] [67.181.48.220]) by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7u2-7.04 64bit (built Jul 2 2009)) with ESMTPSA id <0KSY005QDSE8SCD0@mail-amer.sun.com>; Wed, 11 Nov 2009 14:44:32 -0700 (MST) Date: Wed, 11 Nov 2009 13:44:31 -0800 From: Rob Johnston Subject: Re: snmp-notify: SNMP Notification Daemon for Software Events [PSARC/2009/618 FastTrack timeout 11/18/2009] In-reply-to: <20091111205114.GR1105@Sun.COM> Sender: Robert.Johnston@sun.com To: Nicolas Williams Cc: Liane Praza , PSARC-ext@sun.com Message-id: <4AFB303F.4080800@sun.com> MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200911112042.nABKg58p006244@nihil.sfbay.sun.com> <20091111205114.GR1105@Sun.COM> User-Agent: Thunderbird 2.0.0.23 (X11/20091013) Status: RO Content-Length: 947 Nicolas Williams wrote: > On Wed, Nov 11, 2009 at 12:42:05PM -0800, Liane Praza wrote: >> 4.11. Security Impact: >> >> The snmp-notify daemon starts and runs as uid 0 so that any log files >> it creates can be secured in the /var filesystem. However, during >> daemon initialization, it does reduce it's privilege set to the >> minimum set. >> >> afsr# ppriv 103247 >> 103247: /usr/lib/fm/notify/snmp-notify >> flags = PRIV_AWARE >> E: basic >> I: basic >> P: basic >> L: basic > > But it will retain euid == 0, yes? Yes. Also, won't this mean that the > daemon itself will not be able to rotate logs? Yes - though the only log that the daemons will currently create is a debug log, which is not enabled by default. And there is no support in the daemons for rotating the debug logs. The other intention behind retaining uid 0 was to allow it to dump it's cores under /var/fm/notify/. rob From Nicolas.Williams@sun.com Wed Nov 11 14:22:46 2009 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id nABMMidd009083 for ; Wed, 11 Nov 2009 14:22:45 -0800 (PST) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id nABMMgea015277; Wed, 11 Nov 2009 22:22:42 GMT Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KSY00M05U5TNA00@nwk-avmta-2.sfbay.sun.com>; Wed, 11 Nov 2009 14:22:41 -0800 (PST) Received: from binky.Central.Sun.COM ([129.153.128.104]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KSY00CXDU5SCAB0@nwk-avmta-2.sfbay.sun.com>; Wed, 11 Nov 2009 14:22:40 -0800 (PST) Received: from binky.Central.Sun.COM (localhost [127.0.0.1]) by binky.Central.Sun.COM (8.14.3+Sun/8.14.3) with ESMTP id nABMIao0014019; Wed, 11 Nov 2009 16:18:36 -0600 (CST) Received: (from nw141292@localhost) by binky.Central.Sun.COM (8.14.3+Sun/8.14.3/Submit) id nABMIa7O014018; Wed, 11 Nov 2009 16:18:36 -0600 (CST) Date: Wed, 11 Nov 2009 16:18:36 -0600 From: Nicolas Williams Subject: Re: snmp-notify: SNMP Notification Daemon for Software Events [PSARC/2009/618 FastTrack timeout 11/18/2009] In-reply-to: <4AFB303F.4080800@sun.com> To: Rob Johnston Cc: Liane Praza , PSARC-ext@sun.com Message-id: <20091111221836.GU1105@Sun.COM> MIME-version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-disposition: inline X-PMX-Version: 5.4.1.325704 References: <200911112042.nABKg58p006244@nihil.sfbay.sun.com> <20091111205114.GR1105@Sun.COM> <4AFB303F.4080800@sun.com> X-Authentication-warning: binky.Central.Sun.COM: nw141292 set sender to Nicolas.Williams@sun.com using -f User-Agent: Mutt/1.5.7i Status: RO Content-Length: 1109 On Wed, Nov 11, 2009 at 01:44:31PM -0800, Rob Johnston wrote: > Nicolas Williams wrote: > >But it will retain euid == 0, yes? > > Yes. It doesn't need to after opening log files. > Also, won't this mean that the > >daemon itself will not be able to rotate logs? > > Yes - though the only log that the daemons will currently create is a > debug log, which is not enabled by default. And there is no support > in the daemons for rotating the debug logs. The other intention > behind retaining uid 0 was to allow it to dump it's cores under > /var/fm/notify/. On the phone you characterized this debug log as a private interface. Is that right? To me that seems like a poor reason to complicate process credentials setup of the daemon, though there's nothing fatally wrong with doing that. For a private debug logging facility I'd just make the daemon take SIGUSR1/2 to enable/disable debug logging to syslog, and be done. As for core dumping... Why should a service set its process core pattern? Why not use global coreadm settings? That seems like an architecturally significant detail. Nico -- From Robert.Johnston@sun.com Wed Nov 11 14:43:27 2009 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id nABMhPFW009639 for ; Wed, 11 Nov 2009 14:43:26 -0800 (PST) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id nABMhHxm000448 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Wed, 11 Nov 2009 22:43:24 GMT Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KSY00005V4AWV00@nwk-avmta-2.sfbay.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 11 Nov 2009 14:43:22 -0800 (PST) Received: from brmea-mail-4.sun.com ([192.18.98.36]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KSY00CELV49CJC0@nwk-avmta-2.sfbay.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 11 Nov 2009 14:43:21 -0800 (PST) Received: from fe-amer-10.sun.com ([192.18.109.80]) by brmea-mail-4.sun.com (8.13.6+Sun/8.12.9) with ESMTP id nABMhLCm010499 for ; Wed, 11 Nov 2009 22:43:21 +0000 (GMT) Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7u2-7.04 64bit (built Jul 2 2009)) id <0KSY00J00V30VU00@mail-amer.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 11 Nov 2009 15:43:21 -0700 (MST) Received: from [192.168.2.5] ([unknown] [67.181.48.220]) by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7u2-7.04 64bit (built Jul 2 2009)) with ESMTPSA id <0KSY007WYV45BQF0@mail-amer.sun.com>; Wed, 11 Nov 2009 15:43:17 -0700 (MST) Date: Wed, 11 Nov 2009 14:43:17 -0800 From: Rob Johnston Subject: Re: snmp-notify: SNMP Notification Daemon for Software Events [PSARC/2009/618 FastTrack timeout 11/18/2009] In-reply-to: <20091111221836.GU1105@Sun.COM> Sender: Robert.Johnston@sun.com To: Nicolas Williams Cc: Liane Praza , PSARC-ext@sun.com Message-id: <4AFB3E05.5000703@sun.com> MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200911112042.nABKg58p006244@nihil.sfbay.sun.com> <20091111205114.GR1105@Sun.COM> <4AFB303F.4080800@sun.com> <20091111221836.GU1105@Sun.COM> User-Agent: Thunderbird 2.0.0.23 (X11/20091013) Status: RO Content-Length: 1737 Nicolas Williams wrote: > On Wed, Nov 11, 2009 at 01:44:31PM -0800, Rob Johnston wrote: >> Nicolas Williams wrote: >>> But it will retain euid == 0, yes? >> Yes. > > It doesn't need to after opening log files. > >> Also, won't this mean that the >>> daemon itself will not be able to rotate logs? >> Yes - though the only log that the daemons will currently create is a >> debug log, which is not enabled by default. And there is no support >> in the daemons for rotating the debug logs. The other intention >> behind retaining uid 0 was to allow it to dump it's cores under >> /var/fm/notify/. > > On the phone you characterized this debug log as a private interface. > Is that right? Yes - it's private and disabled by default. > To me that seems like a poor reason to complicate > process credentials setup of the daemon, though there's nothing fatally > wrong with doing that. For a private debug logging facility I'd just > make the daemon take SIGUSR1/2 to enable/disable debug logging to > syslog, and be done. Yes, good point - and this seems like a reasonable way to go. I will make this change. > As for core dumping... > > Why should a service set its process core pattern? Why not use global > coreadm settings? That seems like an architecturally significant > detail. This is how fmd(1m) has always behaved (it sets it's core pattern to drop it's cores in /var/fm/fmd/), so there's precedence for this. From experience looking at a lot of fmd issues on customer systems, it has helped us to know where the fmd cores are going to be and to know that all of the fmd cores have been preserved and not overwritten. Based on that we'd like snmp-notify and smtp-notify to behave in a similar fashion. rob From Nicolas.Williams@Sun.COM Wed Nov 11 14:57:20 2009 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id nABMvIfd010266 for ; Wed, 11 Nov 2009 14:57:19 -0800 (PST) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id nABMvCVF008719; Wed, 11 Nov 2009 22:57:16 GMT Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KSY00E01VRF9200@nwk-avmta-1.sfbay.Sun.COM>; Wed, 11 Nov 2009 14:57:15 -0800 (PST) Received: from binky.Central.Sun.COM ([129.153.128.104]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KSY00C74VREE510@nwk-avmta-1.sfbay.Sun.COM>; Wed, 11 Nov 2009 14:57:14 -0800 (PST) Received: from binky.Central.Sun.COM (localhost [127.0.0.1]) by binky.Central.Sun.COM (8.14.3+Sun/8.14.3) with ESMTP id nABMr71V014506; Wed, 11 Nov 2009 16:53:07 -0600 (CST) Received: (from nw141292@localhost) by binky.Central.Sun.COM (8.14.3+Sun/8.14.3/Submit) id nABMr7KB014505; Wed, 11 Nov 2009 16:53:07 -0600 (CST) Date: Wed, 11 Nov 2009 16:53:07 -0600 From: Nicolas Williams Subject: Re: snmp-notify: SNMP Notification Daemon for Software Events [PSARC/2009/618 FastTrack timeout 11/18/2009] In-reply-to: <4AFB3E05.5000703@sun.com> To: Rob Johnston Cc: Liane Praza , PSARC-ext@Sun.COM Message-id: <20091111225306.GV1105@Sun.COM> MIME-version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-disposition: inline X-PMX-Version: 5.4.1.325704 References: <200911112042.nABKg58p006244@nihil.sfbay.sun.com> <20091111205114.GR1105@Sun.COM> <4AFB303F.4080800@sun.com> <20091111221836.GU1105@Sun.COM> <4AFB3E05.5000703@sun.com> X-Authentication-warning: binky.Central.Sun.COM: nw141292 set sender to Nicolas.Williams@sun.com using -f User-Agent: Mutt/1.5.7i Status: RO Content-Length: 1791 On Wed, Nov 11, 2009 at 02:43:17PM -0800, Rob Johnston wrote: > Nicolas Williams wrote: > >On the phone you characterized this debug log as a private interface. > >Is that right? > > Yes - it's private and disabled by default. > > >To me that seems like a poor reason to complicate > >process credentials setup of the daemon, though there's nothing fatally > >wrong with doing that. For a private debug logging facility I'd just > >make the daemon take SIGUSR1/2 to enable/disable debug logging to > >syslog, and be done. > > Yes, good point - and this seems like a reasonable way to go. I will make > this change. OK. That simplifies things a bit. > >As for core dumping... > > > >Why should a service set its process core pattern? Why not use global > >coreadm settings? That seems like an architecturally significant > >detail. > > This is how fmd(1m) has always behaved (it sets it's core pattern to drop > it's cores in /var/fm/fmd/), so there's precedence for this. From > experience looking at a lot of fmd issues on customer systems, it has > helped us to know where the fmd cores are going to be and to know that all > of the fmd cores have been preserved and not overwritten. Based on that > we'd like snmp-notify and smtp-notify to behave in a similar fashion. Interesting. If this is something that we want to do there must also be a better way to do this... I find it odd that this choice should force daemons to run with euid == 0. For example, we could have a directory, say, /var/core/noaccess/ owned by noaccess (or perhaps with write perms for the noaccess group) into which such daemons could drop core. fmd may need privileges and euid==0 for other reasons -- such daemons should not drop core in a directory that noaccess can write to. Nico -- From Robert.Johnston@sun.com Wed Nov 11 15:04:40 2009 Received: from sunmail2sca.sfbay.sun.com (sunmail2sca.SFBay.Sun.COM [129.145.155.234]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id nABN4dVi010404 for ; Wed, 11 Nov 2009 15:04:39 -0800 (PST) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail2sca.sfbay.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.4) with ESMTP id nABN4dO2025720 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Wed, 11 Nov 2009 15:04:39 -0800 (PST) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KSY00307W3RXL00@brm-avmta-1.central.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 11 Nov 2009 16:04:39 -0700 (MST) Received: from brmea-mail-2.sun.com ([192.18.98.43]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KSY00623W3QN1C0@brm-avmta-1.central.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 11 Nov 2009 16:04:38 -0700 (MST) Received: from fe-amer-09.sun.com ([192.18.109.79]) by brmea-mail-2.sun.com (8.13.6+Sun/8.12.9) with ESMTP id nABN4cHh017496 for ; Wed, 11 Nov 2009 23:04:38 +0000 (GMT) Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7u2-7.04 64bit (built Jul 2 2009)) id <0KSY00400VWULD00@mail-amer.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 11 Nov 2009 16:04:38 -0700 (MST) Received: from [192.168.2.5] ([unknown] [67.181.48.220]) by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7u2-7.04 64bit (built Jul 2 2009)) with ESMTPSA id <0KSY00EXHW3K4KB0@mail-amer.sun.com>; Wed, 11 Nov 2009 16:04:32 -0700 (MST) Date: Wed, 11 Nov 2009 15:04:32 -0800 From: Rob Johnston Subject: Re: snmp-notify: SNMP Notification Daemon for Software Events [PSARC/2009/618 FastTrack timeout 11/18/2009] In-reply-to: <20091111225306.GV1105@Sun.COM> Sender: Robert.Johnston@sun.com To: Nicolas Williams Cc: Liane Praza , PSARC-ext@sun.com Message-id: <4AFB4300.10609@sun.com> MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200911112042.nABKg58p006244@nihil.sfbay.sun.com> <20091111205114.GR1105@Sun.COM> <4AFB303F.4080800@sun.com> <20091111221836.GU1105@Sun.COM> <4AFB3E05.5000703@sun.com> <20091111225306.GV1105@Sun.COM> User-Agent: Thunderbird 2.0.0.23 (X11/20091013) Status: RO Content-Length: 1145 Nicolas Williams wrote: > On Wed, Nov 11, 2009 at 02:43:17PM -0800, Rob Johnston wrote: >> Nicolas Williams wrote: >>> On the phone you characterized this debug log as a private interface. >>> Is that right? >> Yes - it's private and disabled by default. >> >>> To me that seems like a poor reason to complicate >>> process credentials setup of the daemon, though there's nothing fatally >>> wrong with doing that. For a private debug logging facility I'd just >>> make the daemon take SIGUSR1/2 to enable/disable debug logging to >>> syslog, and be done. >> Yes, good point - and this seems like a reasonable way to go. I will make >> this change. > > OK. That simplifies things a bit. I think one thing I like about enabling/disabling the debug log via an SMF property is that we can make the setting persistent. So I would propose that I retain that aspect of the current implementation and simply change it to log into syslog, rather than to the private log file. Do that seem reasonable? Also, since it is a private debug mechanism, perhaps I should remove the mention of it in the man page? thanks again for your help, rob From Nicolas.Williams@sun.com Wed Nov 11 15:07:10 2009 Received: from sunmail3mpk.sfbay.sun.com (sunmail3mpk.SFBay.Sun.COM [129.146.11.52]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id nABN79QP010444 for ; Wed, 11 Nov 2009 15:07:09 -0800 (PST) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail3mpk.sfbay.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.4) with ESMTP id nABN78fB019249; Wed, 11 Nov 2009 15:07:09 -0800 (PST) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KSY0021DW7WH600@nwk-avmta-2.sfbay.sun.com>; Wed, 11 Nov 2009 15:07:08 -0800 (PST) Received: from binky.Central.Sun.COM ([129.153.128.104]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KSY00CY4W7VCJD0@nwk-avmta-2.sfbay.sun.com>; Wed, 11 Nov 2009 15:07:08 -0800 (PST) Received: from binky.Central.Sun.COM (localhost [127.0.0.1]) by binky.Central.Sun.COM (8.14.3+Sun/8.14.3) with ESMTP id nABN34Zu014529; Wed, 11 Nov 2009 17:03:04 -0600 (CST) Received: (from nw141292@localhost) by binky.Central.Sun.COM (8.14.3+Sun/8.14.3/Submit) id nABN34Xw014528; Wed, 11 Nov 2009 17:03:04 -0600 (CST) Date: Wed, 11 Nov 2009 17:03:04 -0600 From: Nicolas Williams Subject: Re: snmp-notify: SNMP Notification Daemon for Software Events [PSARC/2009/618 FastTrack timeout 11/18/2009] In-reply-to: <4AFB4300.10609@sun.com> To: Rob Johnston Cc: Liane Praza , PSARC-ext@sun.com Message-id: <20091111230303.GX1105@Sun.COM> MIME-version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-disposition: inline X-PMX-Version: 5.4.1.325704 References: <200911112042.nABKg58p006244@nihil.sfbay.sun.com> <20091111205114.GR1105@Sun.COM> <4AFB303F.4080800@sun.com> <20091111221836.GU1105@Sun.COM> <4AFB3E05.5000703@sun.com> <20091111225306.GV1105@Sun.COM> <4AFB4300.10609@sun.com> X-Authentication-warning: binky.Central.Sun.COM: nw141292 set sender to Nicolas.Williams@sun.com using -f User-Agent: Mutt/1.5.7i Status: RO Content-Length: 703 On Wed, Nov 11, 2009 at 03:04:32PM -0800, Rob Johnston wrote: > I think one thing I like about enabling/disabling the debug log via an SMF > property is that we can make the setting persistent. So I would propose > that I retain that aspect of the current implementation and simply change > it to log into syslog, rather than to the private log file. Do that seem > reasonable? You can always just fprintf() to stdout or stderr -- SMF arranges for those to go to a log file (see svcs(1) -xv). SMF will take care of log rotation. > Also, since it is a private debug mechanism, perhaps I should remove the > mention of it in the man page? Unless it's of use to users, yes, remove it. Nico -- From Robert.Johnston@sun.com Wed Nov 11 15:09:55 2009 Received: from sunmail2sca.sfbay.sun.com (sunmail2sca.SFBay.Sun.COM [129.145.155.234]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id nABN9tUq010497 for ; Wed, 11 Nov 2009 15:09:55 -0800 (PST) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail2sca.sfbay.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.4) with ESMTP id nABN9tb6027489 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Wed, 11 Nov 2009 15:09:55 -0800 (PST) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KSY00F05WCJVD00@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 11 Nov 2009 15:09:55 -0800 (PST) Received: from brmea-mail-1.sun.com ([192.18.98.31]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KSY00CR9WCIE520@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 11 Nov 2009 15:09:54 -0800 (PST) Received: from fe-amer-09.sun.com ([192.18.109.79]) by brmea-mail-1.sun.com (8.13.6+Sun/8.12.9) with ESMTP id nABN9s4x001201 for ; Wed, 11 Nov 2009 23:09:54 +0000 (GMT) Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7u2-7.04 64bit (built Jul 2 2009)) id <0KSY00400VWULD00@mail-amer.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 11 Nov 2009 16:09:54 -0700 (MST) Received: from [192.168.2.5] ([unknown] [67.181.48.220]) by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7u2-7.04 64bit (built Jul 2 2009)) with ESMTPSA id <0KSY00EY5WCH4KD0@mail-amer.sun.com>; Wed, 11 Nov 2009 16:09:54 -0700 (MST) Date: Wed, 11 Nov 2009 15:09:53 -0800 From: Rob Johnston Subject: Re: snmp-notify: SNMP Notification Daemon for Software Events [PSARC/2009/618 FastTrack timeout 11/18/2009] In-reply-to: <20091111230303.GX1105@Sun.COM> Sender: Robert.Johnston@sun.com To: Nicolas Williams Cc: Liane Praza , PSARC-ext@sun.com Message-id: <4AFB4441.5030904@sun.com> MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200911112042.nABKg58p006244@nihil.sfbay.sun.com> <20091111205114.GR1105@Sun.COM> <4AFB303F.4080800@sun.com> <20091111221836.GU1105@Sun.COM> <4AFB3E05.5000703@sun.com> <20091111225306.GV1105@Sun.COM> <4AFB4300.10609@sun.com> <20091111230303.GX1105@Sun.COM> User-Agent: Thunderbird 2.0.0.23 (X11/20091013) Status: RO Content-Length: 800 Nicolas Williams wrote: > On Wed, Nov 11, 2009 at 03:04:32PM -0800, Rob Johnston wrote: >> I think one thing I like about enabling/disabling the debug log via an SMF >> property is that we can make the setting persistent. So I would propose >> that I retain that aspect of the current implementation and simply change >> it to log into syslog, rather than to the private log file. Do that seem >> reasonable? > > You can always just fprintf() to stdout or stderr -- SMF arranges for > those to go to a log file (see svcs(1) -xv). SMF will take care of log > rotation. Well, that's even better :) > >> Also, since it is a private debug mechanism, perhaps I should remove the >> mention of it in the man page? > > Unless it's of use to users, yes, remove it. Yes, will do. thanks, rob From Nicolas.Williams@sun.com Wed Nov 11 15:12:56 2009 Received: from sunmail2sca.sfbay.sun.com (sunmail2sca.SFBay.Sun.COM [129.145.155.234]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id nABNCtD4010547 for ; Wed, 11 Nov 2009 15:12:55 -0800 (PST) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail2sca.sfbay.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.4) with ESMTP id nABNCqKc028847; Wed, 11 Nov 2009 15:12:55 -0800 (PST) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KSY0040XWHIS100@brm-avmta-1.central.sun.com>; Wed, 11 Nov 2009 16:12:54 -0700 (MST) Received: from binky.Central.Sun.COM ([129.153.128.104]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KSY0063BWHHNAF0@brm-avmta-1.central.sun.com>; Wed, 11 Nov 2009 16:12:53 -0700 (MST) Received: from binky.Central.Sun.COM (localhost [127.0.0.1]) by binky.Central.Sun.COM (8.14.3+Sun/8.14.3) with ESMTP id nABN8ooc014557; Wed, 11 Nov 2009 17:08:50 -0600 (CST) Received: (from nw141292@localhost) by binky.Central.Sun.COM (8.14.3+Sun/8.14.3/Submit) id nABN8oQk014556; Wed, 11 Nov 2009 17:08:50 -0600 (CST) Date: Wed, 11 Nov 2009 17:08:50 -0600 From: Nicolas Williams Subject: Re: snmp-notify: SNMP Notification Daemon for Software Events [PSARC/2009/618 FastTrack timeout 11/18/2009] In-reply-to: <4AFB4441.5030904@sun.com> To: Rob Johnston Cc: Liane Praza , PSARC-ext@sun.com Message-id: <20091111230849.GZ1105@Sun.COM> MIME-version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-disposition: inline X-PMX-Version: 5.4.1.325704 References: <200911112042.nABKg58p006244@nihil.sfbay.sun.com> <20091111205114.GR1105@Sun.COM> <4AFB303F.4080800@sun.com> <20091111221836.GU1105@Sun.COM> <4AFB3E05.5000703@sun.com> <20091111225306.GV1105@Sun.COM> <4AFB4300.10609@sun.com> <20091111230303.GX1105@Sun.COM> <4AFB4441.5030904@sun.com> X-Authentication-warning: binky.Central.Sun.COM: nw141292 set sender to Nicolas.Williams@sun.com using -f User-Agent: Mutt/1.5.7i Status: RO Content-Length: 372 On Wed, Nov 11, 2009 at 03:09:53PM -0800, Rob Johnston wrote: > >You can always just fprintf() to stdout or stderr -- SMF arranges for > >those to go to a log file (see svcs(1) -xv). SMF will take care of log > >rotation. > > Well, that's even better :) Do beware of: 6578671 smf services keep logging to old smf logs after log rotation as well, until we restart them From liane.praza@Sun.COM Tue Nov 17 01:49:19 2009 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id nAH9nIRg020225 for ; Tue, 17 Nov 2009 01:49:19 -0800 (PST) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id nAH9nA1w024622; Tue, 17 Nov 2009 09:49:15 GMT Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KT800603ZA29U00@nwk-avmta-1.sfbay.Sun.COM>; Tue, 17 Nov 2009 01:49:14 -0800 (PST) Received: from jurassic-x4600.sfbay.sun.com ([129.146.17.59]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KT8009H5ZA2RA60@nwk-avmta-1.sfbay.Sun.COM>; Tue, 17 Nov 2009 01:49:14 -0800 (PST) Received: from [10.7.251.216] (punchin-lianep.SFBay.Sun.COM [10.7.251.216]) by jurassic-x4600.sfbay.sun.com (8.14.3+Sun/8.14.3) with ESMTP id nAH9nB0I764278; Tue, 17 Nov 2009 01:49:11 -0800 (PST) Date: Tue, 17 Nov 2009 01:49:13 -0800 From: Liane Praza Subject: Re: snmp-notify: SNMP Notification Daemon for Software Events [PSARC/2009/618 FastTrack timeout 11/18/2009] In-reply-to: <20091111230849.GZ1105@Sun.COM> To: Nicolas Williams Cc: Rob Johnston , Liane Praza , PSARC-ext@Sun.COM Message-id: <4B027199.1080107@sun.com> MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200911112042.nABKg58p006244@nihil.sfbay.sun.com> <20091111205114.GR1105@Sun.COM> <4AFB303F.4080800@sun.com> <20091111221836.GU1105@Sun.COM> <4AFB3E05.5000703@sun.com> <20091111225306.GV1105@Sun.COM> <4AFB4300.10609@sun.com> <20091111230303.GX1105@Sun.COM> <4AFB4441.5030904@sun.com> <20091111230849.GZ1105@Sun.COM> User-Agent: Thunderbird 2.0.0.23 (X11/20091027) Status: RO Content-Length: 210 Rob's sent me updated materials which reflect the clarifications due to the conversation here around privileges and the removal of config/debug from the manpages. I've put them in the case directory. liane From gww@sac.sfbay.sun.com Tue Nov 17 19:32:33 2009 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id nAI3WWZI014284 for ; Tue, 17 Nov 2009 19:32:33 -0800 (PST) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id nAI3WF2x007192 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@Sun.COM>; Wed, 18 Nov 2009 03:32:31 GMT Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KTA00J0NCI4SD00@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@Sun.COM (ORCPT PSARC-ext@Sun.COM); Tue, 17 Nov 2009 19:32:28 -0800 (PST) Received: from dm-sfbay-02.sfbay.sun.com ([129.146.11.31]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KTA0004ECI49YC0@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@Sun.COM (ORCPT PSARC-ext@Sun.COM); Tue, 17 Nov 2009 19:32:28 -0800 (PST) Received: from sac.sfbay.sun.com (sac.SFBay.Sun.COM [129.146.226.132]) by dm-sfbay-02.sfbay.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.4) with ESMTP id nAI3WNGD004313; Tue, 17 Nov 2009 19:32:25 -0800 (PST) Received: from sac.sfbay.sun.com (localhost [127.0.0.1]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id nAI3WNCL014281; Tue, 17 Nov 2009 19:32:23 -0800 (PST) Received: (from gww@localhost) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8/Submit) id nAI3WN94014280; Tue, 17 Nov 2009 19:32:23 -0800 (PST) Date: Tue, 17 Nov 2009 19:32:23 -0800 (PST) From: Gary Winiger Subject: Re: snmp-notify: SNMP Notification Daemon for Software Events [PSARC/2009/618 FastTrack timeout 11/18/2009] To: Nicolas.Williams@sun.com, liane.praza@sun.com Cc: PSARC-ext@sun.com, Robert.Johnston@sun.com, lianep@nihil.sfbay.sun.com Message-id: <200911180332.nAI3WN94014280@sac.sfbay.sun.com> Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 Status: RO Content-Length: 1702 > Rob's sent me updated materials which reflect the clarifications due > to the conversation here around privileges and the removal of > config/debug from the manpages. > > I've put them in the case directory. > config/rootdir > > This is an astring property that defaults to "/". > When set, the specified root directory will be used for > all pathnames evaluated by snmp-notify. > 4.11. Security Impact: > > During daemon initialization, the smtp-notify daemon will reduce its > privileges to the following minimal set: > > afsr# ppriv 103247 > 103247: /usr/lib/fm/notify/snmp-notify > flags = PRIV_AWARE > E: basic > I: basic > P: basic > L: basic > > The case will introduce the following new authorization for management > of the smtp-notify service: > > solaris.smf.manage.snmp-notify > > This case also introduces the "Event Notification Agent Management" > profile which will include the above authorization as well as the new > authorization being added for the smtp-notify service. Similar to 2009/619, Can this privilege reduction be done with a method context instead of by the daemon? If so, why isn't that the choice? If not, why not? What uid/gid does the daemon run with and why -- unless it is noaccess. Additionally this case seems not to follow the SMF policy for configuring properties. See http://sac.eng.sun.com/cgi-bin/bp.cgi?NAME=SMF.bp (there is an opensolsaris.org equivalent, but that website is not presently responding so I can't cut a paste the url). See appendix D relative to value_authorization. Nit, I suspect there's a case dependency on PSARC/2009/617 Gary.. From Robert.Johnston@sun.com Wed Nov 18 09:09:13 2009 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id nAIH9CAw013245 for ; Wed, 18 Nov 2009 09:09:12 -0800 (PST) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id nAIH9B8O012330 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Wed, 18 Nov 2009 10:09:12 -0700 (MST) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KTB0024YEBCU500@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 18 Nov 2009 09:09:12 -0800 (PST) Received: from brmea-mail-1.sun.com ([192.18.98.31]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KTB008GJEBBJL90@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 18 Nov 2009 09:09:12 -0800 (PST) Received: from fe-amer-09.sun.com ([192.18.109.79]) by brmea-mail-1.sun.com (8.13.6+Sun/8.12.9) with ESMTP id nAIH9BY4008156 for ; Wed, 18 Nov 2009 17:09:11 +0000 (GMT) Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7u2-7.04 64bit (built Jul 2 2009)) id <0KTB00L00D1DQI00@mail-amer.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 18 Nov 2009 10:09:11 -0700 (MST) Received: from MacBookPro.local ([unknown] [67.181.40.130]) by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7u2-7.04 64bit (built Jul 2 2009)) with ESMTPSA id <0KTB0065MEAYBV60@mail-amer.sun.com>; Wed, 18 Nov 2009 10:08:59 -0700 (MST) Date: Wed, 18 Nov 2009 09:08:58 -0800 From: Robert Johnston Subject: Re: snmp-notify: SNMP Notification Daemon for Software Events [PSARC/2009/618 FastTrack timeout 11/18/2009] In-reply-to: <200911180332.nAI3WN94014280@sac.sfbay.sun.com> Sender: Robert.Johnston@sun.com To: Gary Winiger Cc: Nicolas.Williams@sun.com, Liane.Praza@sun.com, PSARC-ext@sun.com, Robert.Johnston@sun.com Message-id: <4B042A2A.5000805@sun.com> MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200911180332.nAI3WN94014280@sac.sfbay.sun.com> User-Agent: Thunderbird 2.0.0.23 (Macintosh/20090812) Status: RO Content-Length: 1986 Gary Winiger wrote: >> Rob's sent me updated materials which reflect the clarifications due >> to the conversation here around privileges and the removal of >> config/debug from the manpages. >> >> I've put them in the case directory. > >> config/rootdir >> >> This is an astring property that defaults to "/". >> When set, the specified root directory will be used for >> all pathnames evaluated by snmp-notify. > >> 4.11. Security Impact: >> >> During daemon initialization, the smtp-notify daemon will reduce its >> privileges to the following minimal set: >> >> afsr# ppriv 103247 >> 103247: /usr/lib/fm/notify/snmp-notify >> flags = PRIV_AWARE >> E: basic >> I: basic >> P: basic >> L: basic >> >> The case will introduce the following new authorization for management >> of the smtp-notify service: >> >> solaris.smf.manage.snmp-notify >> >> This case also introduces the "Event Notification Agent Management" >> profile which will include the above authorization as well as the new >> authorization being added for the smtp-notify service. > > Similar to 2009/619, > Can this privilege reduction be done with a method context instead > of by the daemon? If so, why isn't that the choice? If not, > why not? > > What uid/gid does the daemon run with and why -- unless it is noaccess. Same deal as smtp-notify. We initially start as uid/gid 0 to get the sysevent stuff going and then change our uid/gid to noaccess/noaccess. > Additionally this case seems not to follow the SMF policy for > configuring properties. See > http://sac.eng.sun.com/cgi-bin/bp.cgi?NAME=SMF.bp > (there is an opensolsaris.org equivalent, but that website is > not presently responding so I can't cut a paste the url). > See appendix D relative to value_authorization. Ok - let me look through this and get back. > Nit, I suspect there's a case dependency on PSARC/2009/617 Yes. thanks, rob From Robert.Johnston@Sun.COM Wed Nov 18 09:50:08 2009 Received: from sunmail2sca.sfbay.sun.com (sunmail2sca.SFBay.Sun.COM [129.145.155.234]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id nAIHo8Bm015731 for ; Wed, 18 Nov 2009 09:50:08 -0800 (PST) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail2sca.sfbay.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.4) with ESMTP id nAIHo83n016153 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Wed, 18 Nov 2009 09:50:08 -0800 (PST) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KTB0010BG7KAB00@nwk-avmta-2.sfbay.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 18 Nov 2009 09:50:08 -0800 (PST) Received: from brmea-mail-1.sun.com ([192.18.98.31]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KTB00H6MG7IJKA0@nwk-avmta-2.sfbay.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 18 Nov 2009 09:50:07 -0800 (PST) Received: from fe-amer-09.sun.com ([192.18.109.79]) by brmea-mail-1.sun.com (8.13.6+Sun/8.12.9) with ESMTP id nAIHo6nd029494 for ; Wed, 18 Nov 2009 17:50:06 +0000 (GMT) Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7u2-7.04 64bit (built Jul 2 2009)) id <0KTB00900F0E3900@mail-amer.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 18 Nov 2009 10:50:06 -0700 (MST) Received: from MacBookPro.local ([unknown] [67.181.40.130]) by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7u2-7.04 64bit (built Jul 2 2009)) with ESMTPSA id <0KTB00LIIG7H9B90@mail-amer.sun.com>; Wed, 18 Nov 2009 10:50:06 -0700 (MST) Date: Wed, 18 Nov 2009 09:50:05 -0800 From: Robert Johnston Subject: Re: snmp-notify: SNMP Notification Daemon for Software Events [PSARC/2009/618 FastTrack timeout 11/18/2009] In-reply-to: <4B042A2A.5000805@sun.com> Sender: Robert.Johnston@Sun.COM To: Gary Winiger Cc: Robert Johnston , Nicolas.Williams@Sun.COM, Liane.Praza@Sun.COM, PSARC-ext@Sun.COM Message-id: <4B0433CD.6040908@sun.com> MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200911180332.nAI3WN94014280@sac.sfbay.sun.com> <4B042A2A.5000805@sun.com> User-Agent: Thunderbird 2.0.0.23 (Macintosh/20090812) Status: RO Content-Length: 2314 Robert Johnston wrote: > Gary Winiger wrote: >>> Rob's sent me updated materials which reflect the clarifications due >>> to the conversation here around privileges and the removal of >>> config/debug from the manpages. >>> >>> I've put them in the case directory. >> >>> config/rootdir >>> This is an astring property that defaults to "/". >>> When set, the specified root directory will be used for >>> all pathnames evaluated by snmp-notify. >> >>> 4.11. Security Impact: >>> >>> During daemon initialization, the smtp-notify daemon will reduce its >>> privileges to the following minimal set: >>> >>> afsr# ppriv 103247 >>> 103247: /usr/lib/fm/notify/snmp-notify >>> flags = PRIV_AWARE >>> E: basic >>> I: basic >>> P: basic >>> L: basic >>> >>> The case will introduce the following new authorization for >>> management >>> of the smtp-notify service: >>> >>> solaris.smf.manage.snmp-notify >>> >>> This case also introduces the "Event Notification Agent Management" >>> profile which will include the above authorization as well as the >>> new >>> authorization being added for the smtp-notify service. >> >> Similar to 2009/619, >> Can this privilege reduction be done with a method context instead >> of by the daemon? If so, why isn't that the choice? If not, >> why not? >> >> What uid/gid does the daemon run with and why -- unless it is >> noaccess. > > Same deal as smtp-notify. We initially start as uid/gid 0 to get the > sysevent stuff going and then change our uid/gid to noaccess/noaccess. BTW, I forgot to update the list of privileges for snmp-notify. Originally it ran as uid/gid 0, so we could get away with just basic privileges. Since the daemon now changes its uid/gid to noaccess/noaccess, it also requires the PRIV_FILE_DAC_READ privilege in order to send SNMP traps. afsr# ppriv 104900 104900: /usr/lib/fm/notify/snmp-notify flags = PRIV_AWARE E: basic,file_dac_read I: basic,file_dac_read P: basic,file_dac_read L: basic,file_dac_read I'll send an updated copy of the snmp-notify one-pager to Liane so she can put it in the case directory. Sorry for any confusion. rob From Robert.Johnston@sun.com Wed Nov 18 14:58:14 2009 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id nAIMwD9I000598 for ; Wed, 18 Nov 2009 14:58:13 -0800 (PST) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id nAIMwBbH001925 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Wed, 18 Nov 2009 22:58:12 GMT Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KTB00K1PUH03I00@nwk-avmta-2.sfbay.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 18 Nov 2009 14:58:12 -0800 (PST) Received: from brmea-mail-2.sun.com ([192.18.98.43]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KTB00HRQUGY9W30@nwk-avmta-2.sfbay.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 18 Nov 2009 14:58:11 -0800 (PST) Received: from fe-amer-10.sun.com ([192.18.109.80]) by brmea-mail-2.sun.com (8.13.6+Sun/8.12.9) with ESMTP id nAIMwAXi026334 for ; Wed, 18 Nov 2009 22:58:10 +0000 (GMT) Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7u2-7.04 64bit (built Jul 2 2009)) id <0KTB00D00U8KF100@mail-amer.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 18 Nov 2009 15:58:10 -0700 (MST) Received: from [129.146.226.55] ([unknown] [129.146.226.55]) by mail-amer.sun.com (Sun Java(tm) System Messaging Server 7u2-7.04 64bit (built Jul 2 2009)) with ESMTPSA id <0KTB00ES2UGU0W70@mail-amer.sun.com>; Wed, 18 Nov 2009 15:58:07 -0700 (MST) Date: Wed, 18 Nov 2009 14:57:50 -0800 From: Rob Johnston Subject: Re: snmp-notify: SNMP Notification Daemon for Software Events [PSARC/2009/618 FastTrack timeout 11/18/2009] In-reply-to: <4B042A2A.5000805@sun.com> Sender: Robert.Johnston@sun.com To: Gary Winiger Cc: Robert Johnston , Nicolas.Williams@sun.com, Liane.Praza@sun.com, PSARC-ext@sun.com Message-id: <4B047BEE.8040405@sun.com> MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200911180332.nAI3WN94014280@sac.sfbay.sun.com> <4B042A2A.5000805@sun.com> User-Agent: Thunderbird 2.0.0.23 (X11/20091027) Status: RO Content-Length: 2566 Robert Johnston wrote: > Gary Winiger wrote: >>> Rob's sent me updated materials which reflect the clarifications due >>> to the conversation here around privileges and the removal of >>> config/debug from the manpages. >>> >>> I've put them in the case directory. >> >>> config/rootdir >>> This is an astring property that defaults to "/". >>> When set, the specified root directory will be used for >>> all pathnames evaluated by snmp-notify. >> >>> 4.11. Security Impact: >>> >>> During daemon initialization, the smtp-notify daemon will reduce its >>> privileges to the following minimal set: >>> >>> afsr# ppriv 103247 >>> 103247: /usr/lib/fm/notify/snmp-notify >>> flags = PRIV_AWARE >>> E: basic >>> I: basic >>> P: basic >>> L: basic >>> >>> The case will introduce the following new authorization for >>> management >>> of the smtp-notify service: >>> >>> solaris.smf.manage.snmp-notify >>> >>> This case also introduces the "Event Notification Agent Management" >>> profile which will include the above authorization as well as the >>> new >>> authorization being added for the smtp-notify service. >> >> Similar to 2009/619, >> Can this privilege reduction be done with a method context instead >> of by the daemon? If so, why isn't that the choice? If not, >> why not? >> >> What uid/gid does the daemon run with and why -- unless it is >> noaccess. > > Same deal as smtp-notify. We initially start as uid/gid 0 to get the > sysevent stuff going and then change our uid/gid to noaccess/noaccess. > > >> Additionally this case seems not to follow the SMF policy for >> configuring properties. See >> http://sac.eng.sun.com/cgi-bin/bp.cgi?NAME=SMF.bp >> (there is an opensolsaris.org equivalent, but that website is >> not presently responding so I can't cut a paste the url). >> See appendix D relative to value_authorization. > > > Ok - let me look through this and get back. Ah - ok - I see what you mean now. I've added the following authorizations for configuring the service properties for the two daemons, respectively: solaris.smf.value.smtp-notify solaris.smf.value.snmp-notify I've added these two authorizations to the "Event Notification Agent Management" profile (which also encapsulates the manage authorizations for these two daemons) I've also made the appropriate modifications to the service manifests. Thanks for catching that, rob From gww@sac.sfbay.sun.com Wed Nov 18 17:10:40 2009 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id nAJ1AdrH004729 for ; Wed, 18 Nov 2009 17:10:40 -0800 (PST) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id nAJ1AajK000877 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Thu, 19 Nov 2009 01:10:39 GMT Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KTC0030D0LO6S00@brm-avmta-1.central.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 18 Nov 2009 18:10:36 -0700 (MST) Received: from dm-sfbay-02.sfbay.sun.com ([129.146.11.31]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KTC009VM0LO8P90@brm-avmta-1.central.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 18 Nov 2009 18:10:36 -0700 (MST) Received: from sac.sfbay.sun.com (sac.SFBay.Sun.COM [129.146.226.132]) by dm-sfbay-02.sfbay.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.4) with ESMTP id nAJ1AZWg018801; Wed, 18 Nov 2009 17:10:35 -0800 (PST) Received: from sac.sfbay.sun.com (localhost [127.0.0.1]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id nAJ1AZDK004726; Wed, 18 Nov 2009 17:10:35 -0800 (PST) Received: (from gww@localhost) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8/Submit) id nAJ1AZE9004725; Wed, 18 Nov 2009 17:10:35 -0800 (PST) Date: Wed, 18 Nov 2009 17:10:35 -0800 (PST) From: Gary Winiger Subject: Re: snmp-notify: SNMP Notification Daemon for Software Events [PSARC/2009/618 FastTrack timeout 11/18/2009] To: Robert.Johnston@sun.com Cc: Liane.Praza@sun.com, Nicolas.Williams@sun.com, PSARC-ext@sun.com Message-id: <200911190110.nAJ1AZE9004725@sac.sfbay.sun.com> Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 Status: RO Content-Length: 1082 > >> Additionally this case seems not to follow the SMF policy for > >> configuring properties. See > >> http://sac.eng.sun.com/cgi-bin/bp.cgi?NAME=SMF.bp > >> (there is an opensolsaris.org equivalent, but that website is > >> not presently responding so I can't cut a paste the url). > >> See appendix D relative to value_authorization. > > > > > > Ok - let me look through this and get back. > > Ah - ok - I see what you mean now. I've added the following authorizations for > configuring the service properties for the two daemons, respectively: > > solaris.smf.value.smtp-notify > solaris.smf.value.snmp-notify You've answered my issues. And as commented at today's PSARC meeting, uid 0 and all privs is (unfortunately) required by the underlying channel initialization infrastructure. > I've added these two authorizations to the "Event Notification Agent Management" > profile (which also encapsulates the manage authorizations for these two daemons) > > I've also made the appropriate modifications to the service manifests. +1 Gary.. From liane.praza@Sun.COM Fri Nov 20 11:22:09 2009 Received: from sunmail3mpk.sfbay.sun.com (sunmail3mpk.SFBay.Sun.COM [129.146.11.52]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id nAKJM9HF000259 for ; Fri, 20 Nov 2009 11:22:09 -0800 (PST) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail3mpk.sfbay.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.4) with ESMTP id nAKJM8qw008561; Fri, 20 Nov 2009 11:22:08 -0800 (PST) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KTF00I079SWA300@brm-avmta-1.central.sun.com>; Fri, 20 Nov 2009 12:22:08 -0700 (MST) Received: from jurassic-x4600.sfbay.sun.com ([129.146.17.59]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KTF0012K9SVMVA0@brm-avmta-1.central.sun.com>; Fri, 20 Nov 2009 12:22:07 -0700 (MST) Received: from [129.146.228.161] (nihil.SFBay.Sun.COM [129.146.228.161]) by jurassic-x4600.sfbay.sun.com (8.14.3+Sun/8.14.3) with ESMTP id nAKJM5j8998749; Fri, 20 Nov 2009 11:22:05 -0800 (PST) Date: Fri, 20 Nov 2009 11:22:07 -0800 From: Liane Praza Subject: Re: snmp-notify: SNMP Notification Daemon for Software Events [PSARC/2009/618 FastTrack timeout 11/18/2009] In-reply-to: <200911190110.nAJ1AZE9004725@sac.sfbay.sun.com> To: PSARC-ext@Sun.COM Cc: Robert.Johnston@Sun.COM Message-id: <4B06EC5F.60609@sun.com> MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200911190110.nAJ1AZE9004725@sac.sfbay.sun.com> User-Agent: Thunderbird 2.0.0.23 (X11/20091027) Status: RO Content-Length: 134 This case was approved at this weeks meeting pending the requisite +1, which it now has. I've marked it as approved. thanks, liane