Print this page 
11621 fmadm and fmstat document privileges incorrectly
Split Close
Expand all
Collapse all
          --- old/usr/src/man/man5/privileges.5
          +++ new/usr/src/man/man5/privileges.5
   1    1  '\" te
   2    2  .\" Copyright (c) 2009, Sun Microsystems, Inc. All Rights Reserved.
   3    3  .\" Copyright 2015, Joyent, Inc. All Rights Reserved.
        4 +.\" Copyright 2019 Peter Tribble
   4    5  .\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License"). You may not use this file except in compliance with the License. You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing.
   5    6  .\"  See the License for the specific language governing permissions and limitations under the License. When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE. If applicable, add the following below this CDDL HEADER, with
   6    7  .\" the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
   7      -.TH PRIVILEGES 5 "Feb 28, 2018"
        8 +.TH PRIVILEGES 5 "Aug 26, 2019"
   8    9  .SH NAME
   9   10  privileges \- process privilege model
  10   11  .SH DESCRIPTION
  11      -.LP
  12      -Solaris software implements a set of privileges that provide fine-grained
       12 +In illumos, software implements a set of privileges that provide fine-grained
  13   13  control over the actions of processes. The possession of a certain privilege
  14   14  allows a process to perform a specific set of restricted operations.
  15   15  .sp
  16   16  .LP
  17      -The change to a primarily privilege-based security model in the Solaris
       17 +The change to a primarily privilege-based security model in the
  18   18  operating system gives developers an opportunity to restrict processes to those
  19   19  privileged operations actually needed instead of all (super-user) or no
  20   20  privileges (non-zero UIDs). Additionally, a set of previously unrestricted
  21   21  operations now requires a privilege; these privileges are dubbed the "basic"
  22   22  privileges and are by default given to all processes.
  23   23  .sp
  24   24  .LP
  25   25  Taken together, all defined privileges with the exception of the "basic"
  26   26  privileges compose the set of privileges that are traditionally associated with
  27   27  the root user. The "basic" privileges are "privileges" unprivileged processes
↓ open down ↓ 606 lines elided ↑ open up ↑ 
 634  634  .RE
 635  635  
 636  636  .sp
 637  637  .ne 2
 638  638  .na
 639  639  \fB\fBPRIV_SYS_ADMIN\fR\fR
 640  640  .ad
 641  641  .sp .6
 642  642  .RS 4n
 643  643  Allow a process to perform system administration tasks such as setting node and
 644      -domain name and specifying \fBcoreadm\fR(1M) and \fBnscd\fR(1M) settings
      644 +domain name and managing \fBfmd\fR(1M) and \fBnscd\fR(1M).
 645  645  .RE
 646  646  
 647  647  .sp
 648  648  .ne 2
 649  649  .na
 650  650  \fB\fBPRIV_SYS_AUDIT\fR\fR
 651  651  .ad
 652  652  .sp .6
 653  653  .RS 4n
 654  654  Allow a process to start the (kernel) audit daemon. Allow a process to view and
↓ open down ↓ 183 lines elided ↑ open up ↑ 
 838  838  .sp
 839  839  .ne 2
 840  840  .na
 841  841  \fB\fBPRIV_SYS_SUSER_COMPAT\fR\fR
 842  842  .ad
 843  843  .sp .6
 844  844  .RS 4n
 845  845  Allow a process to successfully call a third party loadable module that calls
 846  846  the kernel \fBsuser()\fR function to check for allowed access. This privilege
 847  847  exists only for third party loadable module compatibility and is not used by
 848      -Solaris proper.
      848 +illumos.
 849  849  .RE
 850  850  
 851  851  .sp
 852  852  .ne 2
 853  853  .na
 854  854  \fB\fBPRIV_SYS_TIME\fR\fR
 855  855  .ad
 856  856  .sp .6
 857  857  .RS 4n
 858  858  Allow a process to manipulate system time using any of the appropriate system
↓ open down ↓ 230 lines elided ↑ open up ↑ 
1089 1089  \fBPRIV_PROC_EXEC\fR are considered "basic" privileges. These are privileges
1090 1090  that used to be always available to unprivileged processes. By default,
1091 1091  processes still have the basic privileges.
1092 1092  .sp
1093 1093  .LP
1094 1094  The privileges \fBPRIV_PROC_SETID\fR and \fBPRIV_PROC_AUDIT\fR must be present
1095 1095  in the Limit set (see below) of a process in order for set-uid root \fBexec\fRs
1096 1096  to be successful, that is, get an effective UID of 0 and additional privileges.
1097 1097  .sp
1098 1098  .LP
1099      -The privilege implementation in Solaris extends the process credential with
     1099 +The privilege implementation in illumos extends the process credential with
1100 1100  four privilege sets:
1101 1101  .sp
1102 1102  .ne 2
1103 1103  .na
1104 1104  \fBI, the inheritable set\fR
1105 1105  .ad
1106 1106  .RS 26n
1107 1107  The privileges inherited on \fBexec\fR.
1108 1108  .RE
1109 1109
↓ open down ↓ 142 lines elided ↑ open up ↑ 
1252 1252  .LP
1253 1253  For most privileges, absence of the privilege simply results in a failure. In
1254 1254  some instances, the absence of a privilege can cause system calls to behave
1255 1255  differently. In other instances, the removal of a privilege can force a set-uid
1256 1256  application to seriously malfunction. Privileges of this type are considered
1257 1257  "unsafe". When a process is lacking any of the unsafe privileges from its limit
1258 1258  set, the system does not honor the set-uid bit of set-uid root applications.
1259 1259  The following unsafe privileges have been identified: \fBproc_setid\fR,
1260 1260  \fBsys_resource\fR and \fBproc_audit\fR.
1261 1261  .SS "Privilege Escalation"
1262      -.LP
1263 1262  In certain circumstances, a single privilege could lead to a process gaining
1264 1263  one or more additional privileges that were not explicitly granted to that
1265 1264  process. To prevent such an escalation of privileges, the security policy
1266 1265  requires explicit permission for those additional privileges.
1267 1266  .sp
1268 1267  .LP
1269 1268  Common examples of escalation are those mechanisms that allow modification of
1270      -system resources through "raw'' interfaces; for example, changing kernel data
     1269 +system resources through "raw" interfaces; for example, changing kernel data
1271 1270  structures through \fB/dev/kmem\fR or changing files through \fB/dev/dsk/*\fR.
1272 1271  Escalation also occurs when a process controls processes with more privileges
1273 1272  than the controlling process. A special case of this is manipulating or
1274 1273  creating objects owned by UID 0 or trying to obtain UID 0 using
1275 1274  \fBsetuid\fR(2). The special treatment of UID 0 is needed because the UID 0
1276 1275  owns all system configuration files and ordinary file protection mechanisms
1277 1276  allow processes with UID 0 to modify the system configuration. With appropriate
1278 1277  file modifications, a given process running with an effective UID of 0 can gain
1279 1278  all privileges.
1280 1279  .sp
1281 1280  .LP
1282 1281  In situations where a process might obtain UID 0, the security policy requires
1283 1282  additional privileges, up to the full set of privileges. Such restrictions
1284 1283  could be relaxed or removed at such time as additional mechanisms for
1285 1284  protection of system files became available. There are no such mechanisms in
1286      -the current Solaris release.
     1285 +the current release.
1287 1286  .sp
1288 1287  .LP
1289 1288  The use of UID 0 processes should be limited as much as possible. They should
1290 1289  be replaced with programs running under a different UID but with exactly the
1291 1290  privileges they need.
1292 1291  .sp
1293 1292  .LP
1294 1293  Daemons that never need to \fBexec\fR subprocesses should remove the
1295 1294  \fBPRIV_PROC_EXEC\fR privilege from their permitted and limit sets.
1296 1295  .SS "Assigned Privileges and Safeguards"
1297      -.LP
1298 1296  When privileges are assigned to a user, the system administrator could give
1299 1297  that user more powers than intended. The administrator should consider whether
1300 1298  safeguards are needed. For example, if the \fBPRIV_PROC_LOCK_MEMORY\fR
1301 1299  privilege is given to a user, the administrator should consider setting the
1302 1300  \fBproject.max-locked-memory\fR resource control as well, to prevent that user
1303 1301  from locking all memory.
1304 1302  .SS "Privilege Debugging"
1305      -.LP
1306 1303  When a system call fails with a permission error, it is not always immediately
1307 1304  obvious what caused the problem. To debug such a problem, you can use a tool
1308 1305  called \fBprivilege debugging\fR. When privilege debugging is enabled for a
1309 1306  process, the kernel reports missing privileges on the controlling terminal of
1310 1307  the process. (Enable debugging for a process with the \fB-D\fR option of
1311 1308  \fBppriv\fR(1).) Additionally, the administrator can enable system-wide
1312 1309  privilege debugging by setting the \fBsystem\fR(4) variable \fBpriv_debug\fR
1313 1310  using:
1314 1311  .sp
1315 1312  .in +2
1316 1313  .nf
1317 1314  set priv_debug = 1
1318 1315  .fi
1319 1316  .in -2
1320 1317  
1321 1318  .sp
1322 1319  .LP
1323 1320  On a running system, you can use \fBmdb\fR(1) to change this variable.
1324 1321  .SS "Privilege Administration"
1325      -.LP
1326 1322  Use \fBusermod\fR(1M) or \fBrolemod\fR(1M)
1327 1323  to assign privileges to or modify privileges for, respectively, a user or a
1328 1324  role. Use \fBppriv\fR(1) to enumerate the privileges supported on a system and
1329 1325  \fBtruss\fR(1) to determine which privileges a program requires.
1330 1326  .SH SEE ALSO
1331      -.LP
1332 1327  \fBmdb\fR(1), \fBppriv\fR(1), \fBadd_drv\fR(1M), \fBifconfig\fR(1M),
1333 1328  \fBlockd\fR(1M), \fBnfsd\fR(1M), \fBpppd\fR(1M), \fBrem_drv\fR(1M),
1334 1329  \fBsmbd\fR(1M), \fBsppptun\fR(1M), \fBupdate_drv\fR(1M), \fBIntro\fR(2),
1335 1330  \fBaccess\fR(2), \fBacct\fR(2), \fBacl\fR(2), \fBadjtime\fR(2), \fBaudit\fR(2),
1336 1331  \fBauditon\fR(2), \fBchmod\fR(2), \fBchown\fR(2), \fBchroot\fR(2),
1337 1332  \fBcreat\fR(2), \fBexec\fR(2), \fBfcntl\fR(2), \fBfork\fR(2),
1338 1333  \fBfpathconf\fR(2), \fBgetacct\fR(2), \fBgetpflags\fR(2), \fBgetppriv\fR(2),
1339 1334  \fBgetsid\fR(2), \fBkill\fR(2), \fBlink\fR(2), \fBmemcntl\fR(2),
1340 1335  \fBmknod\fR(2), \fBmount\fR(2), \fBmsgctl\fR(2), \fBnice\fR(2),
1341 1336  \fBntp_adjtime\fR(2), \fBopen\fR(2), \fBp_online\fR(2), \fBpriocntl\fR(2),
↓ open down ↓ 20 lines elided ↑ open up ↑ 
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX