Print this page
uts: Allow for address space randomisation.
Randomise the base addresses of shared objects, non-fixed mappings, the
stack and the heap. Introduce a service, svc:/system/process-security,
and a tool psecflags(1) to control and observe it
| Split |
Close |
| Expand all |
| Collapse all |
--- old/usr/src/man/man5/privileges.5
+++ new/usr/src/man/man5/privileges.5
1 1 '\" te
2 2 .\" Copyright (c) 2009, Sun Microsystems, Inc. All Rights Reserved.
3 3 .\" Copyright 2013, Joyent, Inc. All Rights Reserved.
4 4 .\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License"). You may not use this file except in compliance with the License. You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing.
5 5 .\" See the License for the specific language governing permissions and limitations under the License. When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE. If applicable, add the following below this CDDL HEADER, with
6 6 .\" the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
7 7 .TH PRIVILEGES 5 "Feb 3, 2015"
8 8 .SH NAME
9 9 privileges \- process privilege model
10 10 .SH DESCRIPTION
11 11 .LP
12 12 Solaris software implements a set of privileges that provide fine-grained
13 13 control over the actions of processes. The possession of a certain privilege
14 14 allows a process to perform a specific set of restricted operations.
15 15 .sp
16 16 .LP
17 17 The change to a primarily privilege-based security model in the Solaris
18 18 operating system gives developers an opportunity to restrict processes to those
19 19 privileged operations actually needed instead of all (super-user) or no
20 20 privileges (non-zero UIDs). Additionally, a set of previously unrestricted
21 21 operations now requires a privilege; these privileges are dubbed the "basic"
22 22 privileges and are by default given to all processes.
23 23 .sp
24 24 .LP
25 25 Taken together, all defined privileges with the exception of the "basic"
26 26 privileges compose the set of privileges that are traditionally associated with
27 27 the root user. The "basic" privileges are "privileges" unprivileged processes
28 28 were accustomed to having.
29 29 .sp
30 30 .LP
31 31 The defined privileges are:
32 32 .sp
33 33 .ne 2
34 34 .na
35 35 \fB\fBPRIV_CONTRACT_EVENT\fR\fR
36 36 .ad
37 37 .sp .6
38 38 .RS 4n
39 39 Allow a process to request reliable delivery of events to an event endpoint.
40 40 .sp
41 41 Allow a process to include events in the critical event set term of a template
42 42 which could be generated in volume by the user.
43 43 .RE
44 44
45 45 .sp
46 46 .ne 2
47 47 .na
48 48 \fB\fBPRIV_CONTRACT_IDENTITY\fR\fR
49 49 .ad
50 50 .sp .6
51 51 .RS 4n
52 52 Allows a process to set the service FMRI value of a process contract template.
53 53 .RE
54 54
55 55 .sp
56 56 .ne 2
57 57 .na
58 58 \fB\fBPRIV_CONTRACT_OBSERVER\fR\fR
59 59 .ad
60 60 .sp .6
61 61 .RS 4n
62 62 Allow a process to observe contract events generated by contracts created and
63 63 owned by users other than the process's effective user ID.
64 64 .sp
65 65 Allow a process to open contract event endpoints belonging to contracts created
66 66 and owned by users other than the process's effective user ID.
67 67 .RE
68 68
69 69 .sp
70 70 .ne 2
71 71 .na
72 72 \fB\fBPRIV_CPC_CPU\fR\fR
73 73 .ad
74 74 .sp .6
75 75 .RS 4n
76 76 Allow a process to access per-CPU hardware performance counters.
77 77 .RE
78 78
79 79 .sp
80 80 .ne 2
81 81 .na
82 82 \fB\fBPRIV_DTRACE_KERNEL\fR\fR
83 83 .ad
84 84 .sp .6
85 85 .RS 4n
86 86 Allow DTrace kernel-level tracing.
87 87 .RE
88 88
89 89 .sp
90 90 .ne 2
91 91 .na
92 92 \fB\fBPRIV_DTRACE_PROC\fR\fR
93 93 .ad
94 94 .sp .6
95 95 .RS 4n
96 96 Allow DTrace process-level tracing. Allow process-level tracing probes to be
97 97 placed and enabled in processes to which the user has permissions.
98 98 .RE
99 99
100 100 .sp
101 101 .ne 2
102 102 .na
103 103 \fB\fBPRIV_DTRACE_USER\fR\fR
104 104 .ad
105 105 .sp .6
106 106 .RS 4n
107 107 Allow DTrace user-level tracing. Allow use of the syscall and profile DTrace
108 108 providers to examine processes to which the user has permissions.
109 109 .RE
110 110
111 111 .sp
112 112 .ne 2
113 113 .na
114 114 \fB\fBPRIV_FILE_CHOWN\fR\fR
115 115 .ad
116 116 .sp .6
117 117 .RS 4n
118 118 Allow a process to change a file's owner user ID. Allow a process to change a
119 119 file's group ID to one other than the process's effective group ID or one of
120 120 the process's supplemental group IDs.
121 121 .RE
122 122
123 123 .sp
124 124 .ne 2
125 125 .na
126 126 \fB\fBPRIV_FILE_CHOWN_SELF\fR\fR
127 127 .ad
128 128 .sp .6
129 129 .RS 4n
130 130 Allow a process to give away its files. A process with this privilege runs as
131 131 if {\fB_POSIX_CHOWN_RESTRICTED\fR} is not in effect.
132 132 .RE
133 133
134 134 .sp
135 135 .ne 2
136 136 .na
137 137 \fB\fBPRIV_FILE_DAC_EXECUTE\fR\fR
138 138 .ad
139 139 .sp .6
140 140 .RS 4n
141 141 Allow a process to execute an executable file whose permission bits or ACL
142 142 would otherwise disallow the process execute permission.
143 143 .RE
144 144
145 145 .sp
146 146 .ne 2
147 147 .na
148 148 \fB\fBPRIV_FILE_DAC_READ\fR\fR
149 149 .ad
150 150 .sp .6
151 151 .RS 4n
152 152 Allow a process to read a file or directory whose permission bits or ACL would
153 153 otherwise disallow the process read permission.
154 154 .RE
155 155
156 156 .sp
157 157 .ne 2
158 158 .na
159 159 \fB\fBPRIV_FILE_DAC_SEARCH\fR\fR
160 160 .ad
161 161 .sp .6
162 162 .RS 4n
163 163 Allow a process to search a directory whose permission bits or ACL would not
164 164 otherwise allow the process search permission.
165 165 .RE
166 166
167 167 .sp
168 168 .ne 2
169 169 .na
170 170 \fB\fBPRIV_FILE_DAC_WRITE\fR\fR
171 171 .ad
172 172 .sp .6
173 173 .RS 4n
174 174 Allow a process to write a file or directory whose permission bits or ACL do
175 175 not allow the process write permission. All privileges are required to write
176 176 files owned by UID 0 in the absence of an effective UID of 0.
177 177 .RE
178 178
179 179 .sp
180 180 .ne 2
181 181 .na
182 182 \fB\fBPRIV_FILE_DOWNGRADE_SL\fR\fR
183 183 .ad
184 184 .sp .6
185 185 .RS 4n
186 186 Allow a process to set the sensitivity label of a file or directory to a
187 187 sensitivity label that does not dominate the existing sensitivity label.
188 188 .sp
189 189 This privilege is interpreted only if the system is configured with Trusted
190 190 Extensions.
191 191 .RE
192 192
193 193 .sp
194 194 .ne 2
195 195 .na
196 196 \fB\fBPRIV_FILE_FLAG_SET\fR\fR
197 197 .ad
198 198 .sp .6
199 199 .RS 4n
200 200 Allows a process to set immutable, nounlink or appendonly file attributes.
201 201 .RE
202 202
203 203 .sp
204 204 .ne 2
205 205 .na
206 206 \fB\fBPRIV_FILE_LINK_ANY\fR\fR
207 207 .ad
208 208 .sp .6
209 209 .RS 4n
210 210 Allow a process to create hardlinks to files owned by a UID different from the
211 211 process's effective UID.
212 212 .RE
213 213
214 214 .sp
215 215 .ne 2
216 216 .na
217 217 \fB\fBPRIV_FILE_OWNER\fR\fR
218 218 .ad
219 219 .sp .6
220 220 .RS 4n
221 221 Allow a process that is not the owner of a file to modify that file's access
222 222 and modification times. Allow a process that is not the owner of a directory to
223 223 modify that directory's access and modification times. Allow a process that is
224 224 not the owner of a file or directory to remove or rename a file or directory
225 225 whose parent directory has the "save text image after execution" (sticky) bit
226 226 set. Allow a process that is not the owner of a file to mount a \fBnamefs\fR
227 227 upon that file. Allow a process that is not the owner of a file or directory to
228 228 modify that file's or directory's permission bits or ACL.
229 229 .RE
230 230
231 231 .sp
232 232 .ne 2
233 233 .na
234 234 \fB\fBPRIV_FILE_READ\fR\fR
235 235 .ad
236 236 .sp .6
237 237 .RS 4n
238 238 Allow a process to read objects in the filesystem.
239 239 .RE
240 240
241 241 .sp
242 242 .ne 2
243 243 .na
244 244 \fB\fBPRIV_FILE_SETID\fR\fR
245 245 .ad
246 246 .sp .6
247 247 .RS 4n
248 248 Allow a process to change the ownership of a file or write to a file without
249 249 the set-user-ID and set-group-ID bits being cleared. Allow a process to set the
250 250 set-group-ID bit on a file or directory whose group is not the process's
251 251 effective group or one of the process's supplemental groups. Allow a process to
252 252 set the set-user-ID bit on a file with different ownership in the presence of
253 253 \fBPRIV_FILE_OWNER\fR. Additional restrictions apply when creating or modifying
254 254 a setuid 0 file.
255 255 .RE
256 256
257 257 .sp
258 258 .ne 2
259 259 .na
260 260 \fB\fBPRIV_FILE_UPGRADE_SL\fR\fR
261 261 .ad
262 262 .sp .6
263 263 .RS 4n
264 264 Allow a process to set the sensitivity label of a file or directory to a
265 265 sensitivity label that dominates the existing sensitivity label.
266 266 .sp
267 267 This privilege is interpreted only if the system is configured with Trusted
268 268 Extensions.
269 269 .RE
270 270
271 271 .sp
272 272 .ne 2
273 273 .na
274 274 \fB\fBPRIV_FILE_WRITE\fR\fR
275 275 .ad
276 276 .sp .6
277 277 .RS 4n
278 278 Allow a process to modify objects in the filesytem.
279 279 .RE
280 280
281 281 .sp
282 282 .ne 2
283 283 .na
284 284 \fB\fBPRIV_GRAPHICS_ACCESS\fR\fR
285 285 .ad
286 286 .sp .6
287 287 .RS 4n
288 288 Allow a process to make privileged ioctls to graphics devices. Typically only
289 289 an xserver process needs to have this privilege. A process with this privilege
290 290 is also allowed to perform privileged graphics device mappings.
291 291 .RE
292 292
293 293 .sp
294 294 .ne 2
295 295 .na
296 296 \fB\fBPRIV_GRAPHICS_MAP\fR\fR
297 297 .ad
298 298 .sp .6
299 299 .RS 4n
300 300 Allow a process to perform privileged mappings through a graphics device.
301 301 .RE
302 302
303 303 .sp
304 304 .ne 2
305 305 .na
306 306 \fB\fBPRIV_IPC_DAC_READ\fR\fR
307 307 .ad
308 308 .sp .6
309 309 .RS 4n
310 310 Allow a process to read a System V IPC Message Queue, Semaphore Set, or Shared
311 311 Memory Segment whose permission bits would not otherwise allow the process read
312 312 permission.
313 313 .RE
314 314
315 315 .sp
316 316 .ne 2
317 317 .na
318 318 \fB\fBPRIV_IPC_DAC_WRITE\fR\fR
319 319 .ad
320 320 .sp .6
321 321 .RS 4n
322 322 Allow a process to write a System V IPC Message Queue, Semaphore Set, or Shared
323 323 Memory Segment whose permission bits would not otherwise allow the process
324 324 write permission.
325 325 .RE
326 326
327 327 .sp
328 328 .ne 2
329 329 .na
330 330 \fB\fBPRIV_IPC_OWNER\fR\fR
331 331 .ad
332 332 .sp .6
333 333 .RS 4n
334 334 Allow a process that is not the owner of a System V IPC Message Queue,
335 335 Semaphore Set, or Shared Memory Segment to remove, change ownership of, or
336 336 change permission bits of the Message Queue, Semaphore Set, or Shared Memory
337 337 Segment.
338 338 .RE
339 339
340 340 .sp
341 341 .ne 2
342 342 .na
343 343 \fB\fBPRIV_NET_ACCESS\fR\fR
344 344 .ad
345 345 .sp .6
346 346 .RS 4n
347 347 Allow a process to open a TCP, UDP, SDP, or SCTP network endpoint.
348 348 .RE
349 349
350 350 .sp
351 351 .ne 2
352 352 .na
353 353 \fB\fBPRIV_NET_BINDMLP\fR\fR
354 354 .ad
355 355 .sp .6
356 356 .RS 4n
357 357 Allow a process to bind to a port that is configured as a multi-level port
358 358 (MLP) for the process's zone. This privilege applies to both shared address and
359 359 zone-specific address MLPs. See \fBtnzonecfg\fR(\fB4\fR) from the Trusted
360 360 Extensions manual pages for information on configuring MLP ports.
361 361 .sp
362 362 This privilege is interpreted only if the system is configured with Trusted
363 363 Extensions.
364 364 .RE
365 365
366 366 .sp
367 367 .ne 2
368 368 .na
369 369 \fB\fBPRIV_NET_ICMPACCESS\fR\fR
370 370 .ad
371 371 .sp .6
372 372 .RS 4n
373 373 Allow a process to send and receive ICMP packets.
374 374 .RE
375 375
376 376 .sp
377 377 .ne 2
378 378 .na
379 379 \fB\fBPRIV_NET_MAC_AWARE\fR\fR
380 380 .ad
381 381 .sp .6
382 382 .RS 4n
383 383 Allow a process to set the \fBNET_MAC_AWARE\fR process flag by using
384 384 \fBsetpflags\fR(2). This privilege also allows a process to set the
385 385 \fBSO_MAC_EXEMPT\fR socket option by using \fBsetsockopt\fR(3SOCKET). The
386 386 \fBNET_MAC_AWARE\fR process flag and the \fBSO_MAC_EXEMPT\fR socket option both
387 387 allow a local process to communicate with an unlabeled peer if the local
388 388 process's label dominates the peer's default label, or if the local process
389 389 runs in the global zone.
390 390 .sp
391 391 This privilege is interpreted only if the system is configured with Trusted
392 392 Extensions.
393 393 .RE
394 394
395 395 .sp
396 396 .ne 2
397 397 .na
398 398 \fB\fBPRIV_NET_MAC_IMPLICIT\fR\fR
399 399 .ad
400 400 .sp .6
401 401 .RS 4n
402 402 Allow a proces to set \fBSO_MAC_IMPLICIT\fR option by using
403 403 \fBsetsockopt\fR(3SOCKET). This allows a privileged process to transmit
404 404 implicitly-labeled packets to a peer.
405 405 .sp
406 406 This privilege is interpreted only if the system is configured with
407 407 Trusted Extensions.
408 408 .RE
409 409
410 410 .sp
411 411 .ne 2
412 412 .na
413 413 \fB\fBPRIV_NET_OBSERVABILITY\fR\fR
414 414 .ad
415 415 .sp .6
416 416 .RS 4n
417 417 Allow a process to open a device for just receiving network traffic, sending
418 418 traffic is disallowed.
419 419 .RE
420 420
421 421 .sp
422 422 .ne 2
423 423 .na
424 424 \fB\fBPRIV_NET_PRIVADDR\fR\fR
425 425 .ad
426 426 .sp .6
427 427 .RS 4n
428 428 Allow a process to bind to a privileged port number. The privilege port numbers
429 429 are 1-1023 (the traditional UNIX privileged ports) as well as those ports
430 430 marked as "\fBudp/tcp_extra_priv_ports\fR" with the exception of the ports
431 431 reserved for use by NFS and SMB.
432 432 .RE
433 433
434 434 .sp
435 435 .ne 2
436 436 .na
437 437 \fB\fBPRIV_NET_RAWACCESS\fR\fR
438 438 .ad
439 439 .sp .6
440 440 .RS 4n
441 441 Allow a process to have direct access to the network layer.
442 442 .RE
443 443
444 444 .sp
445 445 .ne 2
446 446 .na
447 447 \fB\fBPRIV_PROC_AUDIT\fR\fR
448 448 .ad
449 449 .sp .6
450 450 .RS 4n
451 451 Allow a process to generate audit records. Allow a process to get its own audit
452 452 pre-selection information.
453 453 .RE
454 454
455 455 .sp
456 456 .ne 2
457 457 .na
458 458 \fB\fBPRIV_PROC_CHROOT\fR\fR
459 459 .ad
460 460 .sp .6
461 461 .RS 4n
462 462 Allow a process to change its root directory.
463 463 .RE
464 464
465 465 .sp
466 466 .ne 2
467 467 .na
468 468 \fB\fBPRIV_PROC_CLOCK_HIGHRES\fR\fR
469 469 .ad
470 470 .sp .6
471 471 .RS 4n
472 472 Allow a process to use high resolution timers.
473 473 .RE
474 474
475 475 .sp
476 476 .ne 2
477 477 .na
478 478 \fB\fBPRIV_PROC_EXEC\fR\fR
479 479 .ad
480 480 .sp .6
481 481 .RS 4n
482 482 Allow a process to call \fBexec\fR(2).
483 483 .RE
484 484
485 485 .sp
486 486 .ne 2
487 487 .na
488 488 \fB\fBPRIV_PROC_FORK\fR\fR
489 489 .ad
490 490 .sp .6
491 491 .RS 4n
492 492 Allow a process to call \fBfork\fR(2), \fBfork1\fR(2), or \fBvfork\fR(2).
493 493 .RE
494 494
495 495 .sp
496 496 .ne 2
497 497 .na
498 498 \fB\fBPRIV_PROC_INFO\fR\fR
499 499 .ad
500 500 .sp .6
501 501 .RS 4n
502 502 Allow a process to examine the status of processes other than those to which it
503 503 can send signals. Processes that cannot be examined cannot be seen in
504 504 \fB/proc\fR and appear not to exist.
505 505 .RE
506 506
507 507 .sp
508 508 .ne 2
509 509 .na
510 510 \fB\fBPRIV_PROC_LOCK_MEMORY\fR\fR
511 511 .ad
512 512 .sp .6
513 513 .RS 4n
514 514 Allow a process to lock pages in physical memory.
515 515 .RE
516 516
517 517 .sp
518 518 .ne 2
519 519 .na
520 520 \fB\fBPRIV_PROC_OWNER\fR\fR
521 521 .ad
522 522 .sp .6
523 523 .RS 4n
524 524 Allow a process to send signals to other processes and inspect and modify the
525 525 process state in other processes, regardless of ownership. When modifying
526 526 another process, additional restrictions apply: the effective privilege set of
527 527 the attaching process must be a superset of the target process's effective,
528 528 permitted, and inheritable sets; the limit set must be a superset of the
529 529 target's limit set; if the target process has any UID set to 0 all privilege
530 530 must be asserted unless the effective UID is 0. Allow a process to bind
531 531 arbitrary processes to CPUs.
532 532 .RE
533 533
534 534 .sp
535 535 .ne 2
536 536 .na
537 537 \fB\fBPRIV_PROC_PRIOUP\fR\fR
538 538 .ad
539 539 .sp .6
540 540 .RS 4n
541 541 Allow a process to elevate its priority above its current level.
542 542 .RE
543 543
544 544 .sp
545 545 .ne 2
546 546 .na
547 547 \fB\fBPRIV_PROC_PRIOCNTL\fR\fR
548 548 .ad
|
↓ open down ↓ |
548 lines elided |
↑ open up ↑ |
549 549 .sp .6
550 550 .RS 4n
551 551 Allows all that PRIV_PROC_PRIOUP allows.
552 552 Allow a process to change its scheduling class to any scheduling class,
553 553 including the RT class.
554 554 .RE
555 555
556 556 .sp
557 557 .ne 2
558 558 .na
559 +\fB\PRIV_PROC_SECFLAGS\fR
560 +.ad
561 +.sp .6
562 +.RS 4n
563 +Allow a process to manipulate the secflags of processes (subject to,
564 +additionally, the ability to signal that process)
565 +.RE
566 +
567 +.sp
568 +.ne 2
569 +.na
559 570 \fB\fBPRIV_PROC_SESSION\fR\fR
560 571 .ad
561 572 .sp .6
562 573 .RS 4n
563 574 Allow a process to send signals or trace processes outside its session.
564 575 .RE
565 576
566 577 .sp
567 578 .ne 2
568 579 .na
569 580 \fB\fBPRIV_PROC_SETID\fR\fR
570 581 .ad
571 582 .sp .6
572 583 .RS 4n
573 584 Allow a process to set its UIDs at will, assuming UID 0 requires all privileges
574 585 to be asserted.
575 586 .RE
576 587
577 588 .sp
578 589 .ne 2
579 590 .na
580 591 \fB\fBPRIV_PROC_TASKID\fR\fR
581 592 .ad
582 593 .sp .6
583 594 .RS 4n
584 595 Allow a process to assign a new task ID to the calling process.
585 596 .RE
586 597
587 598 .sp
588 599 .ne 2
589 600 .na
590 601 \fB\fBPRIV_PROC_ZONE\fR\fR
591 602 .ad
592 603 .sp .6
593 604 .RS 4n
594 605 Allow a process to trace or send signals to processes in other zones. See
595 606 \fBzones\fR(5).
596 607 .RE
597 608
598 609 .sp
599 610 .ne 2
600 611 .na
601 612 \fB\fBPRIV_SYS_ACCT\fR\fR
602 613 .ad
603 614 .sp .6
604 615 .RS 4n
605 616 Allow a process to enable and disable and manage accounting through
606 617 \fBacct\fR(2).
607 618 .RE
608 619
609 620 .sp
610 621 .ne 2
611 622 .na
612 623 \fB\fBPRIV_SYS_ADMIN\fR\fR
613 624 .ad
614 625 .sp .6
615 626 .RS 4n
616 627 Allow a process to perform system administration tasks such as setting node and
617 628 domain name and specifying \fBcoreadm\fR(1M) and \fBnscd\fR(1M) settings
618 629 .RE
619 630
620 631 .sp
621 632 .ne 2
622 633 .na
623 634 \fB\fBPRIV_SYS_AUDIT\fR\fR
624 635 .ad
625 636 .sp .6
626 637 .RS 4n
627 638 Allow a process to start the (kernel) audit daemon. Allow a process to view and
628 639 set audit state (audit user ID, audit terminal ID, audit sessions ID, audit
629 640 pre-selection mask). Allow a process to turn off and on auditing. Allow a
630 641 process to configure the audit parameters (cache and queue sizes, event to
631 642 class mappings, and policy options).
632 643 .RE
633 644
634 645 .sp
635 646 .ne 2
636 647 .na
637 648 \fB\fBPRIV_SYS_CONFIG\fR\fR
638 649 .ad
639 650 .sp .6
640 651 .RS 4n
641 652 Allow a process to perform various system configuration tasks. Allow
642 653 filesystem-specific administrative procedures, such as filesystem configuration
643 654 ioctls, quota calls, creation and deletion of snapshots, and manipulating the
644 655 PCFS bootsector.
645 656 .RE
646 657
647 658 .sp
648 659 .ne 2
649 660 .na
650 661 \fB\fBPRIV_SYS_DEVICES\fR\fR
651 662 .ad
652 663 .sp .6
653 664 .RS 4n
654 665 Allow a process to create device special files. Allow a process to successfully
655 666 call a kernel module that calls the kernel \fBdrv_priv\fR(9F) function to check
656 667 for allowed access. Allow a process to open the real console device directly.
657 668 Allow a process to open devices that have been exclusively opened.
658 669 .RE
659 670
660 671 .sp
661 672 .ne 2
662 673 .na
663 674 \fB\fBPRIV_SYS_DL_CONFIG\fR\fR
664 675 .ad
665 676 .sp .6
666 677 .RS 4n
667 678 Allow a process to configure a system's datalink interfaces.
668 679 .RE
669 680
670 681 .sp
671 682 .ne 2
672 683 .na
673 684 \fB\fBPRIV_SYS_IP_CONFIG\fR\fR
674 685 .ad
675 686 .sp .6
676 687 .RS 4n
677 688 Allow a process to configure a system's IP interfaces and routes. Allow a
678 689 process to configure network parameters for \fBTCP/IP\fR using \fBndd\fR. Allow
679 690 a process access to otherwise restricted \fBTCP/IP\fR information using
680 691 \fBndd\fR. Allow a process to configure \fBIPsec\fR. Allow a process to pop
681 692 anchored \fBSTREAM\fRs modules with matching \fBzoneid\fR.
682 693 .RE
683 694
684 695 .sp
685 696 .ne 2
686 697 .na
687 698 \fB\fBPRIV_SYS_IPC_CONFIG\fR\fR
688 699 .ad
689 700 .sp .6
690 701 .RS 4n
691 702 Allow a process to increase the size of a System V IPC Message Queue buffer.
692 703 .RE
693 704
694 705 .sp
695 706 .ne 2
696 707 .na
697 708 \fB\fBPRIV_SYS_IPTUN_CONFIG\fR\fR
698 709 .ad
699 710 .sp .6
700 711 .RS 4n
701 712 Allow a process to configure IP tunnel links.
702 713 .RE
703 714
704 715 .sp
705 716 .ne 2
706 717 .na
707 718 \fB\fBPRIV_SYS_LINKDIR\fR\fR
708 719 .ad
709 720 .sp .6
710 721 .RS 4n
711 722 Allow a process to unlink and link directories.
712 723 .RE
713 724
714 725 .sp
715 726 .ne 2
716 727 .na
717 728 \fB\fBPRIV_SYS_MOUNT\fR\fR
718 729 .ad
719 730 .sp .6
720 731 .RS 4n
721 732 Allow a process to mount and unmount filesystems that would otherwise be
722 733 restricted (that is, most filesystems except \fBnamefs\fR). Allow a process to
723 734 add and remove swap devices.
724 735 .RE
725 736
726 737 .sp
727 738 .ne 2
728 739 .na
729 740 \fB\fBPRIV_SYS_NET_CONFIG\fR\fR
730 741 .ad
731 742 .sp .6
732 743 .RS 4n
733 744 Allow a process to do all that \fBPRIV_SYS_IP_CONFIG\fR,
734 745 \fBPRIV_SYS_DL_CONFIG\fR, and \fBPRIV_SYS_PPP_CONFIG\fR allow, plus the
735 746 following: use the \fBrpcmod\fR STREAMS module and insert/remove STREAMS
736 747 modules on locations other than the top of the module stack.
737 748 .RE
738 749
739 750 .sp
740 751 .ne 2
741 752 .na
742 753 \fB\fBPRIV_SYS_NFS\fR\fR
743 754 .ad
744 755 .sp .6
745 756 .RS 4n
746 757 Allow a process to provide NFS service: start NFS kernel threads, perform NFS
747 758 locking operations, bind to NFS reserved ports: ports 2049 (\fBnfs\fR) and port
748 759 4045 (\fBlockd\fR).
749 760 .RE
750 761
751 762 .sp
752 763 .ne 2
753 764 .na
754 765 \fB\fBPRIV_SYS_PPP_CONFIG\fR\fR
755 766 .ad
756 767 .sp .6
757 768 .RS 4n
758 769 Allow a process to create, configure, and destroy PPP instances with pppd(1M)
759 770 \fBpppd\fR(1M) and control PPPoE plumbing with \fBsppptun\fR(1M)sppptun(1M).
760 771 This privilege is granted by default to exclusive IP stack instance zones.
761 772 .RE
762 773
763 774 .sp
764 775 .ne 2
765 776 .na
766 777 \fB\fBPRIV_SYS_RES_BIND\fR\fR
767 778 .ad
768 779 .sp .6
769 780 .RS 4n
770 781 Allows a process to bind processes to processor sets.
771 782 .RE
772 783
773 784 .sp
774 785 .ne 2
775 786 .na
776 787 \fB\fBPRIV_SYS_RES_CONFIG\fR\fR
777 788 .ad
778 789 .sp .6
779 790 .RS 4n
780 791 Allows all that PRIV_SYS_RES_BIND allows.
781 792 Allow a process to create and delete processor sets, assign CPUs to processor
782 793 sets and override the \fBPSET_NOESCAPE\fR property. Allow a process to change
783 794 the operational status of CPUs in the system using \fBp_online\fR(2). Allow a
784 795 process to configure filesystem quotas. Allow a process to configure resource
785 796 pools and bind processes to pools.
786 797 .RE
787 798
788 799 .sp
789 800 .ne 2
790 801 .na
791 802 \fB\fBPRIV_SYS_RESOURCE\fR\fR
792 803 .ad
793 804 .sp .6
794 805 .RS 4n
795 806 Allow a process to exceed the resource limits imposed on it by
796 807 \fBsetrlimit\fR(2) and \fBsetrctl\fR(2).
797 808 .RE
798 809
799 810 .sp
800 811 .ne 2
801 812 .na
802 813 \fB\fBPRIV_SYS_SMB\fR\fR
803 814 .ad
804 815 .sp .6
805 816 .RS 4n
806 817 Allow a process to provide NetBIOS or SMB services: start SMB kernel threads or
807 818 bind to NetBIOS or SMB reserved ports: ports 137, 138, 139 (NetBIOS) and 445
808 819 (SMB).
809 820 .RE
810 821
811 822 .sp
812 823 .ne 2
813 824 .na
814 825 \fB\fBPRIV_SYS_SUSER_COMPAT\fR\fR
815 826 .ad
816 827 .sp .6
817 828 .RS 4n
818 829 Allow a process to successfully call a third party loadable module that calls
819 830 the kernel \fBsuser()\fR function to check for allowed access. This privilege
820 831 exists only for third party loadable module compatibility and is not used by
821 832 Solaris proper.
822 833 .RE
823 834
824 835 .sp
825 836 .ne 2
826 837 .na
827 838 \fB\fBPRIV_SYS_TIME\fR\fR
828 839 .ad
829 840 .sp .6
830 841 .RS 4n
831 842 Allow a process to manipulate system time using any of the appropriate system
832 843 calls: \fBstime\fR(2), \fBadjtime\fR(2), and \fBntp_adjtime\fR(2).
833 844 .RE
834 845
835 846 .sp
836 847 .ne 2
837 848 .na
838 849 \fB\fBPRIV_SYS_TRANS_LABEL\fR\fR
839 850 .ad
840 851 .sp .6
841 852 .RS 4n
842 853 Allow a process to translate labels that are not dominated by the process's
843 854 sensitivity label to and from an external string form.
844 855 .sp
845 856 This privilege is interpreted only if the system is configured with Trusted
846 857 Extensions.
847 858 .RE
848 859
849 860 .sp
850 861 .ne 2
851 862 .na
852 863 \fB\fBPRIV_VIRT_MANAGE\fR\fR
853 864 .ad
854 865 .sp .6
855 866 .RS 4n
856 867 Allows a process to manage virtualized environments such as \fBxVM\fR(5).
857 868 .RE
858 869
859 870 .sp
860 871 .ne 2
861 872 .na
862 873 \fB\fBPRIV_WIN_COLORMAP\fR\fR
863 874 .ad
864 875 .sp .6
865 876 .RS 4n
866 877 Allow a process to override colormap restrictions.
867 878 .sp
868 879 Allow a process to install or remove colormaps.
869 880 .sp
870 881 Allow a process to retrieve colormap cell entries allocated by other processes.
871 882 .sp
872 883 This privilege is interpreted only if the system is configured with Trusted
873 884 Extensions.
874 885 .RE
875 886
876 887 .sp
877 888 .ne 2
878 889 .na
879 890 \fB\fBPRIV_WIN_CONFIG\fR\fR
880 891 .ad
881 892 .sp .6
882 893 .RS 4n
883 894 Allow a process to configure or destroy resources that are permanently retained
884 895 by the X server.
885 896 .sp
886 897 Allow a process to use SetScreenSaver to set the screen saver timeout value
887 898 .sp
888 899 Allow a process to use ChangeHosts to modify the display access control list.
889 900 .sp
890 901 Allow a process to use GrabServer.
891 902 .sp
892 903 Allow a process to use the SetCloseDownMode request that can retain window,
893 904 pixmap, colormap, property, cursor, font, or graphic context resources.
894 905 .sp
895 906 This privilege is interpreted only if the system is configured with Trusted
896 907 Extensions.
897 908 .RE
898 909
899 910 .sp
900 911 .ne 2
901 912 .na
902 913 \fB\fBPRIV_WIN_DAC_READ\fR\fR
903 914 .ad
904 915 .sp .6
905 916 .RS 4n
906 917 Allow a process to read from a window resource that it does not own (has a
907 918 different user ID).
908 919 .sp
909 920 This privilege is interpreted only if the system is configured with Trusted
910 921 Extensions.
911 922 .RE
912 923
913 924 .sp
914 925 .ne 2
915 926 .na
916 927 \fB\fBPRIV_WIN_DAC_WRITE\fR\fR
917 928 .ad
918 929 .sp .6
919 930 .RS 4n
920 931 Allow a process to write to or create a window resource that it does not own
921 932 (has a different user ID). A newly created window property is created with the
922 933 window's user ID.
923 934 .sp
924 935 This privilege is interpreted only if the system is configured with Trusted
925 936 Extensions.
926 937 .RE
927 938
928 939 .sp
929 940 .ne 2
930 941 .na
931 942 \fB\fBPRIV_WIN_DEVICES\fR\fR
932 943 .ad
933 944 .sp .6
934 945 .RS 4n
935 946 Allow a process to perform operations on window input devices.
936 947 .sp
937 948 Allow a process to get and set keyboard and pointer controls.
938 949 .sp
939 950 Allow a process to modify pointer button and key mappings.
940 951 .sp
941 952 This privilege is interpreted only if the system is configured with Trusted
942 953 Extensions.
943 954 .RE
944 955
945 956 .sp
946 957 .ne 2
947 958 .na
948 959 \fB\fBPRIV_WIN_DGA\fR\fR
949 960 .ad
950 961 .sp .6
951 962 .RS 4n
952 963 Allow a process to use the direct graphics access (DGA) X protocol extensions.
953 964 Direct process access to the frame buffer is still required. Thus the process
954 965 must have MAC and DAC privileges that allow access to the frame buffer, or the
955 966 frame buffer must be allocated to the process.
956 967 .sp
957 968 This privilege is interpreted only if the system is configured with Trusted
958 969 Extensions.
959 970 .RE
960 971
961 972 .sp
962 973 .ne 2
963 974 .na
964 975 \fB\fBPRIV_WIN_DOWNGRADE_SL\fR\fR
965 976 .ad
966 977 .sp .6
967 978 .RS 4n
968 979 Allow a process to set the sensitivity label of a window resource to a
969 980 sensitivity label that does not dominate the existing sensitivity label.
970 981 .sp
971 982 This privilege is interpreted only if the system is configured with Trusted
972 983 Extensions.
973 984 .RE
974 985
975 986 .sp
976 987 .ne 2
977 988 .na
978 989 \fB\fBPRIV_WIN_FONTPATH\fR\fR
979 990 .ad
980 991 .sp .6
981 992 .RS 4n
982 993 Allow a process to set a font path.
983 994 .sp
984 995 This privilege is interpreted only if the system is configured with Trusted
985 996 Extensions.
986 997 .RE
987 998
988 999 .sp
989 1000 .ne 2
990 1001 .na
991 1002 \fB\fBPRIV_WIN_MAC_READ\fR\fR
992 1003 .ad
993 1004 .sp .6
994 1005 .RS 4n
995 1006 Allow a process to read from a window resource whose sensitivity label is not
996 1007 equal to the process sensitivity label.
997 1008 .sp
998 1009 This privilege is interpreted only if the system is configured with Trusted
999 1010 Extensions.
1000 1011 .RE
1001 1012
1002 1013 .sp
1003 1014 .ne 2
1004 1015 .na
1005 1016 \fB\fBPRIV_WIN_MAC_WRITE\fR\fR
1006 1017 .ad
1007 1018 .sp .6
1008 1019 .RS 4n
1009 1020 Allow a process to create a window resource whose sensitivity label is not
1010 1021 equal to the process sensitivity label. A newly created window property is
1011 1022 created with the window's sensitivity label.
1012 1023 .sp
1013 1024 This privilege is interpreted only if the system is configured with Trusted
1014 1025 Extensions.
1015 1026 .RE
1016 1027
1017 1028 .sp
1018 1029 .ne 2
1019 1030 .na
1020 1031 \fB\fBPRIV_WIN_SELECTION\fR\fR
1021 1032 .ad
1022 1033 .sp .6
1023 1034 .RS 4n
1024 1035 Allow a process to request inter-window data moves without the intervention of
1025 1036 the selection confirmer.
1026 1037 .sp
1027 1038 This privilege is interpreted only if the system is configured with Trusted
1028 1039 Extensions.
1029 1040 .RE
1030 1041
1031 1042 .sp
1032 1043 .ne 2
1033 1044 .na
1034 1045 \fB\fBPRIV_WIN_UPGRADE_SL\fR\fR
1035 1046 .ad
1036 1047 .sp .6
1037 1048 .RS 4n
1038 1049 Allow a process to set the sensitivity label of a window resource to a
1039 1050 sensitivity label that dominates the existing sensitivity label.
1040 1051 .sp
1041 1052 This privilege is interpreted only if the system is configured with Trusted
1042 1053 Extensions.
1043 1054 .RE
1044 1055
1045 1056 .sp
1046 1057 .ne 2
1047 1058 .na
1048 1059 \fB\fBPRIV_XVM_CONTROL\fR\fR
1049 1060 .ad
1050 1061 .sp .6
1051 1062 .RS 4n
1052 1063 Allows a process access to the \fBxVM\fR(5) control devices for managing guest
1053 1064 domains and the hypervisor. This privilege is used only if booted into xVM on
1054 1065 x86 platforms.
1055 1066 .RE
1056 1067
1057 1068 .sp
1058 1069 .LP
1059 1070 Of the privileges listed above, the privileges \fBPRIV_FILE_LINK_ANY\fR,
1060 1071 \fBPRIV_PROC_INFO\fR, \fBPRIV_PROC_SESSION\fR, \fBPRIV_PROC_FORK\fR and
1061 1072 \fBPRIV_PROC_EXEC\fR are considered "basic" privileges. These are privileges
1062 1073 that used to be always available to unprivileged processes. By default,
1063 1074 processes still have the basic privileges.
1064 1075 .sp
1065 1076 .LP
1066 1077 The privileges \fBPRIV_PROC_SETID\fR and \fBPRIV_PROC_AUDIT\fR must be present
1067 1078 in the Limit set (see below) of a process in order for set-uid root \fBexec\fRs
1068 1079 to be successful, that is, get an effective UID of 0 and additional privileges.
1069 1080 .sp
1070 1081 .LP
1071 1082 The privilege implementation in Solaris extends the process credential with
1072 1083 four privilege sets:
1073 1084 .sp
1074 1085 .ne 2
1075 1086 .na
1076 1087 \fBI, the inheritable set\fR
1077 1088 .ad
1078 1089 .RS 26n
1079 1090 The privileges inherited on \fBexec\fR.
1080 1091 .RE
1081 1092
1082 1093 .sp
1083 1094 .ne 2
1084 1095 .na
1085 1096 \fBP, the permitted set\fR
1086 1097 .ad
1087 1098 .RS 26n
1088 1099 The maximum set of privileges for the process.
1089 1100 .RE
1090 1101
1091 1102 .sp
1092 1103 .ne 2
1093 1104 .na
1094 1105 \fBE, the effective set\fR
1095 1106 .ad
1096 1107 .RS 26n
1097 1108 The privileges currently in effect.
1098 1109 .RE
1099 1110
1100 1111 .sp
1101 1112 .ne 2
1102 1113 .na
1103 1114 \fBL, the limit set\fR
1104 1115 .ad
1105 1116 .RS 26n
1106 1117 The upper bound of the privileges a process and its offspring can obtain.
1107 1118 Changes to L take effect on the next \fBexec\fR.
1108 1119 .RE
1109 1120
1110 1121 .sp
1111 1122 .LP
1112 1123 The sets I, P and E are typically identical to the basic set of privileges for
1113 1124 unprivileged processes. The limit set is typically the full set of privileges.
1114 1125 .sp
1115 1126 .LP
1116 1127 Each process has a Privilege Awareness State (PAS) that can take the value PA
1117 1128 (privilege-aware) and NPA (not-PA). PAS is a transitional mechanism that allows
1118 1129 a choice between full compatibility with the old superuser model and completely
1119 1130 ignoring the effective UID.
1120 1131 .sp
1121 1132 .LP
1122 1133 To facilitate the discussion, we introduce the notion of "observed effective
1123 1134 set" (oE) and "observed permitted set" (oP) and the implementation sets iE and
1124 1135 iP.
1125 1136 .sp
1126 1137 .LP
1127 1138 A process becomes privilege-aware either by manipulating the effective,
1128 1139 permitted, or limit privilege sets through \fBsetppriv\fR(2) or by using
1129 1140 \fBsetpflags\fR(2). In all cases, oE and oP are invariant in the process of
1130 1141 becoming privilege-aware. In the process of becoming privilege-aware, the
1131 1142 following assignments take place:
1132 1143 .sp
1133 1144 .in +2
1134 1145 .nf
1135 1146 iE = oE
1136 1147 iP = oP
1137 1148 .fi
1138 1149 .in -2
1139 1150
1140 1151 .sp
1141 1152 .LP
1142 1153 When a process is privilege-aware, oE and oP are invariant under UID changes.
1143 1154 When a process is not privilege-aware, oE and oP are observed as follows:
1144 1155 .sp
1145 1156 .in +2
1146 1157 .nf
1147 1158 oE = euid == 0 ? L : iE
1148 1159 oP = (euid == 0 || ruid == 0 || suid == 0) ? L : iP
1149 1160 .fi
1150 1161 .in -2
1151 1162
1152 1163 .sp
1153 1164 .LP
1154 1165 When a non-privilege-aware process has an effective UID of 0, it can exercise
1155 1166 the privileges contained in its limit set, the upper bound of its privileges.
1156 1167 If a non-privilege-aware process has any of the UIDs 0, it appears to be
1157 1168 capable of potentially exercising all privileges in L.
1158 1169 .sp
1159 1170 .LP
1160 1171 It is possible for a process to return to the non-privilege aware state using
1161 1172 \fBsetpflags()\fR. The kernel always attempts this on \fBexec\fR(2). This
1162 1173 operation is permitted only if the following conditions are met:
1163 1174 .RS +4
1164 1175 .TP
1165 1176 .ie t \(bu
1166 1177 .el o
1167 1178 If any of the UIDs is equal to 0, P must be equal to L.
1168 1179 .RE
1169 1180 .RS +4
1170 1181 .TP
1171 1182 .ie t \(bu
1172 1183 .el o
1173 1184 If the effective UID is equal to 0, E must be equal to L.
1174 1185 .RE
1175 1186 .sp
1176 1187 .LP
1177 1188 When a process gives up privilege awareness, the following assignments take
1178 1189 place:
1179 1190 .sp
1180 1191 .in +2
1181 1192 .nf
1182 1193 if (euid == 0) iE = L & I
1183 1194 if (any uid == 0) iP = L & I
1184 1195 .fi
1185 1196 .in -2
1186 1197
1187 1198 .sp
1188 1199 .LP
1189 1200 The privileges obtained when not having a UID of \fB0\fR are the inheritable
1190 1201 set of the process restricted by the limit set.
1191 1202 .sp
1192 1203 .LP
1193 1204 Only privileges in the process's (observed) effective privilege set allow the
1194 1205 process to perform restricted operations. A process can use any of the
1195 1206 privilege manipulation functions to add or remove privileges from the privilege
1196 1207 sets. Privileges can be removed always. Only privileges found in the permitted
1197 1208 set can be added to the effective and inheritable set. The limit set cannot
1198 1209 grow. The inheritable set can be larger than the permitted set.
1199 1210 .sp
1200 1211 .LP
1201 1212 When a process performs an \fBexec\fR(2), the kernel first tries to relinquish
1202 1213 privilege awareness before making the following privilege set modifications:
1203 1214 .sp
1204 1215 .in +2
1205 1216 .nf
1206 1217 E' = P' = I' = L & I
1207 1218 L is unchanged
1208 1219 .fi
1209 1220 .in -2
1210 1221
1211 1222 .sp
1212 1223 .LP
1213 1224 If a process has not manipulated its privileges, the privilege sets effectively
1214 1225 remain the same, as E, P and I are already identical.
1215 1226 .sp
1216 1227 .LP
1217 1228 The limit set is enforced at \fBexec\fR time.
1218 1229 .sp
1219 1230 .LP
1220 1231 To run a non-privilege-aware application in a backward-compatible manner, a
1221 1232 privilege-aware application should start the non-privilege-aware application
1222 1233 with I=basic.
1223 1234 .sp
1224 1235 .LP
1225 1236 For most privileges, absence of the privilege simply results in a failure. In
1226 1237 some instances, the absense of a privilege can cause system calls to behave
1227 1238 differently. In other instances, the removal of a privilege can force a set-uid
1228 1239 application to seriously malfunction. Privileges of this type are considered
1229 1240 "unsafe". When a process is lacking any of the unsafe privileges from its limit
1230 1241 set, the system does not honor the set-uid bit of set-uid root applications.
1231 1242 The following unsafe privileges have been identified: \fBproc_setid\fR,
1232 1243 \fBsys_resource\fR and \fBproc_audit\fR.
1233 1244 .SS "Privilege Escalation"
1234 1245 .LP
1235 1246 In certain circumstances, a single privilege could lead to a process gaining
1236 1247 one or more additional privileges that were not explicitly granted to that
1237 1248 process. To prevent such an escalation of privileges, the security policy
1238 1249 requires explicit permission for those additional privileges.
1239 1250 .sp
1240 1251 .LP
1241 1252 Common examples of escalation are those mechanisms that allow modification of
1242 1253 system resources through "raw'' interfaces; for example, changing kernel data
1243 1254 structures through \fB/dev/kmem\fR or changing files through \fB/dev/dsk/*\fR.
1244 1255 Escalation also occurs when a process controls processes with more privileges
1245 1256 than the controlling process. A special case of this is manipulating or
1246 1257 creating objects owned by UID 0 or trying to obtain UID 0 using
1247 1258 \fBsetuid\fR(2). The special treatment of UID 0 is needed because the UID 0
1248 1259 owns all system configuration files and ordinary file protection mechanisms
1249 1260 allow processes with UID 0 to modify the system configuration. With appropriate
1250 1261 file modifications, a given process running with an effective UID of 0 can gain
1251 1262 all privileges.
1252 1263 .sp
1253 1264 .LP
1254 1265 In situations where a process might obtain UID 0, the security policy requires
1255 1266 additional privileges, up to the full set of privileges. Such restrictions
1256 1267 could be relaxed or removed at such time as additional mechanisms for
1257 1268 protection of system files became available. There are no such mechanisms in
1258 1269 the current Solaris release.
1259 1270 .sp
1260 1271 .LP
1261 1272 The use of UID 0 processes should be limited as much as possible. They should
1262 1273 be replaced with programs running under a different UID but with exactly the
1263 1274 privileges they need.
1264 1275 .sp
1265 1276 .LP
1266 1277 Daemons that never need to \fBexec\fR subprocesses should remove the
1267 1278 \fBPRIV_PROC_EXEC\fR privilege from their permitted and limit sets.
1268 1279 .SS "Assigned Privileges and Safeguards"
1269 1280 .LP
1270 1281 When privileges are assigned to a user, the system administrator could give
1271 1282 that user more powers than intended. The administrator should consider whether
1272 1283 safeguards are needed. For example, if the \fBPRIV_PROC_LOCK_MEMORY\fR
1273 1284 privilege is given to a user, the administrator should consider setting the
1274 1285 \fBproject.max-locked-memory\fR resource control as well, to prevent that user
1275 1286 from locking all memory.
1276 1287 .SS "Privilege Debugging"
1277 1288 .LP
1278 1289 When a system call fails with a permission error, it is not always immediately
1279 1290 obvious what caused the problem. To debug such a problem, you can use a tool
1280 1291 called \fBprivilege debugging\fR. When privilege debugging is enabled for a
1281 1292 process, the kernel reports missing privileges on the controlling terminal of
1282 1293 the process. (Enable debugging for a process with the \fB-D\fR option of
1283 1294 \fBppriv\fR(1).) Additionally, the administrator can enable system-wide
1284 1295 privilege debugging by setting the \fBsystem\fR(4) variable \fBpriv_debug\fR
1285 1296 using:
1286 1297 .sp
1287 1298 .in +2
1288 1299 .nf
1289 1300 set priv_debug = 1
1290 1301 .fi
1291 1302 .in -2
1292 1303
1293 1304 .sp
1294 1305 .LP
1295 1306 On a running system, you can use \fBmdb\fR(1) to change this variable.
1296 1307 .SS "Privilege Administration"
1297 1308 .LP
1298 1309 The Solaris Management Console (see \fBsmc\fR(1M)) is the preferred method of
1299 1310 modifying privileges for a command. Use \fBusermod\fR(1M) or \fBsmrole\fR(1M)
1300 1311 to assign privileges to or modify privileges for, respectively, a user or a
1301 1312 role. Use \fBppriv\fR(1) to enumerate the privileges supported on a system and
1302 1313 \fBtruss\fR(1) to determine which privileges a program requires.
1303 1314 .SH SEE ALSO
1304 1315 .LP
1305 1316 \fBmdb\fR(1), \fBppriv\fR(1), \fBadd_drv\fR(1M), \fBifconfig\fR(1M),
1306 1317 \fBlockd\fR(1M), \fBnfsd\fR(1M), \fBpppd\fR(1M), \fBrem_drv\fR(1M),
1307 1318 \fBsmbd\fR(1M), \fBsppptun\fR(1M), \fBupdate_drv\fR(1M), \fBIntro\fR(2),
1308 1319 \fBaccess\fR(2), \fBacct\fR(2), \fBacl\fR(2), \fBadjtime\fR(2), \fBaudit\fR(2),
1309 1320 \fBauditon\fR(2), \fBchmod\fR(2), \fBchown\fR(2), \fBchroot\fR(2),
1310 1321 \fBcreat\fR(2), \fBexec\fR(2), \fBfcntl\fR(2), \fBfork\fR(2),
1311 1322 \fBfpathconf\fR(2), \fBgetacct\fR(2), \fBgetpflags\fR(2), \fBgetppriv\fR(2),
1312 1323 \fBgetsid\fR(2), \fBkill\fR(2), \fBlink\fR(2), \fBmemcntl\fR(2),
1313 1324 \fBmknod\fR(2), \fBmount\fR(2), \fBmsgctl\fR(2), \fBnice\fR(2),
1314 1325 \fBntp_adjtime\fR(2), \fBopen\fR(2), \fBp_online\fR(2), \fBpriocntl\fR(2),
1315 1326 \fBpriocntlset\fR(2), \fBprocessor_bind\fR(2), \fBpset_bind\fR(2),
1316 1327 \fBpset_create\fR(2), \fBreadlink\fR(2), \fBresolvepath\fR(2), \fBrmdir\fR(2),
1317 1328 \fBsemctl\fR(2), \fBsetauid\fR(2), \fBsetegid\fR(2), \fBseteuid\fR(2),
1318 1329 \fBsetgid\fR(2), \fBsetgroups\fR(2), \fBsetpflags\fR(2), \fBsetppriv\fR(2),
1319 1330 \fBsetrctl\fR(2), \fBsetregid\fR(2), \fBsetreuid\fR(2), \fBsetrlimit\fR(2),
1320 1331 \fBsettaskid\fR(2), \fBsetuid\fR(2), \fBshmctl\fR(2), \fBshmget\fR(2),
1321 1332 \fBshmop\fR(2), \fBsigsend\fR(2), \fBstat\fR(2), \fBstatvfs\fR(2),
1322 1333 \fBstime\fR(2), \fBswapctl\fR(2), \fBsysinfo\fR(2), \fBuadmin\fR(2),
1323 1334 \fBulimit\fR(2), \fBumount\fR(2), \fBunlink\fR(2), \fButime\fR(2),
1324 1335 \fButimes\fR(2), \fBbind\fR(3SOCKET), \fBdoor_ucred\fR(3C),
1325 1336 \fBpriv_addset\fR(3C), \fBpriv_set\fR(3C), \fBpriv_getbyname\fR(3C),
1326 1337 \fBpriv_getbynum\fR(3C), \fBpriv_set_to_str\fR(3C), \fBpriv_str_to_set\fR(3C),
1327 1338 \fBsocket\fR(3SOCKET), \fBt_bind\fR(3NSL), \fBtimer_create\fR(3C),
1328 1339 \fBucred_get\fR(3C), \fBexec_attr\fR(4), \fBproc\fR(4), \fBsystem\fR(4),
1329 1340 \fBuser_attr\fR(4), \fBxVM\fR(5), \fBddi_cred\fR(9F), \fBdrv_priv\fR(9F),
1330 1341 \fBpriv_getbyname\fR(9F), \fBpriv_policy\fR(9F), \fBpriv_policy_choice\fR(9F),
1331 1342 \fBpriv_policy_only\fR(9F)
1332 1343 .sp
1333 1344 .LP
1334 1345 \fISystem Administration Guide: Security Services\fR
|
↓ open down ↓ |
766 lines elided |
↑ open up ↑ |
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX