Print this page
Code review comments from jeffpc
| Split |
Close |
| Expand all |
| Collapse all |
--- old/usr/src/man/man5/privileges.5.man.txt
+++ new/usr/src/man/man5/privileges.5.man.txt
1 1 PRIVILEGES(5) Standards, Environments, and Macros PRIVILEGES(5)
2 2
3 3
4 4
5 5 NAME
6 6 privileges - process privilege model
7 7
8 8 DESCRIPTION
9 9 Solaris software implements a set of privileges that provide fine-
10 10 grained control over the actions of processes. The possession of a
11 11 certain privilege allows a process to perform a specific set of
12 12 restricted operations.
13 13
14 14
15 15 The change to a primarily privilege-based security model in the Solaris
16 16 operating system gives developers an opportunity to restrict processes
17 17 to those privileged operations actually needed instead of all (super-
18 18 user) or no privileges (non-zero UIDs). Additionally, a set of
19 19 previously unrestricted operations now requires a privilege; these
20 20 privileges are dubbed the "basic" privileges and are by default given
21 21 to all processes.
22 22
23 23
24 24 Taken together, all defined privileges with the exception of the
25 25 "basic" privileges compose the set of privileges that are traditionally
26 26 associated with the root user. The "basic" privileges are "privileges"
27 27 unprivileged processes were accustomed to having.
28 28
29 29
30 30 The defined privileges are:
31 31
32 32 PRIV_CONTRACT_EVENT
33 33
34 34 Allow a process to request reliable delivery of events to an event
35 35 endpoint.
36 36
37 37 Allow a process to include events in the critical event set term of
38 38 a template which could be generated in volume by the user.
39 39
40 40
41 41 PRIV_CONTRACT_IDENTITY
42 42
43 43 Allows a process to set the service FMRI value of a process
44 44 contract template.
45 45
46 46
47 47 PRIV_CONTRACT_OBSERVER
48 48
49 49 Allow a process to observe contract events generated by contracts
50 50 created and owned by users other than the process's effective user
51 51 ID.
52 52
53 53 Allow a process to open contract event endpoints belonging to
54 54 contracts created and owned by users other than the process's
55 55 effective user ID.
56 56
57 57
58 58 PRIV_CPC_CPU
59 59
60 60 Allow a process to access per-CPU hardware performance counters.
61 61
62 62
63 63 PRIV_DTRACE_KERNEL
64 64
65 65 Allow DTrace kernel-level tracing.
66 66
67 67
68 68 PRIV_DTRACE_PROC
69 69
70 70 Allow DTrace process-level tracing. Allow process-level tracing
71 71 probes to be placed and enabled in processes to which the user has
72 72 permissions.
73 73
74 74
75 75 PRIV_DTRACE_USER
76 76
77 77 Allow DTrace user-level tracing. Allow use of the syscall and
78 78 profile DTrace providers to examine processes to which the user has
79 79 permissions.
80 80
81 81
82 82 PRIV_FILE_CHOWN
83 83
84 84 Allow a process to change a file's owner user ID. Allow a process
85 85 to change a file's group ID to one other than the process's
86 86 effective group ID or one of the process's supplemental group IDs.
87 87
88 88
89 89 PRIV_FILE_CHOWN_SELF
90 90
91 91 Allow a process to give away its files. A process with this
92 92 privilege runs as if {_POSIX_CHOWN_RESTRICTED} is not in effect.
93 93
94 94
95 95 PRIV_FILE_DAC_EXECUTE
96 96
97 97 Allow a process to execute an executable file whose permission bits
98 98 or ACL would otherwise disallow the process execute permission.
99 99
100 100
101 101 PRIV_FILE_DAC_READ
102 102
103 103 Allow a process to read a file or directory whose permission bits
104 104 or ACL would otherwise disallow the process read permission.
105 105
106 106
107 107 PRIV_FILE_DAC_SEARCH
108 108
109 109 Allow a process to search a directory whose permission bits or ACL
110 110 would not otherwise allow the process search permission.
111 111
112 112
113 113 PRIV_FILE_DAC_WRITE
114 114
115 115 Allow a process to write a file or directory whose permission bits
116 116 or ACL do not allow the process write permission. All privileges
117 117 are required to write files owned by UID 0 in the absence of an
118 118 effective UID of 0.
119 119
120 120
121 121 PRIV_FILE_DOWNGRADE_SL
122 122
123 123 Allow a process to set the sensitivity label of a file or directory
124 124 to a sensitivity label that does not dominate the existing
125 125 sensitivity label.
126 126
127 127 This privilege is interpreted only if the system is configured with
128 128 Trusted Extensions.
129 129
130 130
131 131 PRIV_FILE_FLAG_SET
132 132
133 133 Allows a process to set immutable, nounlink or appendonly file
134 134 attributes.
135 135
136 136
137 137 PRIV_FILE_LINK_ANY
138 138
139 139 Allow a process to create hardlinks to files owned by a UID
140 140 different from the process's effective UID.
141 141
142 142
143 143 PRIV_FILE_OWNER
144 144
145 145 Allow a process that is not the owner of a file to modify that
146 146 file's access and modification times. Allow a process that is not
147 147 the owner of a directory to modify that directory's access and
148 148 modification times. Allow a process that is not the owner of a file
149 149 or directory to remove or rename a file or directory whose parent
150 150 directory has the "save text image after execution" (sticky) bit
151 151 set. Allow a process that is not the owner of a file to mount a
152 152 namefs upon that file. Allow a process that is not the owner of a
153 153 file or directory to modify that file's or directory's permission
154 154 bits or ACL.
155 155
156 156
157 157 PRIV_FILE_READ
158 158
159 159 Allow a process to open objects in the filesystem for reading. This
160 160 privilege is not necessary to read from an already open file which
161 161 was opened before dropping the PRIV_FILE_READ privilege.
162 162
163 163
164 164 PRIV_FILE_SETID
165 165
166 166 Allow a process to change the ownership of a file or write to a
167 167 file without the set-user-ID and set-group-ID bits being cleared.
168 168 Allow a process to set the set-group-ID bit on a file or directory
169 169 whose group is not the process's effective group or one of the
170 170 process's supplemental groups. Allow a process to set the set-user-
171 171 ID bit on a file with different ownership in the presence of
172 172 PRIV_FILE_OWNER. Additional restrictions apply when creating or
173 173 modifying a setuid 0 file.
174 174
175 175
176 176 PRIV_FILE_UPGRADE_SL
177 177
178 178 Allow a process to set the sensitivity label of a file or directory
179 179 to a sensitivity label that dominates the existing sensitivity
180 180 label.
181 181
182 182 This privilege is interpreted only if the system is configured with
183 183 Trusted Extensions.
184 184
185 185
186 186 PRIV_FILE_WRITE
187 187
188 188 Allow a process to open objects in the filesytem for writing, or
189 189 otherwise modify them. This privilege is not necessary to write to
190 190 an already open file which was opened before dropping the
191 191 PRIV_FILE_WRITE privilege.
192 192
193 193
194 194 PRIV_GRAPHICS_ACCESS
195 195
196 196 Allow a process to make privileged ioctls to graphics devices.
197 197 Typically only an xserver process needs to have this privilege. A
198 198 process with this privilege is also allowed to perform privileged
199 199 graphics device mappings.
200 200
201 201
202 202 PRIV_GRAPHICS_MAP
203 203
204 204 Allow a process to perform privileged mappings through a graphics
205 205 device.
206 206
207 207
208 208 PRIV_IPC_DAC_READ
209 209
210 210 Allow a process to read a System V IPC Message Queue, Semaphore
211 211 Set, or Shared Memory Segment whose permission bits would not
212 212 otherwise allow the process read permission.
213 213
214 214
215 215 PRIV_IPC_DAC_WRITE
216 216
217 217 Allow a process to write a System V IPC Message Queue, Semaphore
218 218 Set, or Shared Memory Segment whose permission bits would not
219 219 otherwise allow the process write permission.
220 220
221 221
222 222 PRIV_IPC_OWNER
223 223
224 224 Allow a process that is not the owner of a System V IPC Message
225 225 Queue, Semaphore Set, or Shared Memory Segment to remove, change
226 226 ownership of, or change permission bits of the Message Queue,
227 227 Semaphore Set, or Shared Memory Segment.
228 228
229 229
230 230 PRIV_NET_ACCESS
231 231
232 232 Allow a process to open a TCP, UDP, SDP, or SCTP network endpoint.
233 233 This privilege is not necessary to communicate using an existing
234 234 endpoint already opened before dropping the PRIV_NET_ACCESS
235 235 privilege.
236 236
237 237
238 238 PRIV_NET_BINDMLP
239 239
240 240 Allow a process to bind to a port that is configured as a multi-
241 241 level port (MLP) for the process's zone. This privilege applies to
242 242 both shared address and zone-specific address MLPs. See
243 243 tnzonecfg(4) from the Trusted Extensions manual pages for
244 244 information on configuring MLP ports.
245 245
246 246 This privilege is interpreted only if the system is configured with
247 247 Trusted Extensions.
248 248
249 249
250 250 PRIV_NET_ICMPACCESS
251 251
252 252 Allow a process to send and receive ICMP packets.
253 253
254 254
255 255 PRIV_NET_MAC_AWARE
256 256
257 257 Allow a process to set the NET_MAC_AWARE process flag by using
258 258 setpflags(2). This privilege also allows a process to set the
259 259 SO_MAC_EXEMPT socket option by using setsockopt(3SOCKET). The
260 260 NET_MAC_AWARE process flag and the SO_MAC_EXEMPT socket option both
261 261 allow a local process to communicate with an unlabeled peer if the
262 262 local process's label dominates the peer's default label, or if the
263 263 local process runs in the global zone.
264 264
265 265 This privilege is interpreted only if the system is configured with
266 266 Trusted Extensions.
267 267
268 268
269 269 PRIV_NET_MAC_IMPLICIT
270 270
271 271 Allow a proces to set SO_MAC_IMPLICIT option by using
272 272 setsockopt(3SOCKET). This allows a privileged process to transmit
273 273 implicitly-labeled packets to a peer.
274 274
275 275 This privilege is interpreted only if the system is configured with
276 276 Trusted Extensions.
277 277
278 278
279 279 PRIV_NET_OBSERVABILITY
280 280
281 281 Allow a process to open a device for just receiving network
282 282 traffic, sending traffic is disallowed.
283 283
284 284
285 285 PRIV_NET_PRIVADDR
286 286
287 287 Allow a process to bind to a privileged port number. The privilege
288 288 port numbers are 1-1023 (the traditional UNIX privileged ports) as
289 289 well as those ports marked as "udp/tcp_extra_priv_ports" with the
290 290 exception of the ports reserved for use by NFS and SMB.
291 291
292 292
293 293 PRIV_NET_RAWACCESS
294 294
295 295 Allow a process to have direct access to the network layer.
296 296
297 297
298 298 PRIV_PROC_AUDIT
299 299
300 300 Allow a process to generate audit records. Allow a process to get
301 301 its own audit pre-selection information.
302 302
303 303
304 304 PRIV_PROC_CHROOT
305 305
306 306 Allow a process to change its root directory.
307 307
308 308
309 309 PRIV_PROC_CLOCK_HIGHRES
310 310
311 311 Allow a process to use high resolution timers.
312 312
313 313
314 314 PRIV_PROC_EXEC
315 315
316 316 Allow a process to call exec(2).
317 317
318 318
319 319 PRIV_PROC_FORK
320 320
321 321 Allow a process to call fork(2), fork1(2), or vfork(2).
322 322
323 323
324 324 PRIV_PROC_INFO
325 325
326 326 Allow a process to examine the status of processes other than those
327 327 to which it can send signals. Processes that cannot be examined
328 328 cannot be seen in /proc and appear not to exist.
329 329
330 330
331 331 PRIV_PROC_LOCK_MEMORY
332 332
333 333 Allow a process to lock pages in physical memory.
334 334
335 335
336 336 PRIV_PROC_MEMINFO
337 337
338 338 Allow a process to access physical memory information.
339 339
340 340
341 341 PRIV_PROC_OWNER
342 342
343 343 Allow a process to send signals to other processes and inspect and
344 344 modify the process state in other processes, regardless of
345 345 ownership. When modifying another process, additional restrictions
346 346 apply: the effective privilege set of the attaching process must be
347 347 a superset of the target process's effective, permitted, and
348 348 inheritable sets; the limit set must be a superset of the target's
349 349 limit set; if the target process has any UID set to 0 all privilege
350 350 must be asserted unless the effective UID is 0. Allow a process to
351 351 bind arbitrary processes to CPUs.
352 352
353 353
354 354 PRIV_PROC_PRIOUP
355 355
356 356 Allow a process to elevate its priority above its current level.
357 357
358 358
359 359 PRIV_PROC_PRIOCNTL
360 360
361 361 Allows all that PRIV_PROC_PRIOUP allows. Allow a process to change
362 362 its scheduling class to any scheduling class, including the RT
363 363 class.
364 364
365 365
366 366 PRIV_PROC_SECFLAGS
367 367
368 368 Allow a process to manipulate the secflags of processes (subject
369 369 to, additionally, the ability to signal that process).
370 370
371 371
372 372 PRIV_PROC_SESSION
373 373
374 374 Allow a process to send signals or trace processes outside its
375 375 session.
376 376
377 377
378 378 PRIV_PROC_SETID
379 379
380 380 Allow a process to set its UIDs at will, assuming UID 0 requires
381 381 all privileges to be asserted.
382 382
383 383
384 384 PRIV_PROC_TASKID
385 385
386 386 Allow a process to assign a new task ID to the calling process.
387 387
388 388
389 389 PRIV_PROC_ZONE
390 390
391 391 Allow a process to trace or send signals to processes in other
392 392 zones. See zones(5).
393 393
394 394
395 395 PRIV_SYS_ACCT
396 396
397 397 Allow a process to enable and disable and manage accounting through
398 398 acct(2).
399 399
400 400
401 401 PRIV_SYS_ADMIN
402 402
403 403 Allow a process to perform system administration tasks such as
404 404 setting node and domain name and specifying coreadm(1M) and
405 405 nscd(1M) settings
406 406
407 407
408 408 PRIV_SYS_AUDIT
409 409
410 410 Allow a process to start the (kernel) audit daemon. Allow a process
411 411 to view and set audit state (audit user ID, audit terminal ID,
412 412 audit sessions ID, audit pre-selection mask). Allow a process to
413 413 turn off and on auditing. Allow a process to configure the audit
414 414 parameters (cache and queue sizes, event to class mappings, and
415 415 policy options).
416 416
417 417
418 418 PRIV_SYS_CONFIG
419 419
420 420 Allow a process to perform various system configuration tasks.
421 421 Allow filesystem-specific administrative procedures, such as
422 422 filesystem configuration ioctls, quota calls, creation and deletion
423 423 of snapshots, and manipulating the PCFS bootsector.
424 424
425 425
426 426 PRIV_SYS_DEVICES
427 427
428 428 Allow a process to create device special files. Allow a process to
429 429 successfully call a kernel module that calls the kernel
430 430 drv_priv(9F) function to check for allowed access. Allow a process
431 431 to open the real console device directly. Allow a process to open
432 432 devices that have been exclusively opened.
433 433
434 434
435 435 PRIV_SYS_DL_CONFIG
436 436
437 437 Allow a process to configure a system's datalink interfaces.
438 438
439 439
440 440 PRIV_SYS_IP_CONFIG
441 441
442 442 Allow a process to configure a system's IP interfaces and routes.
443 443 Allow a process to configure network parameters for TCP/IP using
444 444 ndd. Allow a process access to otherwise restricted TCP/IP
445 445 information using ndd. Allow a process to configure IPsec. Allow a
446 446 process to pop anchored STREAMs modules with matching zoneid.
447 447
448 448
449 449 PRIV_SYS_IPC_CONFIG
450 450
451 451 Allow a process to increase the size of a System V IPC Message
452 452 Queue buffer.
453 453
454 454
455 455 PRIV_SYS_IPTUN_CONFIG
456 456
457 457 Allow a process to configure IP tunnel links.
458 458
459 459
460 460 PRIV_SYS_LINKDIR
461 461
462 462 Allow a process to unlink and link directories.
463 463
464 464
465 465 PRIV_SYS_MOUNT
466 466
467 467 Allow a process to mount and unmount filesystems that would
468 468 otherwise be restricted (that is, most filesystems except namefs).
469 469 Allow a process to add and remove swap devices.
470 470
471 471
472 472 PRIV_SYS_NET_CONFIG
473 473
474 474 Allow a process to do all that PRIV_SYS_IP_CONFIG,
475 475 PRIV_SYS_DL_CONFIG, and PRIV_SYS_PPP_CONFIG allow, plus the
476 476 following: use the rpcmod STREAMS module and insert/remove STREAMS
477 477 modules on locations other than the top of the module stack.
478 478
479 479
480 480 PRIV_SYS_NFS
481 481
482 482 Allow a process to provide NFS service: start NFS kernel threads,
483 483 perform NFS locking operations, bind to NFS reserved ports: ports
484 484 2049 (nfs) and port 4045 (lockd).
485 485
486 486
487 487 PRIV_SYS_PPP_CONFIG
488 488
489 489 Allow a process to create, configure, and destroy PPP instances
490 490 with pppd(1M) pppd(1M) and control PPPoE plumbing with
491 491 sppptun(1M)sppptun(1M). This privilege is granted by default to
492 492 exclusive IP stack instance zones.
493 493
494 494
495 495 PRIV_SYS_RES_BIND
496 496
497 497 Allows a process to bind processes to processor sets.
498 498
499 499
500 500 PRIV_SYS_RES_CONFIG
501 501
502 502 Allows all that PRIV_SYS_RES_BIND allows. Allow a process to
503 503 create and delete processor sets, assign CPUs to processor sets and
504 504 override the PSET_NOESCAPE property. Allow a process to change the
505 505 operational status of CPUs in the system using p_online(2). Allow a
506 506 process to configure filesystem quotas. Allow a process to
507 507 configure resource pools and bind processes to pools.
508 508
509 509
510 510 PRIV_SYS_RESOURCE
511 511
512 512 Allow a process to exceed the resource limits imposed on it by
513 513 setrlimit(2) and setrctl(2).
514 514
515 515
516 516 PRIV_SYS_SMB
517 517
518 518 Allow a process to provide NetBIOS or SMB services: start SMB
519 519 kernel threads or bind to NetBIOS or SMB reserved ports: ports 137,
520 520 138, 139 (NetBIOS) and 445 (SMB).
521 521
522 522
523 523 PRIV_SYS_SUSER_COMPAT
524 524
525 525 Allow a process to successfully call a third party loadable module
526 526 that calls the kernel suser() function to check for allowed access.
527 527 This privilege exists only for third party loadable module
528 528 compatibility and is not used by Solaris proper.
529 529
530 530
531 531 PRIV_SYS_TIME
532 532
533 533 Allow a process to manipulate system time using any of the
534 534 appropriate system calls: stime(2), adjtime(2), and ntp_adjtime(2).
535 535
536 536
537 537 PRIV_SYS_TRANS_LABEL
538 538
539 539 Allow a process to translate labels that are not dominated by the
540 540 process's sensitivity label to and from an external string form.
541 541
542 542 This privilege is interpreted only if the system is configured with
543 543 Trusted Extensions.
544 544
545 545
546 546 PRIV_VIRT_MANAGE
547 547
548 548 Allows a process to manage virtualized environments such as xVM(5).
549 549
550 550
551 551 PRIV_WIN_COLORMAP
552 552
553 553 Allow a process to override colormap restrictions.
554 554
555 555 Allow a process to install or remove colormaps.
556 556
557 557 Allow a process to retrieve colormap cell entries allocated by
558 558 other processes.
559 559
560 560 This privilege is interpreted only if the system is configured with
561 561 Trusted Extensions.
562 562
563 563
564 564 PRIV_WIN_CONFIG
565 565
566 566 Allow a process to configure or destroy resources that are
567 567 permanently retained by the X server.
568 568
569 569 Allow a process to use SetScreenSaver to set the screen saver
570 570 timeout value
571 571
572 572 Allow a process to use ChangeHosts to modify the display access
573 573 control list.
574 574
575 575 Allow a process to use GrabServer.
576 576
577 577 Allow a process to use the SetCloseDownMode request that can retain
578 578 window, pixmap, colormap, property, cursor, font, or graphic
579 579 context resources.
580 580
581 581 This privilege is interpreted only if the system is configured with
582 582 Trusted Extensions.
583 583
584 584
585 585 PRIV_WIN_DAC_READ
586 586
587 587 Allow a process to read from a window resource that it does not own
588 588 (has a different user ID).
589 589
590 590 This privilege is interpreted only if the system is configured with
591 591 Trusted Extensions.
592 592
593 593
594 594 PRIV_WIN_DAC_WRITE
595 595
596 596 Allow a process to write to or create a window resource that it
597 597 does not own (has a different user ID). A newly created window
598 598 property is created with the window's user ID.
599 599
600 600 This privilege is interpreted only if the system is configured with
601 601 Trusted Extensions.
602 602
603 603
604 604 PRIV_WIN_DEVICES
605 605
606 606 Allow a process to perform operations on window input devices.
607 607
608 608 Allow a process to get and set keyboard and pointer controls.
609 609
610 610 Allow a process to modify pointer button and key mappings.
611 611
612 612 This privilege is interpreted only if the system is configured with
613 613 Trusted Extensions.
614 614
615 615
616 616 PRIV_WIN_DGA
617 617
618 618 Allow a process to use the direct graphics access (DGA) X protocol
619 619 extensions. Direct process access to the frame buffer is still
620 620 required. Thus the process must have MAC and DAC privileges that
621 621 allow access to the frame buffer, or the frame buffer must be
622 622 allocated to the process.
623 623
624 624 This privilege is interpreted only if the system is configured with
625 625 Trusted Extensions.
626 626
627 627
628 628 PRIV_WIN_DOWNGRADE_SL
629 629
630 630 Allow a process to set the sensitivity label of a window resource
631 631 to a sensitivity label that does not dominate the existing
632 632 sensitivity label.
633 633
634 634 This privilege is interpreted only if the system is configured with
635 635 Trusted Extensions.
636 636
637 637
638 638 PRIV_WIN_FONTPATH
639 639
640 640 Allow a process to set a font path.
641 641
642 642 This privilege is interpreted only if the system is configured with
643 643 Trusted Extensions.
644 644
645 645
646 646 PRIV_WIN_MAC_READ
647 647
648 648 Allow a process to read from a window resource whose sensitivity
649 649 label is not equal to the process sensitivity label.
650 650
651 651 This privilege is interpreted only if the system is configured with
652 652 Trusted Extensions.
653 653
654 654
655 655 PRIV_WIN_MAC_WRITE
656 656
657 657 Allow a process to create a window resource whose sensitivity label
658 658 is not equal to the process sensitivity label. A newly created
659 659 window property is created with the window's sensitivity label.
660 660
661 661 This privilege is interpreted only if the system is configured with
662 662 Trusted Extensions.
663 663
664 664
665 665 PRIV_WIN_SELECTION
666 666
667 667 Allow a process to request inter-window data moves without the
668 668 intervention of the selection confirmer.
669 669
670 670 This privilege is interpreted only if the system is configured with
671 671 Trusted Extensions.
672 672
673 673
674 674 PRIV_WIN_UPGRADE_SL
675 675
676 676 Allow a process to set the sensitivity label of a window resource
677 677 to a sensitivity label that dominates the existing sensitivity
678 678 label.
679 679
680 680 This privilege is interpreted only if the system is configured with
681 681 Trusted Extensions.
682 682
683 683
684 684 PRIV_XVM_CONTROL
685 685
686 686 Allows a process access to the xVM(5) control devices for managing
687 687 guest domains and the hypervisor. This privilege is used only if
688 688 booted into xVM on x86 platforms.
689 689
690 690
691 691
692 692 Of the privileges listed above, the privileges PRIV_FILE_LINK_ANY,
693 693 PRIV_PROC_INFO, PRIV_PROC_SESSION, PRIV_PROC_FORK, PRIV_FILE_READ,
694 694 PRIV_FILE_WRITE, PRIV_NET_ACCESS and PRIV_PROC_EXEC are considered
695 695 "basic" privileges. These are privileges that used to be always
696 696 available to unprivileged processes. By default, processes still have
697 697 the basic privileges.
698 698
699 699
700 700 The privileges PRIV_PROC_SETID and PRIV_PROC_AUDIT must be present in
701 701 the Limit set (see below) of a process in order for set-uid root execs
702 702 to be successful, that is, get an effective UID of 0 and additional
703 703 privileges.
704 704
705 705
706 706 The privilege implementation in Solaris extends the process credential
707 707 with four privilege sets:
708 708
709 709 I, the inheritable set
710 710 The privileges inherited on exec.
711 711
712 712
713 713 P, the permitted set
714 714 The maximum set of privileges for the
715 715 process.
716 716
717 717
718 718 E, the effective set
719 719 The privileges currently in effect.
720 720
721 721
722 722 L, the limit set
723 723 The upper bound of the privileges a process
724 724 and its offspring can obtain. Changes to L
725 725 take effect on the next exec.
726 726
727 727
728 728
729 729 The sets I, P and E are typically identical to the basic set of
730 730 privileges for unprivileged processes. The limit set is typically the
731 731 full set of privileges.
732 732
733 733
734 734 Each process has a Privilege Awareness State (PAS) that can take the
735 735 value PA (privilege-aware) and NPA (not-PA). PAS is a transitional
736 736 mechanism that allows a choice between full compatibility with the old
737 737 superuser model and completely ignoring the effective UID.
738 738
739 739
740 740 To facilitate the discussion, we introduce the notion of "observed
741 741 effective set" (oE) and "observed permitted set" (oP) and the
742 742 implementation sets iE and iP.
743 743
744 744
745 745 A process becomes privilege-aware either by manipulating the effective,
746 746 permitted, or limit privilege sets through setppriv(2) or by using
747 747 setpflags(2). In all cases, oE and oP are invariant in the process of
748 748 becoming privilege-aware. In the process of becoming privilege-aware,
749 749 the following assignments take place:
750 750
751 751 iE = oE
752 752 iP = oP
753 753
754 754
755 755
756 756 When a process is privilege-aware, oE and oP are invariant under UID
757 757 changes. When a process is not privilege-aware, oE and oP are observed
758 758 as follows:
759 759
760 760 oE = euid == 0 ? L : iE
761 761 oP = (euid == 0 || ruid == 0 || suid == 0) ? L : iP
762 762
763 763
764 764
765 765 When a non-privilege-aware process has an effective UID of 0, it can
766 766 exercise the privileges contained in its limit set, the upper bound of
767 767 its privileges. If a non-privilege-aware process has any of the UIDs
768 768 0, it appears to be capable of potentially exercising all privileges in
769 769 L.
770 770
771 771
772 772 It is possible for a process to return to the non-privilege aware state
773 773 using setpflags(). The kernel always attempts this on exec(2). This
774 774 operation is permitted only if the following conditions are met:
775 775
776 776 o If any of the UIDs is equal to 0, P must be equal to L.
777 777
778 778 o If the effective UID is equal to 0, E must be equal to L.
779 779
780 780
781 781 When a process gives up privilege awareness, the following assignments
782 782 take place:
783 783
784 784 if (euid == 0) iE = L & I
785 785 if (any uid == 0) iP = L & I
786 786
787 787
788 788
789 789 The privileges obtained when not having a UID of 0 are the inheritable
790 790 set of the process restricted by the limit set.
791 791
792 792
793 793 Only privileges in the process's (observed) effective privilege set
794 794 allow the process to perform restricted operations. A process can use
795 795 any of the privilege manipulation functions to add or remove privileges
796 796 from the privilege sets. Privileges can be removed always. Only
797 797 privileges found in the permitted set can be added to the effective and
798 798 inheritable set. The limit set cannot grow. The inheritable set can be
799 799 larger than the permitted set.
800 800
801 801
802 802 When a process performs an exec(2), the kernel first tries to
803 803 relinquish privilege awareness before making the following privilege
804 804 set modifications:
805 805
806 806 E' = P' = I' = L & I
807 807 L is unchanged
808 808
809 809
810 810
811 811 If a process has not manipulated its privileges, the privilege sets
812 812 effectively remain the same, as E, P and I are already identical.
813 813
814 814
815 815 The limit set is enforced at exec time.
816 816
817 817
818 818 To run a non-privilege-aware application in a backward-compatible
819 819 manner, a privilege-aware application should start the non-privilege-
820 820 aware application with I=basic.
821 821
822 822
823 823 For most privileges, absence of the privilege simply results in a
824 824 failure. In some instances, the absense of a privilege can cause system
825 825 calls to behave differently. In other instances, the removal of a
826 826 privilege can force a set-uid application to seriously malfunction.
827 827 Privileges of this type are considered "unsafe". When a process is
828 828 lacking any of the unsafe privileges from its limit set, the system
829 829 does not honor the set-uid bit of set-uid root applications. The
830 830 following unsafe privileges have been identified: proc_setid,
831 831 sys_resource and proc_audit.
832 832
833 833 Privilege Escalation
834 834 In certain circumstances, a single privilege could lead to a process
835 835 gaining one or more additional privileges that were not explicitly
836 836 granted to that process. To prevent such an escalation of privileges,
837 837 the security policy requires explicit permission for those additional
838 838 privileges.
839 839
840 840
841 841 Common examples of escalation are those mechanisms that allow
842 842 modification of system resources through "raw'' interfaces; for
843 843 example, changing kernel data structures through /dev/kmem or changing
844 844 files through /dev/dsk/*. Escalation also occurs when a process
845 845 controls processes with more privileges than the controlling process. A
846 846 special case of this is manipulating or creating objects owned by UID 0
847 847 or trying to obtain UID 0 using setuid(2). The special treatment of UID
848 848 0 is needed because the UID 0 owns all system configuration files and
849 849 ordinary file protection mechanisms allow processes with UID 0 to
850 850 modify the system configuration. With appropriate file modifications, a
851 851 given process running with an effective UID of 0 can gain all
852 852 privileges.
853 853
854 854
855 855 In situations where a process might obtain UID 0, the security policy
856 856 requires additional privileges, up to the full set of privileges. Such
857 857 restrictions could be relaxed or removed at such time as additional
858 858 mechanisms for protection of system files became available. There are
859 859 no such mechanisms in the current Solaris release.
860 860
861 861
862 862 The use of UID 0 processes should be limited as much as possible. They
863 863 should be replaced with programs running under a different UID but with
864 864 exactly the privileges they need.
865 865
866 866
867 867 Daemons that never need to exec subprocesses should remove the
868 868 PRIV_PROC_EXEC privilege from their permitted and limit sets.
869 869
870 870 Assigned Privileges and Safeguards
871 871 When privileges are assigned to a user, the system administrator could
872 872 give that user more powers than intended. The administrator should
873 873 consider whether safeguards are needed. For example, if the
874 874 PRIV_PROC_LOCK_MEMORY privilege is given to a user, the administrator
875 875 should consider setting the project.max-locked-memory resource control
876 876 as well, to prevent that user from locking all memory.
877 877
878 878 Privilege Debugging
879 879 When a system call fails with a permission error, it is not always
880 880 immediately obvious what caused the problem. To debug such a problem,
881 881 you can use a tool called privilege debugging. When privilege debugging
882 882 is enabled for a process, the kernel reports missing privileges on the
883 883 controlling terminal of the process. (Enable debugging for a process
884 884 with the -D option of ppriv(1).) Additionally, the administrator can
885 885 enable system-wide privilege debugging by setting the system(4)
886 886 variable priv_debug using:
887 887
888 888 set priv_debug = 1
889 889
890 890
891 891
892 892 On a running system, you can use mdb(1) to change this variable.
893 893
894 894 Privilege Administration
895 895 The Solaris Management Console (see smc(1M)) is the preferred method of
896 896 modifying privileges for a command. Use usermod(1M) or smrole(1M) to
897 897 assign privileges to or modify privileges for, respectively, a user or
898 898 a role. Use ppriv(1) to enumerate the privileges supported on a system
899 899 and truss(1) to determine which privileges a program requires.
900 900
901 901 SEE ALSO
902 902 mdb(1), ppriv(1), add_drv(1M), ifconfig(1M), lockd(1M), nfsd(1M),
903 903 pppd(1M), rem_drv(1M), smbd(1M), sppptun(1M), update_drv(1M), Intro(2),
904 904 access(2), acct(2), acl(2), adjtime(2), audit(2), auditon(2), chmod(2),
905 905 chown(2), chroot(2), creat(2), exec(2), fcntl(2), fork(2),
906 906 fpathconf(2), getacct(2), getpflags(2), getppriv(2), getsid(2),
907 907 kill(2), link(2), memcntl(2), mknod(2), mount(2), msgctl(2), nice(2),
908 908 ntp_adjtime(2), open(2), p_online(2), priocntl(2), priocntlset(2),
909 909 processor_bind(2), pset_bind(2), pset_create(2), readlink(2),
910 910 resolvepath(2), rmdir(2), semctl(2), setauid(2), setegid(2),
911 911 seteuid(2), setgid(2), setgroups(2), setpflags(2), setppriv(2),
912 912 setrctl(2), setregid(2), setreuid(2), setrlimit(2), settaskid(2),
913 913 setuid(2), shmctl(2), shmget(2), shmop(2), sigsend(2), stat(2),
914 914 statvfs(2), stime(2), swapctl(2), sysinfo(2), uadmin(2), ulimit(2),
915 915 umount(2), unlink(2), utime(2), utimes(2), bind(3SOCKET),
916 916 door_ucred(3C), priv_addset(3C), priv_set(3C), priv_getbyname(3C),
917 917 priv_getbynum(3C), priv_set_to_str(3C), priv_str_to_set(3C),
|
↓ open down ↓ |
917 lines elided |
↑ open up ↑ |
918 918 socket(3SOCKET), t_bind(3NSL), timer_create(3C), ucred_get(3C),
919 919 exec_attr(4), proc(4), system(4), user_attr(4), xVM(5), ddi_cred(9F),
920 920 drv_priv(9F), priv_getbyname(9F), priv_policy(9F),
921 921 priv_policy_choice(9F), priv_policy_only(9F)
922 922
923 923
924 924 System Administration Guide: Security Services
925 925
926 926
927 927
928 - October 30, 2015 PRIVILEGES(5)
928 + June 6, 2016 PRIVILEGES(5)
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX