PSARC 2009/377 In-kernel pfexec implementation

Quicksearch

Disclaimer

The individual owning this blog works for Oracle in Germany. The opinions expressed here are his own, are not necessarily reviewed in advance by anyone but the individual author, and neither Oracle nor any other party necessarily agrees with them.

Navigation

< Alles beim Alten ... | Meet the stats - today: mpstat >

PSARC 2009/377 In-kernel pfexec implementation

Wednesday, April 28. 2010

A larger putback found it's way into OpenSolaris. It's headlined with the introduction of the changes introduced by PSARC case 2009/377 In-kernel pfexec implementation.. This PSARC case removes the old mechanism of proving profile shells to a new kernel-integrated one:

The implementation of pfexec(1) is changed such that is add the PRIV_PFEXEC credential flag and then executes the program. The execve() system call will notice the PRIV_PFEXEC flag and it will ask the pfexecd daemon whether the file can be executed and which changes to the credential are required

Another interesting change introduces by the PSARC is a different behaviour in the case of setuid-ed binaries:

Additional, this project will deliver "Forced Privileges" through the exec_attr database:
- Unsafe privileges are not required to execute ping, traceroute, etc. (If an executable is set-uid root, then the kernel will lookup the Forced Privileges for that executable)
- Set-uid applications in that list will not start as root, instead they run with the appropriate privileges.

One big advantage of the new in-kernel implementation is the point, that profile shells ( are simple to implement now: So there will be an pfbash, pfzsh and pftcsh. A profile shell is a hardlink to a regualar Solaris shells that enables checking privileges that are assigned to the role. The shell code has to be aware of the RBAC configuration. This wasn't the case in the past for bash, zsh and tcsh. Now that this part has moved into the kernel, all shells use the common infrastructure.

Another interesting feature of this change: The introduction of the FILE_READ and FILE_WRITE privileges due to the code putback of the results of PSARC case 2009/378 enables you to create read-only and write-only processes.

Posted by Joerg Moellenkamp in English, Solaris, Sun/Oracle at 13:05 | Comments (20) | Trackbacks (0)

View as PDF: This entry | This month | Full blog

Trackbacks

Trackback specific URI for this entry

No Trackbacks

Comments

Display comments as (Linear | Threaded)

Good Explanation of the change. But what is the advantage?

#1 Martin on 2010-04-28 14:50 (Reply)

I've described one important, more of them are in the ARC documentation i've linked to.

#2 Joerg M. (Homepage) on 2010-04-28 14:54 (Reply)

All this work... for what?

What good is pfexec is you have a heterogenous environment?

pfexec doesn't exist on HP-UX; it doesn't exist on AIX (contrary to hype); and it most definitely does not exist on Linux.

So with this, system administrators worldwide will need to learn the intricacies of pfexec (which is extremely complex), IN ADDITION to sudo.

If they were to follow the Sun way, they would end up with a salad: pdexec/RBAC on Solaris, sudo on everything else.

Who thinks up these things?!? What is going on inside of that organization of yours?!?

#3 UX-admin on 2010-04-28 15:14 (Reply)

All this work... for what?

What good is pfexec if you have a heterogenous environment?

pfexec doesn't exist on HP-UX; it doesn't exist on AIX (contrary to hype); and it most definitely does not exist on Linux.

So with this, system administrators worldwide will need to learn the intricacies of pfexec (which is extremely complex), IN ADDITION to sudo.

If they were to follow the Sun way, they would end up with a salad: pdexec/RBAC on Solaris, sudo on everything else.

Who thinks up these things?!? What is going on inside of that organization of yours?!?

#4 UX-admin on 2010-04-28 15:14 (Reply)

We had this discussion already, you write your rant about pfexec everytime you see it, i won't restart the discussion ....

#4.1 Joerg M. (Homepage) on 2010-04-28 15:20 (Reply)

as@solstice:~$ uname -a; /usr/bin/sudo
SunOS solstice 5.11 snv_129 i86pc i386 i86pc
usage: sudo [-n] -h | -K | -k | -L | -V | -v
usage: sudo -l[l] [-AnS] [-g groupname|#gid] [-U username] [-u username|#uid]
[-g groupname|#gid] [command]
usage: sudo [-AbEHnPS] [-C fd] [-g groupname|#gid] [-p prompt] [-u
username|#uid] [-g groupname|#gid] [VAR=value] [-i|-s] []
usage: sudo -e [-AnS] [-C fd] [-g groupname|#gid] [-p prompt] [-u
username|#uid] file ...

so whats your exact problem now? that you get an additional way to solve your problems (a way that i would call superior)? i said it before: if you are not willing or able to learn new things or adapt to the progress: die with the past, but dont bother us with your stubborn rants. the world is evolving, dont blame others for this if you cant keep pace.

#4.2 as on 2010-04-28 17:14 (Reply)

Well, well, well, what irony... I just love it when a clueless "me too" accuses me of things he knows nothing about.

I actually have formal education in RBAC, and many other technologies in Solaris.

And as far as irony is concerned, the very OpenSolaris and innovations you are boasting about, every time you run OpenSolaris, you're running my code.

Didn't know that, did ya, "me too"? That's right, I hold copyright on some of the code you run in OpenSolaris.

Every time you run your "progress", you're running my code. Don't forget that, "me too".

#4.2.1 UX-admin on 2010-04-28 20:42 (Reply)

and, whats the impact of this to my comment? correct, theres none. and if you have written 99% of the opensolaris code, your comment (or try to troll people) is just a stubborn rant. bother the people who made the decision to extend pfexec in this way, not the messenger. telling people how great you are doesnt substitute a argument. and nothing else you have done here. come back when you have arguments.

#4.2.1.1 as on 2010-04-28 22:09 (Reply)

The messenger should not be promoting something which is a regression as progress.

It's that simple.

#4.2.1.1.1 UX-admin on 2010-04-29 00:13 (Reply)

My exact problem is that all these resources - time, effort, money - are being wasted on stuff like RBAC, when you STILL have buggy implementation of the DHCP server, still have a buggy implementation of the DHCP client, still have ZFS trip and fail if there are any lofs mounts in /etc/vfstab... should I go on?

My point is, there are very basic things, basic functionality inside of Solaris, that still isn't fixed, instead time and effort is being wasted REINVENTING WHEELS from which a sysadmin in a heterogenous environment can't benefit.

In fact, this just causes more work! It does not make one's life SIMPLER.

Fix basic functionality in Solaris services first... then do exotic things like pfexec.

#5 UX-admin on 2010-04-28 20:34 (Reply)

1. Opensolaris is opensource ... why don't you help with it ?

2. pfexec isn't an exotic feature and all the profile shells aren't one as well ...
3. Just because you don't like it, doesn't imply that no one needs it ... but that is a topic we already had in the past, too.

#5.1 Joerg Moellenkamp (Homepage) on 2010-04-28 20:38 (Reply)

See above.

That's right, I do not approve of wasting time and effort on something that already exists.

I'm also criticizing anything that is more complex than it needs to be. I don't care how fancy the technology is, if it is more complex than it needs to be, than it's BUSTED, especially if there already exists a solution that works just as well and is ubiquitous.

Finally, I note that you have not spared one, not one word on commenting about using the resources in a better way, so as to fix basic functionality in Solaris, rather than chasing exotic projects like RBAC.

Very interesting.

#5.1.1 UX-admin on 2010-04-28 20:47 (Reply)

Oh .. that's just because i prefer to write new articles over having fruitless discussions with you. You should go and learn about the person who developed this stuff. And perhaps reading the "The mythical man-month" would be a nice lecture

BTW: Did you filed a bug at bugs.opensolaris about your bugs ?

#5.1.1.1 Joerg M. (Homepage) on 2010-04-28 20:56 (Reply)

Dear Joerg, not only have I read "The mythical man-month", I almost know it by heart.

You see, I am one of the engineers he so vividly described. At the time, I did not know what my problem was, but instinctively I felt the pain.

Then I read his book, and realized I had designed one such "second system", and that both the code and the architecture I put forth suffered from the second system effect.

That was the breaking point. From that point on, I swore I would fight complexity at every turn and at every opportunity; so when I see complexity -- a regression -- being shamelessly promoted as "progress", of course I'm going to get upset.

As for the guy who thought this stuff up, you better believe I would love to meet him in person! And you better believe I would have a few words to say to him about his "baby".

Maybe someday I'll get my wish and get to tell him/her what I think about his "invention", and WHY.

Apropos bugs: yes, I filed all of them. I used to file bugs as a matter of course, because I believed that the system works.

Then I'd get an automated e-mail about a change of status; I'd go look, and it would say "need more info - see comments", except that the comment field was disabled, and since there was no address I could contact, and couldn't update the bug, the bug would get closed eventually by an automated process.

So the system, in which I so firmly believed in, turned out to be flawed and busted.

In yet another instance, I've opened an RFE to add clustering capability to ZFS, to scope the work necessary. I can not find that bug any more; it seems to have been deleted. I looked and looked, but as I don't have the CR any more, it turned out to be futile.

So yes, I've logged bugs; and yes, I've opened RFEs.

#5.1.1.1.1 UX-admin on 2010-04-28 21:19 (Reply)

To cite you: "As for the guy who thought this stuff up, you better believe I would love to meet him in person! And you better believe I would have a few words to say to him about his "baby""

What's really interesting, that you don't want to ask him about his "baby" and why he did it the other way and not the one preferred by you. It just looks the way, that you just want to tell the world your opinion but you aren't willing to really discuss it ...

PS: Pass me a bug id ... i will look up why you aren't able to to see the comments ...

#5.1.1.1.1.1 Joerg M. (Homepage) on 2010-04-28 21:27 (Reply)

C.D.?

Now that's a stab in the heart, because I do hold him in high regard.

As far as I know though, he is not the father of RBAC. And that's the guy I want to have a chat with.

If I can find the CR ID, I'll be glad to pass it to you. It's been closed long since though. All of them, not just one.

#6 UX-admin on 2010-04-28 21:33 (Reply)

I thought, you thought about the implementation in Solaris, not about RBAC in general.

Nevertheless I don't think that you understood my comment. Perhaps i expressed it wrong.To express it simpler: Why do you just want to tell C.D. what you think about it, but not mention to ask C.D. what he thought, when he implemented it that way. That was my point. And that what i call discussion. Not just "i will tell him a word or two".

Regarding the CR: Nevertheless interesting, just want to check it, to prevent future problems. You can file bugs about the bug filing system

#6.1 Joerg M. (Homepage) on 2010-04-28 21:39 (Reply)

Here is one, opened by yours truly:

http://bugs.opensolaris.org/bugdatabase/view_bug.do?bug_id=6859418

#7 UX-admin on 2010-04-28 22:15 (Reply)

From the internal bug system: "There are countless Solaris users (myself included) who do this every day using the latest builds without issue; we're going to need something more to go on tha n what's in the Description. As a starting point, starting dhcpagent by hand wi th /sbin/dhcpagent -d1 -f -v& ... and attempting to acquire a lease with if config, then sending us the logs would be a good first step. Also, the packet e xchange with snoop and a gcore(1) of dhcpagent once it gets into this state woul d also be helpful. Marking "incomplete" until we have some way to proceed. "

Send it to me and i will pass it to the responsible engineer ...

#7.1 Joerg Moellenkamp (Homepage) on 2010-05-04 14:42 (Reply)

Here's another one:

http://bugs.opensolaris.org/bugdatabase/view_bug.do?bug_id=6768836

#8 UX-admin on 2010-04-28 22:23 (Reply)

Add Comment

Name
Email
Homepage
In reply to
Comment	E-Mail addresses will not be displayed and will only be used for E-Mail notifications. To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly. Enter the string from the spam-prevention image above: Standard emoticons like :-) and ;-) are converted to images. Enclosing asterisks marks text as bold (word), underscore are made via _word_.
	Remember Information? Subscribe to this entry