| blob | 6cbf5277fb084e073d135485449866a1958a0bf8 |
1 '\" te
2 .\" Copyright (c) 2009, Sun Microsystems, Inc. All Rights Reserved.
3 .\" Copyright 2013, Joyent, Inc. All Rights Reserved.
4 .\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License"). You may not use this file except in compliance with the License. You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing.
5 .\" See the License for the specific language governing permissions and limitations under the License. When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE. If applicable, add the following below this CDDL HEADER, with
6 .\" the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
7 .TH PRIVILEGES 5 "May 29, 2009"
8 .SH NAME
9 privileges \- process privilege model
10 .SH DESCRIPTION
11 .sp
12 .LP
13 Solaris software implements a set of privileges that provide fine-grained
14 control over the actions of processes. The possession of a certain privilege
15 allows a process to perform a specific set of restricted operations.
16 .sp
17 .LP
18 The change to a primarily privilege-based security model in the Solaris
19 operating system gives developers an opportunity to restrict processes to those
20 privileged operations actually needed instead of all (super-user) or no
21 privileges (non-zero UIDs). Additionally, a set of previously unrestricted
22 operations now requires a privilege; these privileges are dubbed the "basic"
23 privileges and are by default given to all processes.
24 .sp
25 .LP
26 Taken together, all defined privileges with the exception of the "basic"
27 privileges compose the set of privileges that are traditionally associated with
28 the root user. The "basic" privileges are "privileges" unprivileged processes
29 were accustomed to having.
30 .sp
31 .LP
32 The defined privileges are:
33 .sp
34 .ne 2
35 .na
36 \fB\fBPRIV_CONTRACT_EVENT\fR\fR
37 .ad
38 .sp .6
39 .RS 4n
40 Allow a process to request reliable delivery of events to an event endpoint.
41 .sp
42 Allow a process to include events in the critical event set term of a template
43 which could be generated in volume by the user.
44 .RE
46 .sp
47 .ne 2
48 .na
49 \fB\fBPRIV_CONTRACT_IDENTITY\fR\fR
50 .ad
51 .sp .6
52 .RS 4n
53 Allows a process to set the service FMRI value of a process contract template.
54 .RE
56 .sp
57 .ne 2
58 .na
59 \fB\fBPRIV_CONTRACT_OBSERVER\fR\fR
60 .ad
61 .sp .6
62 .RS 4n
63 Allow a process to observe contract events generated by contracts created and
64 owned by users other than the process's effective user ID.
65 .sp
66 Allow a process to open contract event endpoints belonging to contracts created
67 and owned by users other than the process's effective user ID.
68 .RE
70 .sp
71 .ne 2
72 .na
73 \fB\fBPRIV_CPC_CPU\fR\fR
74 .ad
75 .sp .6
76 .RS 4n
77 Allow a process to access per-CPU hardware performance counters.
78 .RE
80 .sp
81 .ne 2
82 .na
83 \fB\fBPRIV_DTRACE_KERNEL\fR\fR
84 .ad
85 .sp .6
86 .RS 4n
87 Allow DTrace kernel-level tracing.
88 .RE
90 .sp
91 .ne 2
92 .na
93 \fB\fBPRIV_DTRACE_PROC\fR\fR
94 .ad
95 .sp .6
96 .RS 4n
97 Allow DTrace process-level tracing. Allow process-level tracing probes to be
98 placed and enabled in processes to which the user has permissions.
99 .RE
101 .sp
102 .ne 2
103 .na
104 \fB\fBPRIV_DTRACE_USER\fR\fR
105 .ad
106 .sp .6
107 .RS 4n
108 Allow DTrace user-level tracing. Allow use of the syscall and profile DTrace
109 providers to examine processes to which the user has permissions.
110 .RE
112 .sp
113 .ne 2
114 .na
115 \fB\fBPRIV_FILE_CHOWN\fR\fR
116 .ad
117 .sp .6
118 .RS 4n
119 Allow a process to change a file's owner user ID. Allow a process to change a
120 file's group ID to one other than the process's effective group ID or one of
121 the process's supplemental group IDs.
122 .RE
124 .sp
125 .ne 2
126 .na
127 \fB\fBPRIV_FILE_CHOWN_SELF\fR\fR
128 .ad
129 .sp .6
130 .RS 4n
131 Allow a process to give away its files. A process with this privilege runs as
132 if {\fB_POSIX_CHOWN_RESTRICTED\fR} is not in effect.
133 .RE
135 .sp
136 .ne 2
137 .na
138 \fB\fBPRIV_FILE_DAC_EXECUTE\fR\fR
139 .ad
140 .sp .6
141 .RS 4n
142 Allow a process to execute an executable file whose permission bits or ACL
143 would otherwise disallow the process execute permission.
144 .RE
146 .sp
147 .ne 2
148 .na
149 \fB\fBPRIV_FILE_DAC_READ\fR\fR
150 .ad
151 .sp .6
152 .RS 4n
153 Allow a process to read a file or directory whose permission bits or ACL would
154 otherwise disallow the process read permission.
155 .RE
157 .sp
158 .ne 2
159 .na
160 \fB\fBPRIV_FILE_DAC_SEARCH\fR\fR
161 .ad
162 .sp .6
163 .RS 4n
164 Allow a process to search a directory whose permission bits or ACL would not
165 otherwise allow the process search permission.
166 .RE
168 .sp
169 .ne 2
170 .na
171 \fB\fBPRIV_FILE_DAC_WRITE\fR\fR
172 .ad
173 .sp .6
174 .RS 4n
175 Allow a process to write a file or directory whose permission bits or ACL do
176 not allow the process write permission. All privileges are required to write
177 files owned by UID 0 in the absence of an effective UID of 0.
178 .RE
180 .sp
181 .ne 2
182 .na
183 \fB\fBPRIV_FILE_DOWNGRADE_SL\fR\fR
184 .ad
185 .sp .6
186 .RS 4n
187 Allow a process to set the sensitivity label of a file or directory to a
188 sensitivity label that does not dominate the existing sensitivity label.
189 .sp
190 This privilege is interpreted only if the system is configured with Trusted
191 Extensions.
192 .RE
194 .sp
195 .ne 2
196 .na
197 \fB\fBPRIV_FILE_LINK_ANY\fR\fR
198 .ad
199 .sp .6
200 .RS 4n
201 Allow a process to create hardlinks to files owned by a UID different from the
202 process's effective UID.
203 .RE
205 .sp
206 .ne 2
207 .na
208 \fB\fBPRIV_FILE_OWNER\fR\fR
209 .ad
210 .sp .6
211 .RS 4n
212 Allow a process that is not the owner of a file to modify that file's access
213 and modification times. Allow a process that is not the owner of a directory to
214 modify that directory's access and modification times. Allow a process that is
215 not the owner of a file or directory to remove or rename a file or directory
216 whose parent directory has the "save text image after execution" (sticky) bit
217 set. Allow a process that is not the owner of a file to mount a \fBnamefs\fR
218 upon that file. Allow a process that is not the owner of a file or directory to
219 modify that file's or directory's permission bits or ACL.
220 .RE
222 .sp
223 .ne 2
224 .na
225 \fB\fBPRIV_FILE_SETID\fR\fR
226 .ad
227 .sp .6
228 .RS 4n
229 Allow a process to change the ownership of a file or write to a file without
230 the set-user-ID and set-group-ID bits being cleared. Allow a process to set the
231 set-group-ID bit on a file or directory whose group is not the process's
232 effective group or one of the process's supplemental groups. Allow a process to
233 set the set-user-ID bit on a file with different ownership in the presence of
234 \fBPRIV_FILE_OWNER\fR. Additional restrictions apply when creating or modifying
235 a setuid 0 file.
236 .RE
238 .sp
239 .ne 2
240 .na
241 \fB\fBPRIV_FILE_UPGRADE_SL\fR\fR
242 .ad
243 .sp .6
244 .RS 4n
245 Allow a process to set the sensitivity label of a file or directory to a
246 sensitivity label that dominates the existing sensitivity label.
247 .sp
248 This privilege is interpreted only if the system is configured with Trusted
249 Extensions.
250 .RE
252 .sp
253 .ne 2
254 .na
255 \fB\fBPRIV_FILE_FLAG_SET\fR\fR
256 .ad
257 .sp .6
258 .RS 4n
259 Allows a process to set immutable, nounlink or appendonly file attributes.
260 .RE
262 .sp
263 .ne 2
264 .na
265 \fB\fBPRIV_GRAPHICS_ACCESS\fR\fR
266 .ad
267 .sp .6
268 .RS 4n
269 Allow a process to make privileged ioctls to graphics devices. Typically only
270 an xserver process needs to have this privilege. A process with this privilege
271 is also allowed to perform privileged graphics device mappings.
272 .RE
274 .sp
275 .ne 2
276 .na
277 \fB\fBPRIV_GRAPHICS_MAP\fR\fR
278 .ad
279 .sp .6
280 .RS 4n
281 Allow a process to perform privileged mappings through a graphics device.
282 .RE
284 .sp
285 .ne 2
286 .na
287 \fB\fBPRIV_IPC_DAC_READ\fR\fR
288 .ad
289 .sp .6
290 .RS 4n
291 Allow a process to read a System V IPC Message Queue, Semaphore Set, or Shared
292 Memory Segment whose permission bits would not otherwise allow the process read
293 permission.
294 .RE
296 .sp
297 .ne 2
298 .na
299 \fB\fBPRIV_IPC_DAC_WRITE\fR\fR
300 .ad
301 .sp .6
302 .RS 4n
303 Allow a process to write a System V IPC Message Queue, Semaphore Set, or Shared
304 Memory Segment whose permission bits would not otherwise allow the process
305 write permission.
306 .RE
308 .sp
309 .ne 2
310 .na
311 \fB\fBPRIV_IPC_OWNER\fR\fR
312 .ad
313 .sp .6
314 .RS 4n
315 Allow a process that is not the owner of a System V IPC Message Queue,
316 Semaphore Set, or Shared Memory Segment to remove, change ownership of, or
317 change permission bits of the Message Queue, Semaphore Set, or Shared Memory
318 Segment.
319 .RE
321 .sp
322 .ne 2
323 .na
324 \fB\fBPRIV_NET_BINDMLP\fR\fR
325 .ad
326 .sp .6
327 .RS 4n
328 Allow a process to bind to a port that is configured as a multi-level port
329 (MLP) for the process's zone. This privilege applies to both shared address and
330 zone-specific address MLPs. See \fBtnzonecfg\fR(\fB4\fR) from the Trusted
331 Extensions manual pages for information on configuring MLP ports.
332 .sp
333 This privilege is interpreted only if the system is configured with Trusted
334 Extensions.
335 .RE
337 .sp
338 .ne 2
339 .na
340 \fB\fBPRIV_NET_ICMPACCESS\fR\fR
341 .ad
342 .sp .6
343 .RS 4n
344 Allow a process to send and receive ICMP packets.
345 .RE
347 .sp
348 .ne 2
349 .na
350 \fB\fBPRIV_NET_MAC_AWARE\fR\fR
351 .ad
352 .sp .6
353 .RS 4n
354 Allow a process to set the \fBNET_MAC_AWARE\fR process flag by using
355 \fBsetpflags\fR(2). This privilege also allows a process to set the
356 \fBSO_MAC_EXEMPT\fR socket option by using \fBsetsockopt\fR(3SOCKET). The
357 \fBNET_MAC_AWARE\fR process flag and the \fBSO_MAC_EXEMPT\fR socket option both
358 allow a local process to communicate with an unlabeled peer if the local
359 process's label dominates the peer's default label, or if the local process
360 runs in the global zone.
361 .sp
362 This privilege is interpreted only if the system is configured with Trusted
363 Extensions.
364 .RE
366 .sp
367 .ne 2
368 .na
369 \fB\fBPRIV_NET_OBSERVABILITY\fR\fR
370 .ad
371 .sp .6
372 .RS 4n
373 Allow a process to open a device for just receiving network traffic, sending
374 traffic is disallowed.
375 .RE
377 .sp
378 .ne 2
379 .na
380 \fB\fBPRIV_NET_PRIVADDR\fR\fR
381 .ad
382 .sp .6
383 .RS 4n
384 Allow a process to bind to a privileged port number. The privilege port numbers
385 are 1-1023 (the traditional UNIX privileged ports) as well as those ports
386 marked as "\fBudp/tcp_extra_priv_ports\fR" with the exception of the ports
387 reserved for use by NFS and SMB.
388 .RE
390 .sp
391 .ne 2
392 .na
393 \fB\fBPRIV_NET_RAWACCESS\fR\fR
394 .ad
395 .sp .6
396 .RS 4n
397 Allow a process to have direct access to the network layer.
398 .RE
400 .sp
401 .ne 2
402 .na
403 \fB\fBPRIV_PROC_AUDIT\fR\fR
404 .ad
405 .sp .6
406 .RS 4n
407 Allow a process to generate audit records. Allow a process to get its own audit
408 pre-selection information.
409 .RE
411 .sp
412 .ne 2
413 .na
414 \fB\fBPRIV_PROC_CHROOT\fR\fR
415 .ad
416 .sp .6
417 .RS 4n
418 Allow a process to change its root directory.
419 .RE
421 .sp
422 .ne 2
423 .na
424 \fB\fBPRIV_PROC_CLOCK_HIGHRES\fR\fR
425 .ad
426 .sp .6
427 .RS 4n
428 Allow a process to use high resolution timers.
429 .RE
431 .sp
432 .ne 2
433 .na
434 \fB\fBPRIV_PROC_EXEC\fR\fR
435 .ad
436 .sp .6
437 .RS 4n
438 Allow a process to call \fBexec\fR(2).
439 .RE
441 .sp
442 .ne 2
443 .na
444 \fB\fBPRIV_PROC_FORK\fR\fR
445 .ad
446 .sp .6
447 .RS 4n
448 Allow a process to call \fBfork\fR(2), \fBfork1\fR(2), or \fBvfork\fR(2).
449 .RE
451 .sp
452 .ne 2
453 .na
454 \fB\fBPRIV_PROC_INFO\fR\fR
455 .ad
456 .sp .6
457 .RS 4n
458 Allow a process to examine the status of processes other than those to which it
459 can send signals. Processes that cannot be examined cannot be seen in
460 \fB/proc\fR and appear not to exist.
461 .RE
463 .sp
464 .ne 2
465 .na
466 \fB\fBPRIV_PROC_LOCK_MEMORY\fR\fR
467 .ad
468 .sp .6
469 .RS 4n
470 Allow a process to lock pages in physical memory.
471 .RE
473 .sp
474 .ne 2
475 .na
476 \fB\fBPRIV_PROC_OWNER\fR\fR
477 .ad
478 .sp .6
479 .RS 4n
480 Allow a process to send signals to other processes and inspect and modify the
481 process state in other processes, regardless of ownership. When modifying
482 another process, additional restrictions apply: the effective privilege set of
483 the attaching process must be a superset of the target process's effective,
484 permitted, and inheritable sets; the limit set must be a superset of the
485 target's limit set; if the target process has any UID set to 0 all privilege
486 must be asserted unless the effective UID is 0. Allow a process to bind
487 arbitrary processes to CPUs.
488 .RE
490 .sp
491 .ne 2
492 .na
493 \fB\fBPRIV_PROC_PRIOUP\fR\fR
494 .ad
495 .sp .6
496 .RS 4n
497 Allow a process to elevate its priority above its current level.
498 .RE
500 .sp
501 .ne 2
502 .na
503 \fB\fBPRIV_PROC_PRIOCNTL\fR\fR
504 .ad
505 .sp .6
506 .RS 4n
507 Allows all that PRIV_PROC_PRIOUP allows.
508 Allow a process to change its scheduling class to any scheduling class,
509 including the RT class.
510 .RE
512 .sp
513 .ne 2
514 .na
515 \fB\fBPRIV_PROC_SESSION\fR\fR
516 .ad
517 .sp .6
518 .RS 4n
519 Allow a process to send signals or trace processes outside its session.
520 .RE
522 .sp
523 .ne 2
524 .na
525 \fB\fBPRIV_PROC_SETID\fR\fR
526 .ad
527 .sp .6
528 .RS 4n
529 Allow a process to set its UIDs at will, assuming UID 0 requires all privileges
530 to be asserted.
531 .RE
533 .sp
534 .ne 2
535 .na
536 \fB\fBPRIV_PROC_TASKID\fR\fR
537 .ad
538 .sp .6
539 .RS 4n
540 Allow a process to assign a new task ID to the calling process.
541 .RE
543 .sp
544 .ne 2
545 .na
546 \fB\fBPRIV_PROC_ZONE\fR\fR
547 .ad
548 .sp .6
549 .RS 4n
550 Allow a process to trace or send signals to processes in other zones. See
551 \fBzones\fR(5).
552 .RE
554 .sp
555 .ne 2
556 .na
557 \fB\fBPRIV_SYS_ACCT\fR\fR
558 .ad
559 .sp .6
560 .RS 4n
561 Allow a process to enable and disable and manage accounting through
562 \fBacct\fR(2).
563 .RE
565 .sp
566 .ne 2
567 .na
568 \fB\fBPRIV_SYS_ADMIN\fR\fR
569 .ad
570 .sp .6
571 .RS 4n
572 Allow a process to perform system administration tasks such as setting node and
573 domain name and specifying \fBcoreadm\fR(1M) and \fBnscd\fR(1M) settings
574 .RE
576 .sp
577 .ne 2
578 .na
579 \fB\fBPRIV_SYS_AUDIT\fR\fR
580 .ad
581 .sp .6
582 .RS 4n
583 Allow a process to start the (kernel) audit daemon. Allow a process to view and
584 set audit state (audit user ID, audit terminal ID, audit sessions ID, audit
585 pre-selection mask). Allow a process to turn off and on auditing. Allow a
586 process to configure the audit parameters (cache and queue sizes, event to
587 class mappings, and policy options).
588 .RE
590 .sp
591 .ne 2
592 .na
593 \fB\fBPRIV_SYS_CONFIG\fR\fR
594 .ad
595 .sp .6
596 .RS 4n
597 Allow a process to perform various system configuration tasks. Allow
598 filesystem-specific administrative procedures, such as filesystem configuration
599 ioctls, quota calls, creation and deletion of snapshots, and manipulating the
600 PCFS bootsector.
601 .RE
603 .sp
604 .ne 2
605 .na
606 \fB\fBPRIV_SYS_DEVICES\fR\fR
607 .ad
608 .sp .6
609 .RS 4n
610 Allow a process to create device special files. Allow a process to successfully
611 call a kernel module that calls the kernel \fBdrv_priv\fR(9F) function to check
612 for allowed access. Allow a process to open the real console device directly.
613 Allow a process to open devices that have been exclusively opened.
614 .RE
616 .sp
617 .ne 2
618 .na
619 \fB\fBPRIV_SYS_DL_CONFIG\fR\fR
620 .ad
621 .sp .6
622 .RS 4n
623 Allow a process to configure a system's datalink interfaces.
624 .RE
626 .sp
627 .ne 2
628 .na
629 \fB\fBPRIV_SYS_IP_CONFIG\fR\fR
630 .ad
631 .sp .6
632 .RS 4n
633 Allow a process to configure a system's IP interfaces and routes. Allow a
634 process to configure network parameters for \fBTCP/IP\fR using \fBndd\fR. Allow
635 a process access to otherwise restricted \fBTCP/IP\fR information using
636 \fBndd\fR. Allow a process to configure \fBIPsec\fR. Allow a process to pop
637 anchored \fBSTREAM\fRs modules with matching \fBzoneid\fR.
638 .RE
640 .sp
641 .ne 2
642 .na
643 \fB\fBPRIV_SYS_IPC_CONFIG\fR\fR
644 .ad
645 .sp .6
646 .RS 4n
647 Allow a process to increase the size of a System V IPC Message Queue buffer.
648 .RE
650 .sp
651 .ne 2
652 .na
653 \fB\fBPRIV_SYS_LINKDIR\fR\fR
654 .ad
655 .sp .6
656 .RS 4n
657 Allow a process to unlink and link directories.
658 .RE
660 .sp
661 .ne 2
662 .na
663 \fB\fBPRIV_SYS_MOUNT\fR\fR
664 .ad
665 .sp .6
666 .RS 4n
667 Allow a process to mount and unmount filesystems that would otherwise be
668 restricted (that is, most filesystems except \fBnamefs\fR). Allow a process to
669 add and remove swap devices.
670 .RE
672 .sp
673 .ne 2
674 .na
675 \fB\fBPRIV_SYS_NET_CONFIG\fR\fR
676 .ad
677 .sp .6
678 .RS 4n
679 Allow a process to do all that \fBPRIV_SYS_IP_CONFIG\fR,
680 \fBPRIV_SYS_DL_CONFIG\fR, and \fBPRIV_SYS_PPP_CONFIG\fR allow, plus the
681 following: use the \fBrpcmod\fR STREAMS module and insert/remove STREAMS
682 modules on locations other than the top of the module stack.
683 .RE
685 .sp
686 .ne 2
687 .na
688 \fB\fBPRIV_SYS_NFS\fR\fR
689 .ad
690 .sp .6
691 .RS 4n
692 Allow a process to provide NFS service: start NFS kernel threads, perform NFS
693 locking operations, bind to NFS reserved ports: ports 2049 (\fBnfs\fR) and port
694 4045 (\fBlockd\fR).
695 .RE
697 .sp
698 .ne 2
699 .na
700 \fB\fBPRIV_SYS_PPP_CONFIG\fR\fR
701 .ad
702 .sp .6
703 .RS 4n
704 Allow a process to create, configure, and destroy PPP instances with pppd(1M)
705 \fBpppd\fR(1M) and control PPPoE plumbing with \fBsppptun\fR(1M)sppptun(1M).
706 This privilege is granted by default to exclusive IP stack instance zones.
707 .RE
709 .sp
710 .ne 2
711 .na
712 \fB\fBPRIV_SYS_RES_BIND\fR\fR
713 .ad
714 .sp .6
715 .RS 4n
716 Allows a process to bind processes to processor sets.
717 .RE
719 .sp
720 .ne 2
721 .na
722 \fB\fBPRIV_SYS_RES_CONFIG\fR\fR
723 .ad
724 .sp .6
725 .RS 4n
726 Allows all that PRIV_SYS_RES_BIND allows.
727 Allow a process to create and delete processor sets, assign CPUs to processor
728 sets and override the \fBPSET_NOESCAPE\fR property. Allow a process to change
729 the operational status of CPUs in the system using \fBp_online\fR(2). Allow a
730 process to configure filesystem quotas. Allow a process to configure resource
731 pools and bind processes to pools.
732 .RE
734 .sp
735 .ne 2
736 .na
737 \fB\fBPRIV_SYS_RESOURCE\fR\fR
738 .ad
739 .sp .6
740 .RS 4n
741 Allow a process to exceed the resource limits imposed on it by
742 \fBsetrlimit\fR(2) and \fBsetrctl\fR(2).
743 .RE
745 .sp
746 .ne 2
747 .na
748 \fB\fBPRIV_SYS_SMB\fR\fR
749 .ad
750 .sp .6
751 .RS 4n
752 Allow a process to provide NetBIOS or SMB services: start SMB kernel threads or
753 bind to NetBIOS or SMB reserved ports: ports 137, 138, 139 (NetBIOS) and 445
754 (SMB).
755 .RE
757 .sp
758 .ne 2
759 .na
760 \fB\fBPRIV_SYS_SUSER_COMPAT\fR\fR
761 .ad
762 .sp .6
763 .RS 4n
764 Allow a process to successfully call a third party loadable module that calls
765 the kernel \fBsuser()\fR function to check for allowed access. This privilege
766 exists only for third party loadable module compatibility and is not used by
767 Solaris proper.
768 .RE
770 .sp
771 .ne 2
772 .na
773 \fB\fBPRIV_SYS_TIME\fR\fR
774 .ad
775 .sp .6
776 .RS 4n
777 Allow a process to manipulate system time using any of the appropriate system
778 calls: \fBstime\fR(2), \fBadjtime\fR(2), and \fBntp_adjtime\fR(2).
779 .RE
781 .sp
782 .ne 2
783 .na
784 \fB\fBPRIV_SYS_TRANS_LABEL\fR\fR
785 .ad
786 .sp .6
787 .RS 4n
788 Allow a process to translate labels that are not dominated by the process's
789 sensitivity label to and from an external string form.
790 .sp
791 This privilege is interpreted only if the system is configured with Trusted
792 Extensions.
793 .RE
795 .sp
796 .ne 2
797 .na
798 \fB\fBPRIV_VIRT_MANAGE\fR\fR
799 .ad
800 .sp .6
801 .RS 4n
802 Allows a process to manage virtualized environments such as \fBxVM\fR(5).
803 .RE
805 .sp
806 .ne 2
807 .na
808 \fB\fBPRIV_WIN_COLORMAP\fR\fR
809 .ad
810 .sp .6
811 .RS 4n
812 Allow a process to override colormap restrictions.
813 .sp
814 Allow a process to install or remove colormaps.
815 .sp
816 Allow a process to retrieve colormap cell entries allocated by other processes.
817 .sp
818 This privilege is interpreted only if the system is configured with Trusted
819 Extensions.
820 .RE
822 .sp
823 .ne 2
824 .na
825 \fB\fBPRIV_WIN_CONFIG\fR\fR
826 .ad
827 .sp .6
828 .RS 4n
829 Allow a process to configure or destroy resources that are permanently retained
830 by the X server.
831 .sp
832 Allow a process to use SetScreenSaver to set the screen saver timeout value
833 .sp
834 Allow a process to use ChangeHosts to modify the display access control list.
835 .sp
836 Allow a process to use GrabServer.
837 .sp
838 Allow a process to use the SetCloseDownMode request that can retain window,
839 pixmap, colormap, property, cursor, font, or graphic context resources.
840 .sp
841 This privilege is interpreted only if the system is configured with Trusted
842 Extensions.
843 .RE
845 .sp
846 .ne 2
847 .na
848 \fB\fBPRIV_WIN_DAC_READ\fR\fR
849 .ad
850 .sp .6
851 .RS 4n
852 Allow a process to read from a window resource that it does not own (has a
853 different user ID).
854 .sp
855 This privilege is interpreted only if the system is configured with Trusted
856 Extensions.
857 .RE
859 .sp
860 .ne 2
861 .na
862 \fB\fBPRIV_WIN_DAC_WRITE\fR\fR
863 .ad
864 .sp .6
865 .RS 4n
866 Allow a process to write to or create a window resource that it does not own
867 (has a different user ID). A newly created window property is created with the
868 window's user ID.
869 .sp
870 This privilege is interpreted only if the system is configured with Trusted
871 Extensions.
872 .RE
874 .sp
875 .ne 2
876 .na
877 \fB\fBPRIV_WIN_DEVICES\fR\fR
878 .ad
879 .sp .6
880 .RS 4n
881 Allow a process to perform operations on window input devices.
882 .sp
883 Allow a process to get and set keyboard and pointer controls.
884 .sp
885 Allow a process to modify pointer button and key mappings.
886 .sp
887 This privilege is interpreted only if the system is configured with Trusted
888 Extensions.
889 .RE
891 .sp
892 .ne 2
893 .na
894 \fB\fBPRIV_WIN_DGA\fR\fR
895 .ad
896 .sp .6
897 .RS 4n
898 Allow a process to use the direct graphics access (DGA) X protocol extensions.
899 Direct process access to the frame buffer is still required. Thus the process
900 must have MAC and DAC privileges that allow access to the frame buffer, or the
901 frame buffer must be allocated to the process.
902 .sp
903 This privilege is interpreted only if the system is configured with Trusted
904 Extensions.
905 .RE
907 .sp
908 .ne 2
909 .na
910 \fB\fBPRIV_WIN_DOWNGRADE_SL\fR\fR
911 .ad
912 .sp .6
913 .RS 4n
914 Allow a process to set the sensitivity label of a window resource to a
915 sensitivity label that does not dominate the existing sensitivity label.
916 .sp
917 This privilege is interpreted only if the system is configured with Trusted
918 Extensions.
919 .RE
921 .sp
922 .ne 2
923 .na
924 \fB\fBPRIV_WIN_FONTPATH\fR\fR
925 .ad
926 .sp .6
927 .RS 4n
928 Allow a process to set a font path.
929 .sp
930 This privilege is interpreted only if the system is configured with Trusted
931 Extensions.
932 .RE
934 .sp
935 .ne 2
936 .na
937 \fB\fBPRIV_WIN_MAC_READ\fR\fR
938 .ad
939 .sp .6
940 .RS 4n
941 Allow a process to read from a window resource whose sensitivity label is not
942 equal to the process sensitivity label.
943 .sp
944 This privilege is interpreted only if the system is configured with Trusted
945 Extensions.
946 .RE
948 .sp
949 .ne 2
950 .na
951 \fB\fBPRIV_WIN_MAC_WRITE\fR\fR
952 .ad
953 .sp .6
954 .RS 4n
955 Allow a process to create a window resource whose sensitivity label is not
956 equal to the process sensitivity label. A newly created window property is
957 created with the window's sensitivity label.
958 .sp
959 This privilege is interpreted only if the system is configured with Trusted
960 Extensions.
961 .RE
963 .sp
964 .ne 2
965 .na
966 \fB\fBPRIV_WIN_SELECTION\fR\fR
967 .ad
968 .sp .6
969 .RS 4n
970 Allow a process to request inter-window data moves without the intervention of
971 the selection confirmer.
972 .sp
973 This privilege is interpreted only if the system is configured with Trusted
974 Extensions.
975 .RE
977 .sp
978 .ne 2
979 .na
980 \fB\fBPRIV_WIN_UPGRADE_SL\fR\fR
981 .ad
982 .sp .6
983 .RS 4n
984 Allow a process to set the sensitivity label of a window resource to a
985 sensitivity label that dominates the existing sensitivity label.
986 .sp
987 This privilege is interpreted only if the system is configured with Trusted
988 Extensions.
989 .RE
991 .sp
992 .ne 2
993 .na
994 \fB\fBPRIV_XVM_CONTROL\fR\fR
995 .ad
996 .sp .6
997 .RS 4n
998 Allows a process access to the \fBxVM\fR(5) control devices for managing guest
999 domains and the hypervisor. This privilege is used only if booted into xVM on
1000 x86 platforms.
1001 .RE
1003 .sp
1004 .LP
1005 Of the privileges listed above, the privileges \fBPRIV_FILE_LINK_ANY\fR,
1006 \fBPRIV_PROC_INFO\fR, \fBPRIV_PROC_SESSION\fR, \fBPRIV_PROC_FORK\fR and
1007 \fBPRIV_PROC_EXEC\fR are considered "basic" privileges. These are privileges
1008 that used to be always available to unprivileged processes. By default,
1009 processes still have the basic privileges.
1010 .sp
1011 .LP
1012 The privileges \fBPRIV_PROC_SETID\fR and \fBPRIV_PROC_AUDIT\fR must be present
1013 in the Limit set (see below) of a process in order for set-uid root \fBexec\fRs
1014 to be successful, that is, get an effective UID of 0 and additional privileges.
1015 .sp
1016 .LP
1017 The privilege implementation in Solaris extends the process credential with
1018 four privilege sets:
1019 .sp
1020 .ne 2
1021 .na
1022 \fBI, the inheritable set\fR
1023 .ad
1024 .RS 26n
1025 The privileges inherited on \fBexec\fR.
1026 .RE
1028 .sp
1029 .ne 2
1030 .na
1031 \fBP, the permitted set\fR
1032 .ad
1033 .RS 26n
1034 The maximum set of privileges for the process.
1035 .RE
1037 .sp
1038 .ne 2
1039 .na
1040 \fBE, the effective set\fR
1041 .ad
1042 .RS 26n
1043 The privileges currently in effect.
1044 .RE
1046 .sp
1047 .ne 2
1048 .na
1049 \fBL, the limit set\fR
1050 .ad
1051 .RS 26n
1052 The upper bound of the privileges a process and its offspring can obtain.
1053 Changes to L take effect on the next \fBexec\fR.
1054 .RE
1056 .sp
1057 .LP
1058 The sets I, P and E are typically identical to the basic set of privileges for
1059 unprivileged processes. The limit set is typically the full set of privileges.
1060 .sp
1061 .LP
1062 Each process has a Privilege Awareness State (PAS) that can take the value PA
1063 (privilege-aware) and NPA (not-PA). PAS is a transitional mechanism that allows
1064 a choice between full compatibility with the old superuser model and completely
1065 ignoring the effective UID.
1066 .sp
1067 .LP
1068 To facilitate the discussion, we introduce the notion of "observed effective
1069 set" (oE) and "observed permitted set" (oP) and the implementation sets iE and
1070 iP.
1071 .sp
1072 .LP
1073 A process becomes privilege-aware either by manipulating the effective,
1074 permitted, or limit privilege sets through \fBsetppriv\fR(2) or by using
1075 \fBsetpflags\fR(2). In all cases, oE and oP are invariant in the process of
1076 becoming privilege-aware. In the process of becoming privilege-aware, the
1077 following assignments take place:
1078 .sp
1079 .in +2
1080 .nf
1081 iE = oE
1082 iP = oP
1083 .fi
1084 .in -2
1086 .sp
1087 .LP
1088 When a process is privilege-aware, oE and oP are invariant under UID changes.
1089 When a process is not privilege-aware, oE and oP are observed as follows:
1090 .sp
1091 .in +2
1092 .nf
1093 oE = euid == 0 ? L : iE
1094 oP = (euid == 0 || ruid == 0 || suid == 0) ? L : iP
1095 .fi
1096 .in -2
1098 .sp
1099 .LP
1100 When a non-privilege-aware process has an effective UID of 0, it can exercise
1101 the privileges contained in its limit set, the upper bound of its privileges.
1102 If a non-privilege-aware process has any of the UIDs 0, it appears to be
1103 capable of potentially exercising all privileges in L.
1104 .sp
1105 .LP
1106 It is possible for a process to return to the non-privilege aware state using
1107 \fBsetpflags()\fR. The kernel always attempts this on \fBexec\fR(2). This
1108 operation is permitted only if the following conditions are met:
1109 .RS +4
1110 .TP
1111 .ie t \(bu
1112 .el o
1113 If any of the UIDs is equal to 0, P must be equal to L.
1114 .RE
1115 .RS +4
1116 .TP
1117 .ie t \(bu
1118 .el o
1119 If the effective UID is equal to 0, E must be equal to L.
1120 .RE
1121 .sp
1122 .LP
1123 When a process gives up privilege awareness, the following assignments take
1124 place:
1125 .sp
1126 .in +2
1127 .nf
1128 if (euid == 0) iE = L & I
1129 if (any uid == 0) iP = L & I
1130 .fi
1131 .in -2
1133 .sp
1134 .LP
1135 The privileges obtained when not having a UID of \fB0\fR are the inheritable
1136 set of the process restricted by the limit set.
1137 .sp
1138 .LP
1139 Only privileges in the process's (observed) effective privilege set allow the
1140 process to perform restricted operations. A process can use any of the
1141 privilege manipulation functions to add or remove privileges from the privilege
1142 sets. Privileges can be removed always. Only privileges found in the permitted
1143 set can be added to the effective and inheritable set. The limit set cannot
1144 grow. The inheritable set can be larger than the permitted set.
1145 .sp
1146 .LP
1147 When a process performs an \fBexec\fR(2), the kernel first tries to relinquish
1148 privilege awareness before making the following privilege set modifications:
1149 .sp
1150 .in +2
1151 .nf
1152 E' = P' = I' = L & I
1153 L is unchanged
1154 .fi
1155 .in -2
1157 .sp
1158 .LP
1159 If a process has not manipulated its privileges, the privilege sets effectively
1160 remain the same, as E, P and I are already identical.
1161 .sp
1162 .LP
1163 The limit set is enforced at \fBexec\fR time.
1164 .sp
1165 .LP
1166 To run a non-privilege-aware application in a backward-compatible manner, a
1167 privilege-aware application should start the non-privilege-aware application
1168 with I=basic.
1169 .sp
1170 .LP
1171 For most privileges, absence of the privilege simply results in a failure. In
1172 some instances, the absense of a privilege can cause system calls to behave
1173 differently. In other instances, the removal of a privilege can force a set-uid
1174 application to seriously malfunction. Privileges of this type are considered
1175 "unsafe". When a process is lacking any of the unsafe privileges from its limit
1176 set, the system does not honor the set-uid bit of set-uid root applications.
1177 The following unsafe privileges have been identified: \fBproc_setid\fR,
1178 \fBsys_resource\fR and \fBproc_audit\fR.
1179 .SS "Privilege Escalation"
1180 .sp
1181 .LP
1182 In certain circumstances, a single privilege could lead to a process gaining
1183 one or more additional privileges that were not explicitly granted to that
1184 process. To prevent such an escalation of privileges, the security policy
1185 requires explicit permission for those additional privileges.
1186 .sp
1187 .LP
1188 Common examples of escalation are those mechanisms that allow modification of
1189 system resources through "raw'' interfaces; for example, changing kernel data
1190 structures through \fB/dev/kmem\fR or changing files through \fB/dev/dsk/*\fR.
1191 Escalation also occurs when a process controls processes with more privileges
1192 than the controlling process. A special case of this is manipulating or
1193 creating objects owned by UID 0 or trying to obtain UID 0 using
1194 \fBsetuid\fR(2). The special treatment of UID 0 is needed because the UID 0
1195 owns all system configuration files and ordinary file protection mechanisms
1196 allow processes with UID 0 to modify the system configuration. With appropriate
1197 file modifications, a given process running with an effective UID of 0 can gain
1198 all privileges.
1199 .sp
1200 .LP
1201 In situations where a process might obtain UID 0, the security policy requires
1202 additional privileges, up to the full set of privileges. Such restrictions
1203 could be relaxed or removed at such time as additional mechanisms for
1204 protection of system files became available. There are no such mechanisms in
1205 the current Solaris release.
1206 .sp
1207 .LP
1208 The use of UID 0 processes should be limited as much as possible. They should
1209 be replaced with programs running under a different UID but with exactly the
1210 privileges they need.
1211 .sp
1212 .LP
1213 Daemons that never need to \fBexec\fR subprocesses should remove the
1214 \fBPRIV_PROC_EXEC\fR privilege from their permitted and limit sets.
1215 .SS "Assigned Privileges and Safeguards"
1216 .sp
1217 .LP
1218 When privileges are assigned to a user, the system administrator could give
1219 that user more powers than intended. The administrator should consider whether
1220 safeguards are needed. For example, if the \fBPRIV_PROC_LOCK_MEMORY\fR
1221 privilege is given to a user, the administrator should consider setting the
1222 \fBproject.max-locked-memory\fR resource control as well, to prevent that user
1223 from locking all memory.
1224 .SS "Privilege Debugging"
1225 .sp
1226 .LP
1227 When a system call fails with a permission error, it is not always immediately
1228 obvious what caused the problem. To debug such a problem, you can use a tool
1229 called \fBprivilege debugging\fR. When privilege debugging is enabled for a
1230 process, the kernel reports missing privileges on the controlling terminal of
1231 the process. (Enable debugging for a process with the \fB-D\fR option of
1232 \fBppriv\fR(1).) Additionally, the administrator can enable system-wide
1233 privilege debugging by setting the \fBsystem\fR(4) variable \fBpriv_debug\fR
1234 using:
1235 .sp
1236 .in +2
1237 .nf
1238 set priv_debug = 1
1239 .fi
1240 .in -2
1242 .sp
1243 .LP
1244 On a running system, you can use \fBmdb\fR(1) to change this variable.
1245 .SS "Privilege Administration"
1246 .sp
1247 .LP
1248 The Solaris Management Console (see \fBsmc\fR(1M)) is the preferred method of
1249 modifying privileges for a command. Use \fBusermod\fR(1M) or \fBsmrole\fR(1M)
1250 to assign privileges to or modify privileges for, respectively, a user or a
1251 role. Use \fBppriv\fR(1) to enumerate the privileges supported on a system and
1252 \fBtruss\fR(1) to determine which privileges a program requires.
1253 .SH SEE ALSO
1254 .sp
1255 .LP
1256 \fBmdb\fR(1), \fBppriv\fR(1), \fBadd_drv\fR(1M), \fBifconfig\fR(1M),
1257 \fBlockd\fR(1M), \fBnfsd\fR(1M), \fBpppd\fR(1M), \fBrem_drv\fR(1M),
1258 \fBsmbd\fR(1M), \fBsppptun\fR(1M), \fBupdate_drv\fR(1M), \fBIntro\fR(2),
1259 \fBaccess\fR(2), \fBacct\fR(2), \fBacl\fR(2), \fBadjtime\fR(2), \fBaudit\fR(2),
1260 \fBauditon\fR(2), \fBchmod\fR(2), \fBchown\fR(2), \fBchroot\fR(2),
1261 \fBcreat\fR(2), \fBexec\fR(2), \fBfcntl\fR(2), \fBfork\fR(2),
1262 \fBfpathconf\fR(2), \fBgetacct\fR(2), \fBgetpflags\fR(2), \fBgetppriv\fR(2),
1263 \fBgetsid\fR(2), \fBkill\fR(2), \fBlink\fR(2), \fBmemcntl\fR(2),
1264 \fBmknod\fR(2), \fBmount\fR(2), \fBmsgctl\fR(2), \fBnice\fR(2),
1265 \fBntp_adjtime\fR(2), \fBopen\fR(2), \fBp_online\fR(2), \fBpriocntl\fR(2),
1266 \fBpriocntlset\fR(2), \fBprocessor_bind\fR(2), \fBpset_bind\fR(2),
1267 \fBpset_create\fR(2), \fBreadlink\fR(2), \fBresolvepath\fR(2), \fBrmdir\fR(2),
1268 \fBsemctl\fR(2), \fBsetauid\fR(2), \fBsetegid\fR(2), \fBseteuid\fR(2),
1269 \fBsetgid\fR(2), \fBsetgroups\fR(2), \fBsetpflags\fR(2), \fBsetppriv\fR(2),
1270 \fBsetrctl\fR(2), \fBsetregid\fR(2), \fBsetreuid\fR(2), \fBsetrlimit\fR(2),
1271 \fBsettaskid\fR(2), \fBsetuid\fR(2), \fBshmctl\fR(2), \fBshmget\fR(2),
1272 \fBshmop\fR(2), \fBsigsend\fR(2), \fBstat\fR(2), \fBstatvfs\fR(2),
1273 \fBstime\fR(2), \fBswapctl\fR(2), \fBsysinfo\fR(2), \fBuadmin\fR(2),
1274 \fBulimit\fR(2), \fBumount\fR(2), \fBunlink\fR(2), \fButime\fR(2),
1275 \fButimes\fR(2), \fBbind\fR(3SOCKET), \fBdoor_ucred\fR(3C),
1276 \fBpriv_addset\fR(3C), \fBpriv_set\fR(3C), \fBpriv_getbyname\fR(3C),
1277 \fBpriv_getbynum\fR(3C), \fBpriv_set_to_str\fR(3C), \fBpriv_str_to_set\fR(3C),
1278 \fBsocket\fR(3SOCKET), \fBt_bind\fR(3NSL), \fBtimer_create\fR(3C),
1279 \fBucred_get\fR(3C), \fBexec_attr\fR(4), \fBproc\fR(4), \fBsystem\fR(4),
1280 \fBuser_attr\fR(4), \fBxVM\fR(5), \fBddi_cred\fR(9F), \fBdrv_priv\fR(9F),
1281 \fBpriv_getbyname\fR(9F), \fBpriv_policy\fR(9F), \fBpriv_policy_choice\fR(9F),
1282 \fBpriv_policy_only\fR(9F)
1283 .sp
1284 .LP
1285 \fISystem Administration Guide: Security Services\fR