| blob | 1eb7bd75161c0bc974f69086ebb952a6bcf07474 |
1 '\" te
2 .\" Copyright (c) 2009, Sun Microsystems, Inc. All Rights Reserved.
3 .\" Copyright 2015, Joyent, Inc. All Rights Reserved.
4 .\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License"). You may not use this file except in compliance with the License. You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing.
5 .\" See the License for the specific language governing permissions and limitations under the License. When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE. If applicable, add the following below this CDDL HEADER, with
6 .\" the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
7 .TH PRIVILEGES 5 "Feb 28, 2018"
8 .SH NAME
9 privileges \- process privilege model
10 .SH DESCRIPTION
11 .LP
12 Solaris software implements a set of privileges that provide fine-grained
13 control over the actions of processes. The possession of a certain privilege
14 allows a process to perform a specific set of restricted operations.
15 .sp
16 .LP
17 The change to a primarily privilege-based security model in the Solaris
18 operating system gives developers an opportunity to restrict processes to those
19 privileged operations actually needed instead of all (super-user) or no
20 privileges (non-zero UIDs). Additionally, a set of previously unrestricted
21 operations now requires a privilege; these privileges are dubbed the "basic"
22 privileges and are by default given to all processes.
23 .sp
24 .LP
25 Taken together, all defined privileges with the exception of the "basic"
26 privileges compose the set of privileges that are traditionally associated with
27 the root user. The "basic" privileges are "privileges" unprivileged processes
28 were accustomed to having.
29 .sp
30 .LP
31 The defined privileges are:
32 .sp
33 .ne 2
34 .na
35 \fB\fBPRIV_CONTRACT_EVENT\fR\fR
36 .ad
37 .sp .6
38 .RS 4n
39 Allow a process to request reliable delivery of events to an event endpoint.
40 .sp
41 Allow a process to include events in the critical event set term of a template
42 which could be generated in volume by the user.
43 .RE
45 .sp
46 .ne 2
47 .na
48 \fB\fBPRIV_CONTRACT_IDENTITY\fR\fR
49 .ad
50 .sp .6
51 .RS 4n
52 Allows a process to set the service FMRI value of a process contract template.
53 .RE
55 .sp
56 .ne 2
57 .na
58 \fB\fBPRIV_CONTRACT_OBSERVER\fR\fR
59 .ad
60 .sp .6
61 .RS 4n
62 Allow a process to observe contract events generated by contracts created and
63 owned by users other than the process's effective user ID.
64 .sp
65 Allow a process to open contract event endpoints belonging to contracts created
66 and owned by users other than the process's effective user ID.
67 .RE
69 .sp
70 .ne 2
71 .na
72 \fB\fBPRIV_CPC_CPU\fR\fR
73 .ad
74 .sp .6
75 .RS 4n
76 Allow a process to access per-CPU hardware performance counters.
77 .RE
79 .sp
80 .ne 2
81 .na
82 \fB\fBPRIV_DTRACE_KERNEL\fR\fR
83 .ad
84 .sp .6
85 .RS 4n
86 Allow DTrace kernel-level tracing.
87 .RE
89 .sp
90 .ne 2
91 .na
92 \fB\fBPRIV_DTRACE_PROC\fR\fR
93 .ad
94 .sp .6
95 .RS 4n
96 Allow DTrace process-level tracing. Allow process-level tracing probes to be
97 placed and enabled in processes to which the user has permissions.
98 .RE
100 .sp
101 .ne 2
102 .na
103 \fB\fBPRIV_DTRACE_USER\fR\fR
104 .ad
105 .sp .6
106 .RS 4n
107 Allow DTrace user-level tracing. Allow use of the syscall and profile DTrace
108 providers to examine processes to which the user has permissions.
109 .RE
111 .sp
112 .ne 2
113 .na
114 \fB\fBPRIV_FILE_CHOWN\fR\fR
115 .ad
116 .sp .6
117 .RS 4n
118 Allow a process to change a file's owner user ID. Allow a process to change a
119 file's group ID to one other than the process's effective group ID or one of
120 the process's supplemental group IDs.
121 .RE
123 .sp
124 .ne 2
125 .na
126 \fB\fBPRIV_FILE_CHOWN_SELF\fR\fR
127 .ad
128 .sp .6
129 .RS 4n
130 Allow a process to give away its files. A process with this privilege runs as
131 if {\fB_POSIX_CHOWN_RESTRICTED\fR} is not in effect.
132 .RE
134 .sp
135 .ne 2
136 .na
137 \fB\fBPRIV_FILE_DAC_EXECUTE\fR\fR
138 .ad
139 .sp .6
140 .RS 4n
141 Allow a process to execute an executable file whose permission bits or ACL
142 would otherwise disallow the process execute permission.
143 .RE
145 .sp
146 .ne 2
147 .na
148 \fB\fBPRIV_FILE_DAC_READ\fR\fR
149 .ad
150 .sp .6
151 .RS 4n
152 Allow a process to read a file or directory whose permission bits or ACL would
153 otherwise disallow the process read permission.
154 .RE
156 .sp
157 .ne 2
158 .na
159 \fB\fBPRIV_FILE_DAC_SEARCH\fR\fR
160 .ad
161 .sp .6
162 .RS 4n
163 Allow a process to search a directory whose permission bits or ACL would not
164 otherwise allow the process search permission.
165 .RE
167 .sp
168 .ne 2
169 .na
170 \fB\fBPRIV_FILE_DAC_WRITE\fR\fR
171 .ad
172 .sp .6
173 .RS 4n
174 Allow a process to write a file or directory whose permission bits or ACL do
175 not allow the process write permission. All privileges are required to write
176 files owned by UID 0 in the absence of an effective UID of 0.
177 .RE
179 .sp
180 .ne 2
181 .na
182 \fB\fBPRIV_FILE_FLAG_SET\fR\fR
183 .ad
184 .sp .6
185 .RS 4n
186 Allows a process to set immutable, nounlink or appendonly file attributes.
187 .RE
189 .sp
190 .ne 2
191 .na
192 \fB\fBPRIV_FILE_LINK_ANY\fR\fR
193 .ad
194 .sp .6
195 .RS 4n
196 Allow a process to create hardlinks to files owned by a UID different from the
197 process's effective UID.
198 .RE
200 .sp
201 .ne 2
202 .na
203 \fB\fBPRIV_FILE_OWNER\fR\fR
204 .ad
205 .sp .6
206 .RS 4n
207 Allow a process that is not the owner of a file to modify that file's access
208 and modification times. Allow a process that is not the owner of a directory to
209 modify that directory's access and modification times. Allow a process that is
210 not the owner of a file or directory to remove or rename a file or directory
211 whose parent directory has the "save text image after execution" (sticky) bit
212 set. Allow a process that is not the owner of a file to mount a \fBnamefs\fR
213 upon that file. Allow a process that is not the owner of a file or directory to
214 modify that file's or directory's permission bits or ACL.
215 .RE
217 .sp
218 .ne 2
219 .na
220 \fB\fBPRIV_FILE_READ\fR\fR
221 .ad
222 .sp .6
223 .RS 4n
224 Allow a process to open objects in the filesystem for reading. This
225 privilege is not necessary to read from an already open file which was opened
226 before dropping the \fBPRIV_FILE_READ\fR privilege.
227 .RE
229 .sp
230 .ne 2
231 .na
232 \fB\fBPRIV_FILE_SETID\fR\fR
233 .ad
234 .sp .6
235 .RS 4n
236 Allow a process to change the ownership of a file or write to a file without
237 the set-user-ID and set-group-ID bits being cleared. Allow a process to set the
238 set-group-ID bit on a file or directory whose group is not the process's
239 effective group or one of the process's supplemental groups. Allow a process to
240 set the set-user-ID bit on a file with different ownership in the presence of
241 \fBPRIV_FILE_OWNER\fR. Additional restrictions apply when creating or modifying
242 a setuid 0 file.
243 .RE
245 .sp
246 .ne 2
247 .na
248 \fB\fBPRIV_FILE_WRITE\fR\fR
249 .ad
250 .sp .6
251 .RS 4n
252 Allow a process to open objects in the filesystem for writing, or otherwise
253 modify them. This privilege is not necessary to write to an already open file
254 which was opened before dropping the \fBPRIV_FILE_WRITE\fR privilege.
255 .RE
257 .sp
258 .ne 2
259 .na
260 \fB\fBPRIV_GRAPHICS_ACCESS\fR\fR
261 .ad
262 .sp .6
263 .RS 4n
264 Allow a process to make privileged ioctls to graphics devices. Typically only
265 an xserver process needs to have this privilege. A process with this privilege
266 is also allowed to perform privileged graphics device mappings.
267 .RE
269 .sp
270 .ne 2
271 .na
272 \fB\fBPRIV_GRAPHICS_MAP\fR\fR
273 .ad
274 .sp .6
275 .RS 4n
276 Allow a process to perform privileged mappings through a graphics device.
277 .RE
279 .sp
280 .ne 2
281 .na
282 \fB\fBPRIV_IPC_DAC_READ\fR\fR
283 .ad
284 .sp .6
285 .RS 4n
286 Allow a process to read a System V IPC Message Queue, Semaphore Set, or Shared
287 Memory Segment whose permission bits would not otherwise allow the process read
288 permission.
289 .RE
291 .sp
292 .ne 2
293 .na
294 \fB\fBPRIV_IPC_DAC_WRITE\fR\fR
295 .ad
296 .sp .6
297 .RS 4n
298 Allow a process to write a System V IPC Message Queue, Semaphore Set, or Shared
299 Memory Segment whose permission bits would not otherwise allow the process
300 write permission.
301 .RE
303 .sp
304 .ne 2
305 .na
306 \fB\fBPRIV_IPC_OWNER\fR\fR
307 .ad
308 .sp .6
309 .RS 4n
310 Allow a process that is not the owner of a System V IPC Message Queue,
311 Semaphore Set, or Shared Memory Segment to remove, change ownership of, or
312 change permission bits of the Message Queue, Semaphore Set, or Shared Memory
313 Segment.
314 .RE
316 .sp
317 .ne 2
318 .na
319 \fB\fBPRIV_NET_ACCESS\fR\fR
320 .ad
321 .sp .6
322 .RS 4n
323 Allow a process to open a TCP, UDP, SDP, or SCTP network endpoint. This
324 privilege is not necessary to communicate using an existing endpoint already
325 opened before dropping the \fBPRIV_NET_ACCESS\fR privilege.
326 .RE
328 .sp
329 .ne 2
330 .na
331 \fB\fBPRIV_NET_ICMPACCESS\fR\fR
332 .ad
333 .sp .6
334 .RS 4n
335 Allow a process to send and receive ICMP packets.
336 .RE
338 .sp
339 .ne 2
340 .na
341 \fB\fBPRIV_NET_OBSERVABILITY\fR\fR
342 .ad
343 .sp .6
344 .RS 4n
345 Allow a process to open a device for just receiving network traffic, sending
346 traffic is disallowed.
347 .RE
349 .sp
350 .ne 2
351 .na
352 \fB\fBPRIV_NET_PRIVADDR\fR\fR
353 .ad
354 .sp .6
355 .RS 4n
356 Allow a process to bind to a privileged port number. The privilege port numbers
357 are 1-1023 (the traditional UNIX privileged ports) as well as those ports
358 marked as "\fBudp/tcp_extra_priv_ports\fR" with the exception of the ports
359 reserved for use by NFS and SMB.
360 .RE
362 .sp
363 .ne 2
364 .na
365 \fB\fBPRIV_NET_RAWACCESS\fR\fR
366 .ad
367 .sp .6
368 .RS 4n
369 Allow a process to have direct access to the network layer.
370 .RE
372 .sp
373 .ne 2
374 .na
375 \fB\fBPRIV_PROC_AUDIT\fR\fR
376 .ad
377 .sp .6
378 .RS 4n
379 Allow a process to generate audit records. Allow a process to get its own audit
380 pre-selection information.
381 .RE
383 .sp
384 .ne 2
385 .na
386 \fB\fBPRIV_PROC_CHROOT\fR\fR
387 .ad
388 .sp .6
389 .RS 4n
390 Allow a process to change its root directory.
391 .RE
393 .sp
394 .ne 2
395 .na
396 \fB\fBPRIV_PROC_CLOCK_HIGHRES\fR\fR
397 .ad
398 .sp .6
399 .RS 4n
400 Allow a process to use high resolution timers.
401 .RE
403 .sp
404 .ne 2
405 .na
406 \fB\fBPRIV_PROC_EXEC\fR\fR
407 .ad
408 .sp .6
409 .RS 4n
410 Allow a process to call \fBexec\fR(2).
411 .RE
413 .sp
414 .ne 2
415 .na
416 \fB\fBPRIV_PROC_FORK\fR\fR
417 .ad
418 .sp .6
419 .RS 4n
420 Allow a process to call \fBfork\fR(2), \fBfork1\fR(2), or \fBvfork\fR(2).
421 .RE
423 .sp
424 .ne 2
425 .na
426 \fB\fBPRIV_PROC_INFO\fR\fR
427 .ad
428 .sp .6
429 .RS 4n
430 Allow a process to examine the status of processes other than those to which it
431 can send signals. Processes that cannot be examined cannot be seen in
432 \fB/proc\fR and appear not to exist.
433 .RE
435 .sp
436 .ne 2
437 .na
438 \fB\fBPRIV_PROC_LOCK_MEMORY\fR\fR
439 .ad
440 .sp .6
441 .RS 4n
442 Allow a process to lock pages in physical memory.
443 .RE
445 .sp
446 .ne 2
447 .na
448 \fB\fBPRIV_PROC_MEMINFO\fR\fR
449 .ad
450 .sp .6
451 .RS 4n
452 Allow a process to access physical memory information.
453 .RE
455 .sp
456 .ne 2
457 .na
458 \fB\fBPRIV_PROC_OWNER\fR\fR
459 .ad
460 .sp .6
461 .RS 4n
462 Allow a process to send signals to other processes and inspect and modify the
463 process state in other processes, regardless of ownership. When modifying
464 another process, additional restrictions apply: the effective privilege set of
465 the attaching process must be a superset of the target process's effective,
466 permitted, and inheritable sets; the limit set must be a superset of the
467 target's limit set; if the target process has any UID set to 0 all privilege
468 must be asserted unless the effective UID is 0. Allow a process to bind
469 arbitrary processes to CPUs.
470 .RE
472 .sp
473 .ne 2
474 .na
475 \fB\fBPRIV_PROC_PRIOUP\fR\fR
476 .ad
477 .sp .6
478 .RS 4n
479 Allow a process to elevate its priority above its current level.
480 .RE
482 .sp
483 .ne 2
484 .na
485 \fB\fBPRIV_PROC_PRIOCNTL\fR\fR
486 .ad
487 .sp .6
488 .RS 4n
489 Allows all that PRIV_PROC_PRIOUP allows.
490 Allow a process to change its scheduling class to any scheduling class,
491 including the RT class.
492 .RE
494 .sp
495 .ne 2
496 .na
497 \fBPRIV_PROC_SECFLAGS\fR
498 .ad
499 .sp .6
500 .RS 4n
501 Allow a process to manipulate the secflags of processes (subject to,
502 additionally, the ability to signal that process).
503 .RE
505 .sp
506 .ne 2
507 .na
508 \fB\fBPRIV_PROC_SESSION\fR\fR
509 .ad
510 .sp .6
511 .RS 4n
512 Allow a process to send signals or trace processes outside its session.
513 .RE
515 .sp
516 .ne 2
517 .na
518 \fB\fBPRIV_PROC_SETID\fR\fR
519 .ad
520 .sp .6
521 .RS 4n
522 Allow a process to set its UIDs at will, assuming UID 0 requires all privileges
523 to be asserted.
524 .RE
526 .sp
527 .ne 2
528 .na
529 \fB\fBPRIV_PROC_TASKID\fR\fR
530 .ad
531 .sp .6
532 .RS 4n
533 Allow a process to assign a new task ID to the calling process.
534 .RE
536 .sp
537 .ne 2
538 .na
539 \fB\fBPRIV_PROC_ZONE\fR\fR
540 .ad
541 .sp .6
542 .RS 4n
543 Allow a process to trace or send signals to processes in other zones. See
544 \fBzones\fR(5).
545 .RE
547 .sp
548 .ne 2
549 .na
550 \fB\fBPRIV_SYS_ACCT\fR\fR
551 .ad
552 .sp .6
553 .RS 4n
554 Allow a process to enable and disable and manage accounting through
555 \fBacct\fR(2).
556 .RE
558 .sp
559 .ne 2
560 .na
561 \fB\fBPRIV_SYS_ADMIN\fR\fR
562 .ad
563 .sp .6
564 .RS 4n
565 Allow a process to perform system administration tasks such as setting node and
566 domain name and specifying \fBcoreadm\fR(8) and \fBnscd\fR(8) settings
567 .RE
569 .sp
570 .ne 2
571 .na
572 \fB\fBPRIV_SYS_AUDIT\fR\fR
573 .ad
574 .sp .6
575 .RS 4n
576 Allow a process to start the (kernel) audit daemon. Allow a process to view and
577 set audit state (audit user ID, audit terminal ID, audit sessions ID, audit
578 pre-selection mask). Allow a process to turn off and on auditing. Allow a
579 process to configure the audit parameters (cache and queue sizes, event to
580 class mappings, and policy options).
581 .RE
583 .sp
584 .ne 2
585 .na
586 \fB\fBPRIV_SYS_CONFIG\fR\fR
587 .ad
588 .sp .6
589 .RS 4n
590 Allow a process to perform various system configuration tasks. Allow
591 filesystem-specific administrative procedures, such as filesystem configuration
592 ioctls, quota calls, creation and deletion of snapshots, and manipulating the
593 PCFS bootsector.
594 .RE
596 .sp
597 .ne 2
598 .na
599 \fB\fBPRIV_SYS_DEVICES\fR\fR
600 .ad
601 .sp .6
602 .RS 4n
603 Allow a process to create device special files. Allow a process to successfully
604 call a kernel module that calls the kernel \fBdrv_priv\fR(9F) function to check
605 for allowed access. Allow a process to open the real console device directly.
606 Allow a process to open devices that have been exclusively opened.
607 .RE
609 .sp
610 .ne 2
611 .na
612 \fB\fBPRIV_SYS_DL_CONFIG\fR\fR
613 .ad
614 .sp .6
615 .RS 4n
616 Allow a process to configure a system's datalink interfaces.
617 .RE
619 .sp
620 .ne 2
621 .na
622 \fB\fBPRIV_SYS_IP_CONFIG\fR\fR
623 .ad
624 .sp .6
625 .RS 4n
626 Allow a process to configure a system's IP interfaces and routes. Allow a
627 process to configure network parameters for \fBTCP/IP\fR using \fBndd\fR. Allow
628 a process access to otherwise restricted \fBTCP/IP\fR information using
629 \fBndd\fR. Allow a process to configure \fBIPsec\fR. Allow a process to pop
630 anchored \fBSTREAM\fRs modules with matching \fBzoneid\fR.
631 .RE
633 .sp
634 .ne 2
635 .na
636 \fB\fBPRIV_SYS_IPC_CONFIG\fR\fR
637 .ad
638 .sp .6
639 .RS 4n
640 Allow a process to increase the size of a System V IPC Message Queue buffer.
641 .RE
643 .sp
644 .ne 2
645 .na
646 \fB\fBPRIV_SYS_IPTUN_CONFIG\fR\fR
647 .ad
648 .sp .6
649 .RS 4n
650 Allow a process to configure IP tunnel links.
651 .RE
653 .sp
654 .ne 2
655 .na
656 \fB\fBPRIV_SYS_LINKDIR\fR\fR
657 .ad
658 .sp .6
659 .RS 4n
660 Allow a process to unlink and link directories.
661 .RE
663 .sp
664 .ne 2
665 .na
666 \fB\fBPRIV_SYS_MOUNT\fR\fR
667 .ad
668 .sp .6
669 .RS 4n
670 Allow a process to mount and unmount filesystems that would otherwise be
671 restricted (that is, most filesystems except \fBnamefs\fR). Allow a process to
672 add and remove swap devices.
673 .RE
675 .sp
676 .ne 2
677 .na
678 \fB\fBPRIV_SYS_NET_CONFIG\fR\fR
679 .ad
680 .sp .6
681 .RS 4n
682 Allow a process to do all that \fBPRIV_SYS_IP_CONFIG\fR,
683 \fBPRIV_SYS_DL_CONFIG\fR, and \fBPRIV_SYS_PPP_CONFIG\fR allow, plus the
684 following: use the \fBrpcmod\fR STREAMS module and insert/remove STREAMS
685 modules on locations other than the top of the module stack.
686 .RE
688 .sp
689 .ne 2
690 .na
691 \fB\fBPRIV_SYS_NFS\fR\fR
692 .ad
693 .sp .6
694 .RS 4n
695 Allow a process to provide NFS service: start NFS kernel threads, perform NFS
696 locking operations, bind to NFS reserved ports: ports 2049 (\fBnfs\fR) and port
697 4045 (\fBlockd\fR).
698 .RE
700 .sp
701 .ne 2
702 .na
703 \fB\fBPRIV_SYS_PPP_CONFIG\fR\fR
704 .ad
705 .sp .6
706 .RS 4n
707 Allow a process to create, configure, and destroy PPP instances with pppd(8)
708 \fBpppd\fR(8) and control PPPoE plumbing with \fBsppptun\fR(8)sppptun(8).
709 This privilege is granted by default to exclusive IP stack instance zones.
710 .RE
712 .sp
713 .ne 2
714 .na
715 \fB\fBPRIV_SYS_RES_BIND\fR\fR
716 .ad
717 .sp .6
718 .RS 4n
719 Allows a process to bind processes to processor sets.
720 .RE
722 .sp
723 .ne 2
724 .na
725 \fB\fBPRIV_SYS_RES_CONFIG\fR\fR
726 .ad
727 .sp .6
728 .RS 4n
729 Allows all that PRIV_SYS_RES_BIND allows.
730 Allow a process to create and delete processor sets, assign CPUs to processor
731 sets and override the \fBPSET_NOESCAPE\fR property. Allow a process to change
732 the operational status of CPUs in the system using \fBp_online\fR(2). Allow a
733 process to configure filesystem quotas. Allow a process to configure resource
734 pools and bind processes to pools.
735 .RE
737 .sp
738 .ne 2
739 .na
740 \fB\fBPRIV_SYS_RESOURCE\fR\fR
741 .ad
742 .sp .6
743 .RS 4n
744 Allow a process to exceed the resource limits imposed on it by
745 \fBsetrlimit\fR(2) and \fBsetrctl\fR(2).
746 .RE
748 .sp
749 .ne 2
750 .na
751 \fB\fBPRIV_SYS_SMB\fR\fR
752 .ad
753 .sp .6
754 .RS 4n
755 Allow a process to provide NetBIOS or SMB services: start SMB kernel threads or
756 bind to NetBIOS or SMB reserved ports: ports 137, 138, 139 (NetBIOS) and 445
757 (SMB).
758 .RE
760 .sp
761 .ne 2
762 .na
763 \fB\fBPRIV_SYS_SUSER_COMPAT\fR\fR
764 .ad
765 .sp .6
766 .RS 4n
767 Allow a process to successfully call a third party loadable module that calls
768 the kernel \fBsuser()\fR function to check for allowed access. This privilege
769 exists only for third party loadable module compatibility and is not used by
770 Solaris proper.
771 .RE
773 .sp
774 .ne 2
775 .na
776 \fB\fBPRIV_SYS_TIME\fR\fR
777 .ad
778 .sp .6
779 .RS 4n
780 Allow a process to manipulate system time using any of the appropriate system
781 calls: \fBstime\fR(2), \fBadjtime\fR(2), and \fBntp_adjtime\fR(2).
782 .RE
784 .sp
785 .ne 2
786 .na
787 \fB\fBPRIV_VIRT_MANAGE\fR\fR
788 .ad
789 .sp .6
790 .RS 4n
791 Allows a process to manage virtualized environments such as \fBxVM\fR(5).
792 .RE
794 .sp
795 .ne 2
796 .na
797 \fB\fBPRIV_XVM_CONTROL\fR\fR
798 .ad
799 .sp .6
800 .RS 4n
801 Allows a process access to the \fBxVM\fR(5) control devices for managing guest
802 domains and the hypervisor. This privilege is used only if booted into xVM on
803 x86 platforms.
804 .RE
806 .sp
807 .LP
808 Of the privileges listed above, the privileges \fBPRIV_FILE_LINK_ANY\fR,
809 \fBPRIV_PROC_INFO\fR, \fBPRIV_PROC_SESSION\fR, \fBPRIV_PROC_FORK\fR,
810 \fBPRIV_FILE_READ\fR, \fBPRIV_FILE_WRITE\fR, \fBPRIV_NET_ACCESS\fR and
811 \fBPRIV_PROC_EXEC\fR are considered "basic" privileges. These are privileges
812 that used to be always available to unprivileged processes. By default,
813 processes still have the basic privileges.
814 .sp
815 .LP
816 The privileges \fBPRIV_PROC_SETID\fR and \fBPRIV_PROC_AUDIT\fR must be present
817 in the Limit set (see below) of a process in order for set-uid root \fBexec\fRs
818 to be successful, that is, get an effective UID of 0 and additional privileges.
819 .sp
820 .LP
821 The privilege implementation in Solaris extends the process credential with
822 four privilege sets:
823 .sp
824 .ne 2
825 .na
826 \fBI, the inheritable set\fR
827 .ad
828 .RS 26n
829 The privileges inherited on \fBexec\fR.
830 .RE
832 .sp
833 .ne 2
834 .na
835 \fBP, the permitted set\fR
836 .ad
837 .RS 26n
838 The maximum set of privileges for the process.
839 .RE
841 .sp
842 .ne 2
843 .na
844 \fBE, the effective set\fR
845 .ad
846 .RS 26n
847 The privileges currently in effect.
848 .RE
850 .sp
851 .ne 2
852 .na
853 \fBL, the limit set\fR
854 .ad
855 .RS 26n
856 The upper bound of the privileges a process and its offspring can obtain.
857 Changes to L take effect on the next \fBexec\fR.
858 .RE
860 .sp
861 .LP
862 The sets I, P and E are typically identical to the basic set of privileges for
863 unprivileged processes. The limit set is typically the full set of privileges.
864 .sp
865 .LP
866 Each process has a Privilege Awareness State (PAS) that can take the value PA
867 (privilege-aware) and NPA (not-PA). PAS is a transitional mechanism that allows
868 a choice between full compatibility with the old superuser model and completely
869 ignoring the effective UID.
870 .sp
871 .LP
872 To facilitate the discussion, we introduce the notion of "observed effective
873 set" (oE) and "observed permitted set" (oP) and the implementation sets iE and
874 iP.
875 .sp
876 .LP
877 A process becomes privilege-aware either by manipulating the effective,
878 permitted, or limit privilege sets through \fBsetppriv\fR(2) or by using
879 \fBsetpflags\fR(2). In all cases, oE and oP are invariant in the process of
880 becoming privilege-aware. In the process of becoming privilege-aware, the
881 following assignments take place:
882 .sp
883 .in +2
884 .nf
885 iE = oE
886 iP = oP
887 .fi
888 .in -2
890 .sp
891 .LP
892 When a process is privilege-aware, oE and oP are invariant under UID changes.
893 When a process is not privilege-aware, oE and oP are observed as follows:
894 .sp
895 .in +2
896 .nf
897 oE = euid == 0 ? L : iE
898 oP = (euid == 0 || ruid == 0 || suid == 0) ? L : iP
899 .fi
900 .in -2
902 .sp
903 .LP
904 When a non-privilege-aware process has an effective UID of 0, it can exercise
905 the privileges contained in its limit set, the upper bound of its privileges.
906 If a non-privilege-aware process has any of the UIDs 0, it appears to be
907 capable of potentially exercising all privileges in L.
908 .sp
909 .LP
910 It is possible for a process to return to the non-privilege aware state using
911 \fBsetpflags()\fR. The kernel always attempts this on \fBexec\fR(2). This
912 operation is permitted only if the following conditions are met:
913 .RS +4
914 .TP
915 .ie t \(bu
916 .el o
917 If any of the UIDs is equal to 0, P must be equal to L.
918 .RE
919 .RS +4
920 .TP
921 .ie t \(bu
922 .el o
923 If the effective UID is equal to 0, E must be equal to L.
924 .RE
925 .sp
926 .LP
927 When a process gives up privilege awareness, the following assignments take
928 place:
929 .sp
930 .in +2
931 .nf
932 if (euid == 0) iE = L & I
933 if (any uid == 0) iP = L & I
934 .fi
935 .in -2
937 .sp
938 .LP
939 The privileges obtained when not having a UID of \fB0\fR are the inheritable
940 set of the process restricted by the limit set.
941 .sp
942 .LP
943 Only privileges in the process's (observed) effective privilege set allow the
944 process to perform restricted operations. A process can use any of the
945 privilege manipulation functions to add or remove privileges from the privilege
946 sets. Privileges can be removed always. Only privileges found in the permitted
947 set can be added to the effective and inheritable set. The limit set cannot
948 grow. The inheritable set can be larger than the permitted set.
949 .sp
950 .LP
951 When a process performs an \fBexec\fR(2), the kernel first tries to relinquish
952 privilege awareness before making the following privilege set modifications:
953 .sp
954 .in +2
955 .nf
956 E' = P' = I' = L & I
957 L is unchanged
958 .fi
959 .in -2
961 .sp
962 .LP
963 If a process has not manipulated its privileges, the privilege sets effectively
964 remain the same, as E, P and I are already identical.
965 .sp
966 .LP
967 The limit set is enforced at \fBexec\fR time.
968 .sp
969 .LP
970 To run a non-privilege-aware application in a backward-compatible manner, a
971 privilege-aware application should start the non-privilege-aware application
972 with I=basic.
973 .sp
974 .LP
975 For most privileges, absence of the privilege simply results in a failure. In
976 some instances, the absence of a privilege can cause system calls to behave
977 differently. In other instances, the removal of a privilege can force a set-uid
978 application to seriously malfunction. Privileges of this type are considered
979 "unsafe". When a process is lacking any of the unsafe privileges from its limit
980 set, the system does not honor the set-uid bit of set-uid root applications.
981 The following unsafe privileges have been identified: \fBproc_setid\fR,
982 \fBsys_resource\fR and \fBproc_audit\fR.
983 .SS "Privilege Escalation"
984 .LP
985 In certain circumstances, a single privilege could lead to a process gaining
986 one or more additional privileges that were not explicitly granted to that
987 process. To prevent such an escalation of privileges, the security policy
988 requires explicit permission for those additional privileges.
989 .sp
990 .LP
991 Common examples of escalation are those mechanisms that allow modification of
992 system resources through "raw'' interfaces; for example, changing kernel data
993 structures through \fB/dev/kmem\fR or changing files through \fB/dev/dsk/*\fR.
994 Escalation also occurs when a process controls processes with more privileges
995 than the controlling process. A special case of this is manipulating or
996 creating objects owned by UID 0 or trying to obtain UID 0 using
997 \fBsetuid\fR(2). The special treatment of UID 0 is needed because the UID 0
998 owns all system configuration files and ordinary file protection mechanisms
999 allow processes with UID 0 to modify the system configuration. With appropriate
1000 file modifications, a given process running with an effective UID of 0 can gain
1001 all privileges.
1002 .sp
1003 .LP
1004 In situations where a process might obtain UID 0, the security policy requires
1005 additional privileges, up to the full set of privileges. Such restrictions
1006 could be relaxed or removed at such time as additional mechanisms for
1007 protection of system files became available. There are no such mechanisms in
1008 the current Solaris release.
1009 .sp
1010 .LP
1011 The use of UID 0 processes should be limited as much as possible. They should
1012 be replaced with programs running under a different UID but with exactly the
1013 privileges they need.
1014 .sp
1015 .LP
1016 Daemons that never need to \fBexec\fR subprocesses should remove the
1017 \fBPRIV_PROC_EXEC\fR privilege from their permitted and limit sets.
1018 .SS "Assigned Privileges and Safeguards"
1019 .LP
1020 When privileges are assigned to a user, the system administrator could give
1021 that user more powers than intended. The administrator should consider whether
1022 safeguards are needed. For example, if the \fBPRIV_PROC_LOCK_MEMORY\fR
1023 privilege is given to a user, the administrator should consider setting the
1024 \fBproject.max-locked-memory\fR resource control as well, to prevent that user
1025 from locking all memory.
1026 .SS "Privilege Debugging"
1027 .LP
1028 When a system call fails with a permission error, it is not always immediately
1029 obvious what caused the problem. To debug such a problem, you can use a tool
1030 called \fBprivilege debugging\fR. When privilege debugging is enabled for a
1031 process, the kernel reports missing privileges on the controlling terminal of
1032 the process. (Enable debugging for a process with the \fB-D\fR option of
1033 \fBppriv\fR(1).) Additionally, the administrator can enable system-wide
1034 privilege debugging by setting the \fBsystem\fR(4) variable \fBpriv_debug\fR
1035 using:
1036 .sp
1037 .in +2
1038 .nf
1039 set priv_debug = 1
1040 .fi
1041 .in -2
1043 .sp
1044 .LP
1045 On a running system, you can use \fBmdb\fR(1) to change this variable.
1046 .SS "Privilege Administration"
1047 .LP
1048 Use \fBusermod\fR(8) or \fBrolemod\fR(8)
1049 to assign privileges to or modify privileges for, respectively, a user or a
1050 role. Use \fBppriv\fR(1) to enumerate the privileges supported on a system and
1051 \fBtruss\fR(1) to determine which privileges a program requires.
1052 .SH SEE ALSO
1053 .LP
1054 \fBmdb\fR(1), \fBppriv\fR(1), \fBadd_drv\fR(8), \fBifconfig\fR(8),
1055 \fBlockd\fR(8), \fBnfsd\fR(8), \fBpppd\fR(8), \fBrem_drv\fR(8),
1056 \fBsmbd\fR(8), \fBsppptun\fR(8), \fBupdate_drv\fR(8), \fBIntro\fR(2),
1057 \fBaccess\fR(2), \fBacct\fR(2), \fBacl\fR(2), \fBadjtime\fR(2), \fBaudit\fR(2),
1058 \fBauditon\fR(2), \fBchmod\fR(2), \fBchown\fR(2), \fBchroot\fR(2),
1059 \fBcreat\fR(2), \fBexec\fR(2), \fBfcntl\fR(2), \fBfork\fR(2),
1060 \fBfpathconf\fR(2), \fBgetacct\fR(2), \fBgetpflags\fR(2), \fBgetppriv\fR(2),
1061 \fBgetsid\fR(2), \fBkill\fR(2), \fBlink\fR(2), \fBmemcntl\fR(2),
1062 \fBmknod\fR(2), \fBmount\fR(2), \fBmsgctl\fR(2), \fBnice\fR(2),
1063 \fBntp_adjtime\fR(2), \fBopen\fR(2), \fBp_online\fR(2), \fBpriocntl\fR(2),
1064 \fBpriocntlset\fR(2), \fBprocessor_bind\fR(2), \fBpset_bind\fR(2),
1065 \fBpset_create\fR(2), \fBreadlink\fR(2), \fBresolvepath\fR(2), \fBrmdir\fR(2),
1066 \fBsemctl\fR(2), \fBsetauid\fR(2), \fBsetegid\fR(2), \fBseteuid\fR(2),
1067 \fBsetgid\fR(2), \fBsetgroups\fR(2), \fBsetpflags\fR(2), \fBsetppriv\fR(2),
1068 \fBsetrctl\fR(2), \fBsetregid\fR(2), \fBsetreuid\fR(2), \fBsetrlimit\fR(2),
1069 \fBsettaskid\fR(2), \fBsetuid\fR(2), \fBshmctl\fR(2), \fBshmget\fR(2),
1070 \fBshmop\fR(2), \fBsigsend\fR(2), \fBstat\fR(2), \fBstatvfs\fR(2),
1071 \fBstime\fR(2), \fBswapctl\fR(2), \fBsysinfo\fR(2), \fBuadmin\fR(2),
1072 \fBulimit\fR(2), \fBumount\fR(2), \fBunlink\fR(2), \fButime\fR(2),
1073 \fButimes\fR(2), \fBbind\fR(3SOCKET), \fBdoor_ucred\fR(3C),
1074 \fBpriv_addset\fR(3C), \fBpriv_set\fR(3C), \fBpriv_getbyname\fR(3C),
1075 \fBpriv_getbynum\fR(3C), \fBpriv_set_to_str\fR(3C), \fBpriv_str_to_set\fR(3C),
1076 \fBsocket\fR(3SOCKET), \fBt_bind\fR(3NSL), \fBtimer_create\fR(3C),
1077 \fBucred_get\fR(3C), \fBexec_attr\fR(4), \fBproc\fR(4), \fBsystem\fR(4),
1078 \fBuser_attr\fR(4), \fBxVM\fR(5), \fBddi_cred\fR(9F), \fBdrv_priv\fR(9F),
1079 \fBpriv_getbyname\fR(9F), \fBpriv_policy\fR(9F), \fBpriv_policy_choice\fR(9F),
1080 \fBpriv_policy_only\fR(9F)
1081 .sp
1082 .LP
1083 \fISystem Administration Guide: Security Services\fR