Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.os.vms > #58809

Re: VMS Privileges Versus Linux Capabilities

Show all headers | View raw

Stephen Hoffman wrote:
> On 2016-06-22 21:14:53 +0000, Paul Sture said:
> 
>> SETPRV is a special one though.  It doesn't actually go away if you 
>> disable it.  Note for the following user SETPRV is enabled in the 
>> default privileges, but not in the authorized ones.
> 
> Haven't checked this lately, but it used to be that SETPRV in the 
> default mask was not honored.  It had to be in the authorized mask.  
> Allowing SETPRV from the authorized mask was intended to avoid a user 
> ending up nailed by the SET PROCESS /PRIVILEGE=NONE command.  Various 
> versions of the IDSM have a write-up on this, and there have been 
> previous discussions.
> 
> This SETPRV behavior led to a sequence for a username that needs 
> privileges initially but you wished to somewhat armor the process 
> against subsequent nefarious use of SETPRV: put SETPRV in the default 
> mask and not the authorized mask, login with the user, then SPAWN and 
> issue the commands requiring privileges, and then log out of the 
> subprocess and remove SETPRV.  The SPAWN copied the privilege list from 
> the default mask in the parent to the authorized mask in the subprocess.

Somewhat related:  If you have a utility that includes a SPAWN 
capability, and the utility is installed with privileges, test it very 
carefully.

At least in some versions of VMS, the SPAWNed process inherits the 
installed privileges unless there is code around the spawn to remove the 
extra privileges.

-- 
-----------------------------------------------------------------------
Chris Scheers, Applied Synergy, Inc.

Voice: 817-237-3360            Internet: chris@applied-synergy.com
   Fax: 817-237-3074

Back to comp.os.vms | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

VMS Privileges Versus Linux Capabilities lawrencedo99@gmail.com - 2016-06-15 00:54 -0700
  Re: VMS Privileges Versus Linux Capabilities Simon Clubley <clubley@remove_me.eisner.decus.org-Earth.UFP> - 2016-06-16 20:53 +0000
    Re: VMS Privileges Versus Linux Capabilities lawrencedo99@gmail.com - 2016-06-16 16:02 -0700
    Re: VMS Privileges Versus Linux Capabilities lawrencedo99@gmail.com - 2016-06-16 16:03 -0700
      Re: VMS Privileges Versus Linux Capabilities Stephen Hoffman <seaohveh@hoffmanlabs.invalid> - 2016-06-16 20:06 -0400
        Re: VMS Privileges Versus Linux Capabilities "Kerry Main" <kemain.nospam@gmail.com> - 2016-06-16 20:57 -0400
        Re: VMS Privileges Versus Linux Capabilities RobertsonEricW <robertsonericw@netzero.net> - 2016-06-21 05:29 -0700
          SEVMS, was: Re: VMS Privileges Versus Linux Capabilities Simon Clubley <clubley@remove_me.eisner.decus.org-Earth.UFP> - 2016-06-21 13:02 +0000
          Re: VMS Privileges Versus Linux Capabilities Stephen Hoffman <seaohveh@hoffmanlabs.invalid> - 2016-06-21 11:20 -0400
            Re: VMS Privileges Versus Linux Capabilities Jerry Eckert <jerry.eckert@gmail.com> - 2016-06-21 11:41 -0500
              Re: VMS Privileges Versus Linux Capabilities lawrencedo99@gmail.com - 2016-06-21 22:59 -0700
            Re: VMS Privileges Versus Linux Capabilities lawrencedo99@gmail.com - 2016-06-21 22:57 -0700
              Re: VMS Privileges Versus Linux Capabilities Stephen Hoffman <seaohveh@hoffmanlabs.invalid> - 2016-06-22 09:38 -0400
        Re: VMS Privileges Versus Linux Capabilities mcleanjoh@gmail.com - 2016-06-22 01:09 -0700
          Re: VMS Privileges Versus Linux Capabilities Stephen Hoffman <seaohveh@hoffmanlabs.invalid> - 2016-06-22 09:47 -0400
          Re: VMS Privileges Versus Linux Capabilities David Froble <davef@tsoft-inc.com> - 2016-06-22 16:39 -0400
            Re: VMS Privileges Versus Linux Capabilities Paul Sture <nospam@sture.ch> - 2016-06-22 23:14 +0200
              Re: VMS Privileges Versus Linux Capabilities abrsvc <dansabrservices@yahoo.com> - 2016-06-22 14:41 -0700
                Re: VMS Privileges Versus Linux Capabilities lawrencedo99@gmail.com - 2016-06-22 19:03 -0700
              Re: VMS Privileges Versus Linux Capabilities Stephen Hoffman <seaohveh@hoffmanlabs.invalid> - 2016-06-22 17:48 -0400
                Re: VMS Privileges Versus Linux Capabilities Chris Scheers <chris@applied-synergy.com> - 2016-06-22 19:57 -0500
              Re: VMS Privileges Versus Linux Capabilities David Froble <davef@tsoft-inc.com> - 2016-06-22 20:11 -0400
                Re: VMS Privileges Versus Linux Capabilities koehler@eisner.nospam.decuserve.org (Bob Koehler) - 2016-06-23 09:19 -0400
                Re: VMS Privileges Versus Linux Capabilities David Froble <davef@tsoft-inc.com> - 2016-06-23 12:57 -0400

csiph-web