[Search for users] [Overall Top Noters] [List of all Conferences] [Download this site]

Conference iosg::all-in-1_v30

Title:	OLD ALL-IN-1 (tm) Support Conference
Notice:	Closed - See Note 4331.l to move to IOSG::ALL-IN-1
Moderator:	IOSG::PYE

Created:	Thu Jan 30 1992
Last Modified:	Tue Jan 23 1996
Last Successful Update:	Fri Jun 06 1997
Number of topics:	4343
Total number of notes:	18308

337.0. "BYPASS must be both default and authorized priv..." by TAV02::CHAIM (Semper ubi Sub ubi .....) Thu Mar 26 1992 14:09

It appears that ALL-IN-1 treats the BYPASS privelege in the following manner:

If you have BYPASS as default priv but NOT as an authorized priv then when you
enter ALL-IN-1 you don't have BYPASS.

If you have BYPASS as BOTH default and authorized, or if you have SETPRV then
you get the BYPASS.

Is this a "bug" or a feature?

Thanks,

Cb.

T.R	Title	User	Personal Name	Date	Lines
337.1	The priv story.	UTRTSC::BOSMAN	We're just sugar mice in the rain	`Thu Mar 26 1992 15:17`	155
	Hi, See this article. ALL-IN-1 doesn't treat it differently (at least I think so). If you have the BYPASS privilege by default, then it is valid for your process. The default privileges are copied into the sub-process. So if you have enough authorized privileges, but only NETMBX and TMPMBX as default, than you can't switch on BYPASS in the sub-process. Sjaak. Explanation of DEFPRIVILEGES and PRIVILEGES Qualifiers in AUTHORIZE COPYRIGHT (c) 1988, 1989, 1990 by Digital Equipment Corporation. ALL RIGHTS RESERVED. No distribution except as provided under contract. COMPONENT: Authorize Utility OP/SYS: VMS LAST TECHNICAL REVIEW: 21-JUN-1990 SOURCE: Customer Support Center / USA VERSION INFORMATION: Information Applies To: VMS, All Versions SUBJECT: This article is an explanation of the qualifiers DEFPRIVILEGES and PRIVILEGES used in the Authorize Utility. DISCUSSION: Authorized privileges are recorded in the SYSUAF record in a 64-bit PRIVILEGES mask. When logging on, the privileges mask is stored in the header of the process. DEFPRIVILEGES are privileges that are enabled at login time. PRIVILEGES are privileges that a user is authorized to use and may or may not be enabled at login time. Confusion often arises with these qualifiers. The specific privilege bit must be set in the PRIVILEGES mask before the privilege can be used. For Example: $ RUN AUTHORIZE UAF> SHOW JDOE Username: JDOE Owner: JOHN DOE Account: UIC: [777,7] ([JDOE]) CLI: DCL Tables: DCLTABLES . . . AUTHORIZED PRIVILEGES: TMPMBX NETMBX DEFAULT PRIVILEGES: SETPRV TMPMBX NETMBX A user executes the following commands: $ SHOW PROCESS/PRIVILEGES 21-JUN-1990 10:02:44.14 RTA1: User: JDOE Process privileges: SETPRV may set any privilege bit TMPMBX may create temporary mailbox NETMBX may create network device $ SET PROCESS/PRIVILEGES=ALL %SYSTEM-W-NOTALLPRIV, not all requested privileges authorized The correct way to set this account is: UAF> MODIFY JDOE/DEFPRIVILEGES=NOSETPRV- _UAF> /PRIVILEGES=SETPRV %UAF-I-MDFYMSG, user record(s) updated UAF> SHOW JDOE Username: JDOE Owner: JOHN DOE Account: UIC: [777,7] ([JDOE]) CLI: DCL Tables: DCLTABLES . . . AUTHORIZED PRIVILEGES: SETPRV TMPMBX NETMBX DEFAULT PRIVILEGES: TMPMBX NETMBX A user executes the following commands after logging out then back into the system: $ SHOW PROCESS/PRIVILEGES 21-JUN-1990 10:12:39.68 RTA2: User: JDOE Process privileges: TMPMBX may create temporary mailbox NETMBX may create network device $ SET PROCESS/PRIVILEGES=ALL $ SHOW PROCESS/PRIVILEGES 21-JUN-1990 10:15:09.33 RTA2: User: JDOE Process privileges: CMKRNL may change mode to kernel CMEXEC may change mode to exec SYSNAM may insert in system logical name table GRPNAM may insert in group logical name table ALLSPOOL may allocate spooled device DETACH may create detached processes DIAGNOSE may diagnose devices LOG_IO may do logical i/o GROUP may affect other processes in same group ACNT may suppress accounting message PRMCEB may create permanent common event clusters PRMMBX may create permanent mailbox PSWAPM may change process swap mode ALTPRI may set any priority value SETPRV may set any privilege bit TMPMBX may create temporary mailbox WORLD may affect other processes in the world MOUNT may execute mount acp function OPER operator privilege EXQUOTA may exceed quota NETMBX may create network device VOLPRO may override volume protection PHY_IO may do physical i/o BUGCHK may make bug check log entries PRMGBL may create permanent global sections SYSGBL may create system wide global sections PFNMAP may map to specific physical pages SHMEM may create/delete objects in shared memory SYSPRV may access objects via system protection BYPASS bypasses UIC checking SYSLCK may lock system wide resources SHARE may assign channels to non-shared device GRPPRV group access via system protection READALL may read anything as the owner SECURITY may perform security functions REFERENCES: "Guide to Setting Up a VMS System", (AA-LA25A-TE), April 1988, page 5-8. "VMS Authorize Utility Manual", (AA-LA42A-TE), April 1988, page AUTH-5, and page AUTH-9.
337.2	A bit more to add	IOSG::SHOVE	Dave Shove -- REO-D/3C	`Thu Mar 26 1992 16:09`	11
	To add to .1 The reason why ALL-IN-1 makes this behaviour appear is that it turns off the image's installed privs and restores the process privs instead, as soon as it's entered. Presumaqbly, VMS is refusing to give you BYPASS in your first case, as it isn't one of your authorized privs. SETPRV, by definition, lets you set any priv and so over-rides this behaviour. I think. Dave.
337.3	Be carefull with SETPRV	CHRLIE::HUSTON		`Thu Mar 26 1992 18:41`	13
	Be carefull what you do with SETPRV, while checking into how the FCS should handle SETPRV I came across two points: 1) SETPRV is rumored to be going away soon as it is basically useless. 2) SETPRV does not mean you have any priv, it means that if you want you can get any priv, it takes an explicit action to get the priv. We were told not to treat SETPRV as anything, basically ignore it. --Bob