Thursday August 14, 2008
Making files on ZFS Immutable (even by root!) First lets look at the normal POSIX file permissions and show who we are and what privileges our shell is running with:
# ls -l /tank/fs/hamlet.txt
-rw-rw-rw- 1 root root 211179 Aug 14 13:00 /tank/fs/hamlet.txt
# pcred $$
100618: e/r/suid=0 e/r/sgid=0
groups: 0 1 2 3 4 5 6 7 8 9 12
# ppriv $$
100618: -zsh
flags =
E: all
I: all
P: all
L: all
So we are running as root and have all privileges in our process and are passing all on to our children. We also own the file (and it is on a local ZFS filesystem not over NFS), and it is writable by us and our group, everyone in fact. So lets try and modify it:
# echo "SCRIBBLE" > /tank/fs/hamlet.txt zsh: not owner: /tank/fs/hamlet.txt
That didn't work lets try and delete it, but first check the permissions of the containing directory:
# ls -ld /tank/fs drwxr-xr-x 2 root root 3 Aug 14 13:00 /tank/fs # rm /tank/fs/hamlet.txt rm: /tank/fs/hamlet.txt: override protection 666 (yes/no)? y rm: /tank/fs/hamlet.txt not removed: Not owner
That is very strange, so what is going on here ?
Before I started this I made the file immutable. That means that regardless of what privileges(5) the process has and what POSIX permissions or NFSv4/ZFS ACL it has we can't delete it change it nor can we even change the POSIX permissions or the ACL. So how did we do that ? Without good old friend chmod:
# chmod S+ci /tank/fs/hamlet.txtOr more verbosely:
# chmod chmod S+v immutable /tank/fs/hamlet.txt
See chmod(1) for more details. For those of you running OpenSolaris 2008.05 releases then you need to change the default PATH to have /usr/bin in front of /usr/gnu/bin or use the full path to /usr/bin/chmod. This is because these extensions are only part of the OpenSolaris chmod command not the GNU version. The same applies to my previous posting on the extended output from ls.
( Aug 14 2008, 01:24:53 PM BST ) Permalink Comments [6]Heaps of info available on files via good old ls(1) [ But not encryption status ]
In "compact" form:
ls -V@ -/c -% all /tank/fs/hamlet.txt
-rw-r--r--+ 1 root root 211179 Aug 14 12:20 /tank/fs/hamlet.txt
{AHRSa-i--u}
timestamp: atime Aug 14 12:37:37 2008
timestamp: ctime Aug 14 12:32:58 2008
timestamp: mtime Aug 14 12:20:08 2008
timestamp: crtime Aug 14 12:19:41 2008
user:lp:r-------------:-------:deny
owner@:--x-----------:-------:deny
owner@:rw-p---A-W-Co-:-------:allow
group@:-wxp----------:-------:deny
group@:r-------------:-------:allow
everyone@:-wxp---A-W-Co-:-------:deny
everyone@:r-----a-R-c--s:-------:allow
In verbose form:
ls -v@ -/v -% all /tank/fs/hamlet.txt
-rw-r--r--+ 1 root root 211179 Aug 14 12:20 /tank/fs/hamlet.txt
{archive,hidden,readonly,system,appendonly,nonodump,
immutable,noav_modified,noav_quarantined,nounlink}
timestamp: atime Aug 14 12:21:12 2008
timestamp: ctime Aug 14 12:32:58 2008
timestamp: mtime Aug 14 12:20:08 2008
timestamp: crtime Aug 14 12:19:41 2008
0:user:lp:read_data:deny
1:owner@:execute:deny
2:owner@:read_data/write_data/append_data/write_xattr/write_attributes
/write_acl/write_owner:allow
3:group@:write_data/append_data/execute:deny
4:group@:read_data:allow
5:everyone@:write_data/append_data/write_xattr/execute/write_attributes
/write_acl/write_owner:deny
6:everyone@:read_data/read_xattr/read_attributes/read_acl/synchronize
:allow
One interesting thing it doesn't tell me about this file is that it is that all that information is encrypted on disk. For that I have to use zfs(1):
# zfs get encryption tank/fs NAME PROPERTY VALUE SOURCE tank/fs encryption on local
Or a little more verbosely:
# zfs list -r -o name,encryption,keyscope,keystatus,mounted tank NAME CRYPT KEYSCOPE KEYSTATUS MOUNTED tank off pool undefined yes tank/fs on pool available yes
I wonder if it is worth having the verbose ls(1) output indicate that the file was encrypted on "disk" by the filesystem.
What would people do with that info if they had it ? Any ideas let me know.
( Aug 14 2008, 12:49:15 PM BST ) Permalink Comments [2]
Tuesday August 12, 2008
What is the maximum password length for Solaris/OpenSolaris ? I find I'm answering this question a lot on our internal support aliases. Simply out the maximum possible length is 255. However it actually depends on the algorithm that crypt(3C) is going to use. Starting in the second update release of Solaris 9 we made crypt(3C) pluggable.
Not all crypt(3C) plugins accept the full 255 chars as significant input. The documented limit for each of them is on the relevant man page but I'll summarise here:
- crypt_unix(5) - the old unix default (8)
- crypt_sunmd5(5) - S9u2 onwards - (255)
- crypt_bsdmd5(5) - S9u2 onwards - (255)
- crypt_bsdbf(5) - S9u2 onwards - (255)
- crypt_sha256(5) - S10u6 / OpenSolaris onwards - (255)
- crypt_sha512(5) - S10u6 / OpenSolaris onwards - (255)
How to do this is documented here: Solaris 10 System Administrator Collection >> System Administration Guide: Security Services >> System, File, and Device Security >> 3. Controlling Access to Systems (Tasks) >> Changing the Password Algorithm (Task Map)
( Aug 12 2008, 05:11:48 PM BST ) Permalink
Friday July 25, 2008
T5120 donated to Haskell Community I just spotted on Darryl Gove's blog that Sun has donated a T5120 to the Haskell community. Fantastic. The goal is investigate how GHC (The Glasgow Haskell Compiler) can take advantage of the CMT architecture of the T5120.
Ah good old GHC that takes me back (ghc on SunOS 4.1.3 on sun4m!). I wonder if any of my code is still in the GHC libraries. This is a fantastic announcement. I've been thinking for a while now I'd like to get back to doing some Haskell programming and I've been considering adding DTrace probes to GHC - because I just feel it should have them!
Almost makes me want to be a student back at Glasgow again so I could work on it, I liked Haskell and I had a fun summer after graduation working on GHC
( Jul 25 2008, 01:30:28 PM BST ) Permalink
Thursday July 24, 2008
Enabling OpenSolaris Auditing without Device Allocation Today I needed to enable auditing on my OpenSolaris system to check some audit behaviour. However I didn't want device allocation enabled, I do want mass storage devices to still be automatically mounted particularly since I was doing this on my laptop, and also because I wasn't interested in anything other than the events in the 'lo' or 'ss' class (login/logout and system state change).
When bsmconv is run it turns on auditing (on next reboot) and disables the automatic mounting of mass storage devices. The later it does by updating the HAL configuration. I creates /etc/hal/fdi/policy/30user/90-solaris-device-allocation.fdi, this is an XML format file that HAL reads when it starts up.
So the simple fix to have auditing but not device allocation is this:
islay$ pfexec bsmconv # Answer y islay$ pfexec rm etc/hal/fdi/policy/30user/90-solaris-device-allocation.fdi
We really should split these things a part like we have been planning to do for quite some time.
( Jul 24 2008, 02:49:35 PM BST ) Permalink Comments [2]
Thursday June 26, 2008
A TX window without a label ? Opps ? What is going on here ?
Surely that editor window on the right hand side is a problem it doesn't have a sensitivity label on it ?
Answer is in the next picture:
This was a screenshot of Trusted Extensions running in VirtualBox with Seamless Windows mode turned on.The host was OpenSolaris 2008.05 (snv_91). Where I'm going next is to do it other other way around, so that the host is TX and the guest is also TX but with different label encodings.
What this does show is that even when TX is running as a virtualised guest the MLS enforcement for cut and paste still applies. The host was treated as "Trusted Path", which makes perfect sense in this case because it is the "hardware".
( Jun 26 2008, 05:37:12 PM BST ) PermalinkRole enhancements Proposal
Allowing role to same role over network
The current implementation of pam_roles has an "allow_remote" module argument that allows the role to be assumed over the network when PAM_AUSER is set. Currently only ssh with hostbased user authentication sets PAM_AUSER.
It also only allows user to role not role to (same) role. However I believe that "role to (same) role" is actually much more useful. Consider the following example case:
Helpdesk users login on a workstation/Sun Ray or something not even running Solaris. They ssh (using any userauth method) to some "Trusted Host". This "Trusted Host" then has network routes to the production machines. It is also possible that "Trusted Host" has some stronger initial user auth (eg, OTP or SecurID).
The helpdesk user assumes a role on "Trusted Host" (this is audited on Trusted Host, maybe also has additional PAM modules to determine when roles can be assumed).
The user (now with ruid of the role) then uses ssh to connect to the appropriate production host as the role.
If no auditing is in use the user doesn't even need to be known on the production host at all just the roles. Even if the user is known they don't need to be allowed to login (eg using pam_list).
This is a reasonably common and in my opinion very sensible architecture. I've heard of this existing at several sites.
This can actually be achieved today by manually editing a roles user_attr(4) entry so that it has a "roles=" entry for itself eg:
sysadm::::type=role;roles=sysadm;profiles=System Admin
However this can't be done using the rolemod(1M) or other admin tools since they currently believe that roles can't have roles.
A fix for this could be integrated into pam_roles so that "allow_remote" allows PAM_AUSER to be the role as well. However this now means that all roles can be remotely assumed by themselves. In my opinion that isn't any weaker a policy than what allow_remote already means.
It also makes sense to me that a role be allowed to "su - rolename" to itself - this has no audit impact but has the advantage of being a nice easy way to "clean" the environment. To allow that roles would need to be able to assume themselves regardless of the value of "allow_remote".
Allowing roles to have roles
In the general case, why can't a role have roles ?
I see no reason why not, in fact I can thing of many cases where allowing roles to have roles actually helps build a more understandable and usable policy.
Continuing with our helpdesk scenario above.
A slightly different implementation is that the user assumes the "helpdesk" role on their workstation and runs tools as helpdesk. Some of those tools need to remotely access production machines. However the users don't have accounts that can login on those remote machines. The only accounts that can login on the production machines are those that represent roles eg "dbadmin" and the "helpdesk" account.
In this case the "dbadmin" role is given to the "helpdesk" shared account as well as some of the core database team.
For this to work we need to allow roles (helpdesk) to have other roles (dbadmin).
Again I think this is a perfectly reasonable deployment case, and one that is already in use without roles. By making helpdesk and dbadmin roles we can increase the security. If we stick with the current "roles don't have roles" then we weaken the security because now one or both of the "helpdesk" and "dbadmin" would be deployed as normal user accounts.
Like above this is actually already possible by manually updating the user_attr(4) entries for the roles, eg
helpdesk::::type=role;roles=dbadmin dbadmin::::type=role;
To make this part of the proposal "official" requires updating the administrative interfaces. pam_roles doesn't need to be changed at all.
( Jun 26 2008, 11:41:45 AM BST )
Permalink
Friday May 23, 2008
VNC as OpenSolaris 2008.05 console Changing OpenSolaris 2008.05 to use Xvnc for the default X server rather than Xorg is really simple. OpenSolaris 2008.05 uses GDM as the graphical login manager. GDM starts the X server using /usr/X11/bin/X (a symlink to Xserver). The Xserver program in /usr/X11/bin uses SMF to store its configuration properties. This includes the location of the "real" (or "virtual" in our case) X server program.
To switch to Xnvc:
$ pfexec svccfg -s x11-server
svc:/application/x11/x11-server> setprop options/server = "/usr/X11/bin/Xvnc"
svc:/application/x11/x11-server> setprop options/server_args = astring: ("-SecurityTypes" "None")
svc:/application/x11/x11-server> setprop options/tcp_listen = true
svc:/application/x11/x11-server> end
$ pfexec svcadm restart gdm
Now use your VNC client to connect using the IP address of your OpenSolaris machine. You will get the OpenSolaris login screen. Note that we disabled VNC level security above, so lets now change things so that VNC only works over SSH port forwarding. We do this by telling the Xvnc server to only listen locally.
$ pfexec svccfg -s x11-server
svc:/application/x11/x11-server> setprop options/server_args = astring: ("-SecurityTypes" "None" "-localhost")
svc:/application/x11/x11-server> end
$ pfexec svcadm restart gdm
Now to connect we need to do somethink like this:
remotehost$ ssh -n -f -L5900:localhost:5900 opensolarishost sleep 100 remotehost$ vncviewer localhost
To switch back to a local X server:
$ pfexec svccfg -s x11-server svc:/application/x11/x11-server> setprop options/server = "/usr/X11/bin/Xorg" svc:/application/x11/x11-server>setprop options/server_args= "" svc:/application/x11/x11-server> setprop options/tcp_listen = false svc:/application/x11/x11-server>end $ pfexec svcadm restart gdm( May 23 2008, 05:46:10 PM BST ) Permalink Comments [2]
Friday May 09, 2008
Worst (and Best) keyboards Seems like for some reason I didn't actually post this when I wrote it on Jan 10th 2008, so I'll post it now
I've just read over the PC World "10 Worst Keyboards of all time" article. Out of the 10 there was only 3 I hadn't actually used (the IBM PCjr, the original PET, and the Atari 400. All the others I've actually used at least once. I found it interesting on the selection of the Sinclair keyboards, the ZX Spectrum one suffered all the same problems as the Timex 1000 but the metal "cover" also came off over time. I replaced the key membrane on my speccy at least once and upgraded the heat sink to try and stop it failing again (didn't really help in the long run)).
My current vote for the worst keyboard of all time is actually the iPhone/iTouch - yes it doesn't have a real keyboard but an on screen touch one instead, and the later lacks Bluetooth for connection of a "real" keyboard. I don't own an iPhone/iTouch just played with friends so maybe it gets better over time.
My favourite keyboard - Sun Microsystems Type 7 (USB) US UNIX layout. The layout is critical despite being a Brit I hate the UK keyboard layout with a passion it sucks for writing C or shell code because " and # get moved! The UNIX layout is also important so that Control is on the same row as return - caps lock has no use since I stopped writting COBOL code.
( May 09 2008, 09:11:58 PM BST ) Permalink Comments [7]Missing Apple Mac hardware
My current home machine is a first generation (ordered the day after the announcement) PPC Mac Mini. I initially ordered it with 512Mb RAM and no WiFi or Bluetooth. It has since been upgraded to 1G (the max this machine can take) and had the WiFi/Bluetooth added (and it now lives in the UK rather than California where it was bought). When I first bought it it was as a secondary machine to learn where MacOS was, I hadn't used MacOS since System 7 at that time. It soon became my our primary home desktop and got given gifts of a (wired) Mac keyboard and 20" Cinema screen in addition to its upgraded memory and wireless capabilities.
It has been serving us well but I feel like a new machine. While I love OpenSolaris and spend a huge number of hours developing for it and using it MacOS is what I want to continue using for my personal stuff for now (I like iTunes, iPhoto, Safari and more importantly so does my wife). So if the current PPC Mac Mini is to be repurposed it needs to be Apple hardware.
I titled this "Missing Apple Mac hardware", why ? I can't find a non laptop Mac that actually fits what I want in terms of computing resources and cost. Disk space isn't an issue I'd buy the machine in the lowest possible disk configuration because all my data is stored on a ZFS on a separate system running OpenSolaris and mounted on the Mac using NFS.
The best CPU/RAM combination I get buy on a current Intel Mac Mini is 2GHz and 2G RAM for £558. The next option is a Mac Pro and that starts at a wallet breaking £1,749, it is a nice workstation but out of budget for my desktop machine. There is Mac hardware in between that price range but with, for me, a fundamental problem because it has an integrated LCD and comes with a keyboard. Now integrated systems are great I remember fondly using the Sun ELC workstations at University and my current Sun machine at home (and the office) is a Sun Ray 270 (ultra thin client with integrated LCD). However I like my 20" Apple Cinema display and I want to keep using and it doesn't need to be replaced, same for the keyboard/mouse.
The Apple Mac I want to buy would have a CPU around 2.4 to 3GHz and 4G RAM, a single disk and a reasonable graphics card - this isn't a games machine (I use consoles or my phone for games these days) - for helping with photo processing. Of course it should be "green" in that it should allow me to reuse my existing LCD monitor and keyboard (both Apple products!). Pretty much something like a Sun Ultra 20M2but capable of legally running MacOS X 10.5 and for about that price
So Apple where is my missing Mac ?
Update: I know I can do dual monitor on with an iMac (first saw that on a mono SE30 with an external colour display and putting windows "across" the boundary it was done perfectly!) but I already have two monitors on the desk (the Sun Ray 270 mentioned above) and I don't really have space for another one. The big issue with the top end Mac Mini is the memory only goes to 2G according to Apple and some of that will be taken away by the Intel GMA graphics. One of the reasons I need at least 4G RAM is that there is always two users logged in (with fast user switching) to this machine. A bit of space to upgrade beyond 4G of RAM would be nice.
( May 09 2008, 09:10:25 PM BST ) Permalink Comments [6]
Wednesday April 30, 2008
Simple CLI based CA on Solaris With the recently added ability to sign PKCS#10 certificate request files the pktool(1) command of OpenSolaris can be used as a very simple Certificate Authority, similar to what can be done with the openssl(1) command but in my opinion in a much clearer way and actually providing stronger security. I'll outline the basic commands below but some external "database" will be needed to keep the serial number count and some other state needed to be a useful CA.
First Generate root CA - this is by definition self-signed
admin$ pktool gencert keystore=file outcert=myCA \ subject="CN=test,DC=EXAMPLE,DC=COM" serial=0x1 outkey=myCA.key
Generate a user CSR in PKCS#10 format
user$ pktool gencsr keystore=file outcsr=sample.p10 \ subject="CN=darren,OU=people,DC=EXAMPLE,DC=COM" outkey=sample.keyThe user then sends the PKCS#10 certificate request to the administrator for signing.
Sign the PKCS#10 CSR with the root CA
admin$ pktool signcsr keystore=file signkey=myCA.key csr=sample.p10 \ outcert=sample.cert format=pem serial=0x1001 issuer="CN=small-CA,DC=EXAMPLE,DC=COM"
Increasing the CA security
The above example stores the master CA key in a file but we can do better than that and store it in a PKCS#11 accessible hardware keystore. It would looks something like this:admin$ pktool gencert keystore=pkcs11 label=myCA \ subject="CN=test,DC=EXAMPLE,DC=COM" serial=0x1 Enter PIN for Sun Software PKCS#11 softtoken :
We now have the key in a PKCS#11 accessible keystore that is PIN protected, the sign operation is almost the same:
admin$ pktool signcsr keystore=pkcs11 signkey=myCA csr=sample.p10 \ outcert=sample.cert format=pem serial=0x1001 \ issuer="CN=small-CA,DC=EXAMPLE,DC=COM" Enter PIN for Sun Software PKCS#11 softtoken :
Note that we didn't explicitly specify the PKCS#11 token to use but pktool(1) allows us to do so.
Similarly the user can use a PKCS#11 keystore when they run gencert.
( Apr 30 2008, 03:25:00 PM BST ) Permalink
Tuesday February 19, 2008
Mercurial Links A few hopefully helpful links for OpenSolaris/JDK developers in the transition to mercurial (hg).
- Distributed revision control with Mercurial: http://hgbook.red-bean.com/hgbook.html
- Genunix.org Wiki on Mercurial: http://www.genunix.org/wiki/index.php/Mercurial
- Official Mercurial site: http://www.selenic.com/mercurial/wiki/
- webrev is being ported to mercurial by the OpenSolaris scm-migration project.
- My previous blogs on mercurial:
Monday February 04, 2008
isaexec(1) as a shell script
/usr/lib/isaexecis often used to provide automatic selection of a 32 vs 64 bit binary, however it can actually do much more than that it can pick between sparcv8+vis and sparcv8 for example. What it can't do in its distributed form is pick between SPARC and x86 variants because it is a 32 bit binary.
I wanted a single ~/bin in my home dir that could cope with 32 vs 64 and SPARC vs x86 and also allow me to have CPU capability variants as well, ie sparcv9+vis2 and a generic sparcv8 variant. So I rewrote isaexec as a simple shell script, I don't know how long ago I did this but it was probably some time during Solaris 7 development (which is when isaexec first appeared), anyway below is the shell script. I have subdirs in ~/bin for each cpu/architecture and all the binaries are links to ~/bin/isaexec.sh
#!/bin/ksh
fname=`basename $0`
pathname=`dirname $0`
if [ ! -x /usr/bin/isalist ]; then
arch=`arch`
if [ ! -x $pathname/$arch/$fname ]; then
echo "$0: cannot find the ISA list";
else
exec $pathname/$arch/$fname
echo "$0: cannon find/execute $fname in ISA subdirectories"
fi
fi
for isa in `/usr/bin/isalist` ; do
execpath="${pathname}/${isa}/${fname}"
if [ -x $execpath ]; then
exec $execpath "$@"
echo "$0 exec $execpath failed"
fi
done
echo "$0: cannon find/execute $fname in ISA subdirectories"
exit 1;
This far from perfect shell script from a performance view point and could probably use much more shell builtin functionality if ksh (or ksh93) was used instead.
( Feb 04 2008, 01:08:22 PM GMT ) Permalink Comments [1]
Tuesday January 15, 2008
War on Terror: ENOENT Via CRYPTO-GRAM I found this brief article from last month on how the UK government is changing the language it uses to describe terrorism. About bloody time, and IMO the UK government should have known better than to abuse the English language like this in the first place. I particularly like the "London is not a battlefield" quote from Sir Ken Macdonald (DPP), exactly because without a battlefield there never could have been a war (or even a conflict - I never understood why it was often referred to as the Falklands Conflict rather than war).
( Jan 15 2008, 01:23:12 PM GMT )
Permalink
Comments [1]
Friday January 04, 2008
Migrating a Teamware workspace to OpenSolaris.org hosted Mercurial Casper just asked me: "How do you put your own project workspace on opensolaris.org?. So I wrote up email describing how I do it. Since I thought it might be useful I've included a slightly reworded version of it here.
It has to be in either Mercurial or SubVersion. If it is a project targeting the ONNV consolidation then Mercurial is the choice.
First create a local clone of the Mercurial onnv-gate like this:
$ hg clone ssh://anon@hg.opensolaris.org/hg/onnv/onnv-gate myproject
Make sure your Teamware gate is at the same point. Now do a 'wx backup' of your teamware workspace.
Untar the ??.clear.tar file from the wx backup directory into the myproject directory.
Check this still builds - it should but you will need to get the closed-bins tar file that match your clone of onnv-gate since you don't have usr/closed.
If it all built find commit this to your local repository
$ hg commit
You now need to create a repository on opensolaris.org to host this. In your project page there is an "SCM Management" link that is shown only to project leads. Click that. On the left hand nav-column there will then be a link "Add Repository". Fill in the form.
The Anonymous here means allow anyone to pull from the repository, if you don't tick that then only people with an opensolaris.org account with loaded ssh keys can do a pull (I generally allow it as do most projects I believe). Project leads can always do a push, and you can delegate that to people who are listed as observers too.
The name you give is tagged on the end of your project URL. So if you say "gate" you will end up with:
"ssh://hg.opensolaris.org/hg/fgap/gate"
The notification email gets every push message, so choose wisely what you set this too. Some projects use a dedicated
You are now ready to push your changes so lets configure your local copy of your Mercurial repository with the paths. Add the following to the .hg/hgrc file in your myproject dir:
[paths] default=ssh://username@hg.opensolaris.org/hg/myproject/gate default-push=ssh://username@hg.opensolaris.org/hg/myproject/gate onnv-gate=ssh://anon@hg.opensolaris.org/hg/onnv/onnv-gate
Now lets do the push:
$ hg push
You now have a populated repository on opensolaris.org. To do a resync with onnv-gate you do something like this:
# Make sure you are in sync with the fgap project gate $ hg pull # Merge if needed $ hg merge # Now pull in the onnv-gate changes # if you want a specific build you can say -r onnv_80 after the pull # Note this uses the path alias we defined above to avoid using the full URL $ hg pull onnv-gate $ hg merge $ hg commit $ hg push
Hope this helps.
Note that for all this push/pull to work as your user you need to have your ssh pubkey uploaded for opensolaris.org. If you have ever voted you have done that already.
( Jan 04 2008, 03:47:00 PM GMT ) Permalink Comments [2]
This is a personal weblog, I do not speak for my employer.
