TRUSTED EXTENSIONS MEDIATION 107 Operating Systerm Security

110 CHAPTER 8. CASE STUDY: SOLARIS TRUSTED EXTENSIONS their programs such that they are only running with privileges when they are needed. Even more importantly, programs can not only enable or disable their privileges, but they can also drop any privileges granted to them assuming they will not be needed and even relinquish them so they can no longer be used when there is no longer a need for the privilege. Just as importantly, programs can also restrict which of their privileges can be passed along to their children e.g., programs that they execute. In the Solaris operating environment many setuid programs e.g., ping, traceroute, rmformat and system services e.g., nfsd, ftpd, mountd use these techniques. Each process has a Privilege Awareness State PAS that can take the value PA privilege- aware and NPA not privilege-aware. PAS is a transitional mechanism that allows a choice between full compatibility with the old superuser model and completely ignoring the effective UID. To facili- tate the discussion, we introduce the notion of observed effective set oE and observed permitted set oP and the implementation sets iE and iP . A process becomes privilege-aware either by manipulating the effective, permitted, or limit privilege sets through the setppriv or setpflags system calls. In all cases, oE and oP are invariant in the process of becoming privilege-aware. In the process of becoming privilege-aware, the following assignments take place: iE = oE 8.1 iP = oP 8.2 When a process is privilege-aware, oE and oP are invariant under UID changes. When a process is not privilege-aware, oE and oP are observed as follows: oE = euid == 0 ? L : iE 8.3 oP = euid == 0||ruid == 0||suid == 0 ? L : iP 8.4 When a non-privilege-aware process has an effective UID of 0, it can exercise the privileges contained in its limit set, the upper bound of its privileges. If a non-privilege-aware process has any of the UIDs 0, it will appear to be capable of potentially exercising all privileges in L. It is possible for a process to return to the non-privilege aware state, which the kernel will always attempt on exec. This operation is permitted only if the following conditions are met: • If any of the UIDs is equal to 0, P must be equal to L. • If the effective UID is equal to 0, E must be equal to L. When a process gives up privilege awareness, the following assignments take place: if euid == 0 iE = LI 8.5 if anyuid == 0 iP = LI 8.6

8.4. PROCESS RIGHTS MANAGEMENT PRIVILEGES 111