From:	CSBVAX::MRGATE!RELAY-INFO-VAX@CRVAX.SRI.COM@SMTP 18-AUG-1988 16:16
To:	ARISIA::EVERHART
Subj:	Changing Process Privileges PERMANENTLY


Received: From KL.SRI.COM by CRVAX.SRI.COM with TCP; Thu, 18 AUG 88 11:54:38 PDT
Received: from CUNYVM.CUNY.EDU by KL.SRI.COM with TCP; Thu, 18 Aug 88 11:44:30 PDT
Received: from GRIN1.Bitnet by CUNYVM.CUNY.EDU (IBM VM SMTP R1.1) with BSMTP id 8653; Thu, 18 Aug 88 14:43:09 EDT
Date: Thu, 18 Aug 88 13:43:55 cdt
From: "The Sysco Kid (McGuire,Ed)" <MCGUIRE%GRIN1.BITNET@CUNYVM.CUNY.EDU>
To:   info-vax@kl.sri.com
cc:   prindiville@%ccrs.cdn@relay.cs.net,
      mgrrws%vms.rose-hulman.edu@cornellc.ccs.cornell.edu,
      "McGuire,Ed" <MCGUIRE@GRIN1.Bitnet>
Subject: Changing Process Privileges PERMANENTLY

> Date: Tuesday, August 16, 1988 at 3:18 pm est
> From: "Robert W. Shew" <MGRRWS%VMS.Rose-Hulman.Edu@CORNELLC.CCS.CORNELL.EDU>
> Subj: Changing Process Privileges PERMANENTLY
>
> For John Edgecombe (and any other interested parties)...
>
> Simply change the privileges in the MOVQ statements to the privileges
> you need.

Robert,

Thanks for publishing your privilege changing program.  I'm an interested
party!  It was enlightening to see how to change any of the four process
privilege masks.  I'm following up because I'm not certain your program
satisfies the original query's requirements.

* Soapbox ON *

First, it changes the privileges by writing them directly to VMS data
structures which are not necessarily the most stable.  For John's project I'd
suggest using the documented method of changing the permanent process
privileges (PROCPRIV) by calling $SETPRV in exec or kernel mode.

Second, it requires CMKRNL privilege in the current process.  I imagine that
John's users will not want CMKRNL active at all times.  I'd suggest installing
the program with CMEXEC privileges, which are the minimum required, and remove
the lines that turn on CMKRNL privilege.

Third, it seemed to me that John required different usernames to have differing
privilege.  I would find the username in a data file and grant privileges
specified in the file.  This permits variance in the authorized privileges for
different usernames.  Furthermore, I would add a DCL command and parse a
/PRIVILEGES= qualifier rather than just turning on the whole set of privileges.

---

As a footnote to my second point, I recommend that the general practice be to
require the privilege to be already active, either in process privileges or
image privileges.  VMS utility programs follow this practice.

Similarly, I suggest that any program which requires a special privilege always
drop its image privileges immediately, and only regain them when needed for a
privileged operation.  This lessens the probability that someone will subvert a
program installed with privileges, providing it with input that causes it to
perform a security-breaking function such as rewriting a protected file.

* Soapbox OFF *

Attached are two utility functions which lower and raise image privileges.  The
former resets any privileges which are present only in the process' image
privilege mask (IMAGPRIV), and the latter sets those same privileges.  The code
has been detabbed for transmission using the Software Tools detab utility.

Ed

P.S.  If anyone has improvements to suggest in these functions, I'd like to
      hear about it.  I'm no MACRO programming guru!

------------------------------- Cut here ---------------------------------------
        .TITLE          GC_IMAG         Drop and raise image privileges
        .IDENT          /1-001/
;+
; FACILITY:     Grinnell College Procedure Library
;
; ABSTRACT:     This module contains procedures GC_DROP_IMAG and GC_GAIN_IMAG,
;               which drop and regain image privileges.
;
; ENVIRONMENT:  User mode, AST-reentrant.  Note carefully, however, that any
;               thread of concurrent execution (such as an AST handler) can
;               make no assumption about the initial state of process privi-
;               leges; and, if it changes process privileges (using these
;               procedures or by any other means), it must restore previous
;               privileges before passing control back to its parent or to
;               any coroutine.
;
; AUTHOR:       Edward K. McGuire       CREATION DATE:  14-MAY-1986
;
; MODIFIED BY:
; 1-001  EKM  14-MAY-1986       Original.
;-
;+
; Define JPI item codes.
;-
        $JPIDEF
;+
; Define macro to test for error in system service.
;-
        .MACRO          TESTERR ADDRESS,?LABEL
        BLBS            ADDRESS,LABEL
        RET
LABEL:
        .ENDM
;+
; An ITMLST, IOSB, and return buffer are allocated on the stack by each
; procedure, using R2 as an offset.  This is a map of the structure:
;
;               +-----------------------+-----------------------+
;        0(R2)  | ITMLST.ITEM-CODE      | ITMLST.BUFFER-LENGTH  |
;               +-----------------------+-----------------------+
;        4(R2)  | ITMLST.BUFFER-ADDRESS                         |
;               +-----------------------------------------------+
;        8(R2)  | ITMLST.RETURN-LENGTH-ADDRESS                  |
;               +-----------------------------------------------+
;       12(R2)  | 0 (ITMLST TERMINATOR)                         |
;               +-----------------------------------------------+
;       16(R2)  | IOSB.CONDITION-VALUE                          |
;               +-----------------------------------------------+
;       20(R2)  | IOSB.RESERVED-TO-DIGITAL                      |
;               +-----------------------------------------------+
;       24(R2)  |                                               |
;               | PRIV-MASK                                     |
;       28(R2)  |                                               |
;               +-----------------------------------------------+
;-
        .PAGE
        .PSECT          _GC_CODE,NOWRT,PIC,SHR
        .ENTRY          GC_DROP_IMAG,^M<R2>
;++
; FUNCTIONAL DESCRIPTION:
;
;       Clear image privileges (IMAGPRIV) by setting process privileges
;       (PROCPRIV) in current privileges, then clearing the one's complement
;       of PROCPRIV in current privileges.
;
; CALLING SEQUENCE:
;
;       COND_VALUE = GC_DROP_IMAG
;
; FORMAL ARGUMENTS:     NONE
;
; IMPLICIT INPUTS:      NONE
;
; IMPLICIT OUTPUTS:     NONE
;
; COMPLETION CODES:
;
;       Any code returned by $GETJPIW or $SETPRV
;
; SIDE EFFECTS:
;
;       Changes process privileges.
;
;--
        SUBL2           #32,SP          ; Allocate storage on stack
        MOVL            SP,R2           ; Use R2 for offset into storage
        MOVW            #8,(R2)         ; Buffer length (QUAD)
        MOVW            #JPI$_PROCPRIV,2(R2)    ; Item code
        MOVAL           24(R2),4(R2)    ; Buffer address
        CLRQ            8(R2)           ; Return length address, terminator
;+
; Get PROCPRIV into buffer.
;-
        $GETJPIW_S      ITMLST=(R2), IOSB=16(R2)
        TESTERR         R0
        TESTERR         16(R2)
;+
; Set PROCPRIV into current privileges.
;-
        $SETPRV_S       PRVADR=24(R2), ENBFLG=#1
        TESTERR         R0
;+
; Complement and clear all privileges not set in PROCPRIV.
;-
        MCOML           24(R2),24(R2)
        MCOML           28(R2),28(R2)
        $SETPRV_S       PRVADR=24(R2), ENBFLG=#0
        RET
        .PAGE
        .PSECT          _GC_CODE,NOWRT,PIC,SHR
        .ENTRY          GC_GAIN_IMAG,^M<R2>
;++
; FUNCTIONAL DESCRIPTION:
;
;       Set image privileges (IMAGPRIV) in current privileges.
;
; CALLING SEQUENCE:
;
;       COND_VALUE = GC_GAIN_IMAG
;
; FORMAL ARGUMENTS:     NONE
;
; IMPLICIT INPUTS:      NONE
;
; IMPLICIT OUTPUTS:     NONE
;
; COMPLETION CODES:
;
;       Any code returned by $GETJPIW or $SETPRV
;
; SIDE EFFECTS:
;
;       Changes process privileges.
;
;--
        SUBL2           #32,SP          ; Allocate storage on stack
        MOVL            SP,R2           ; Use R2 for offset into storage
        MOVW            #8,(R2)         ; Buffer length (QUAD)
        MOVW            #JPI$_IMAGPRIV,2(R2)    ; Item code
        MOVAL           24(R2),4(R2)    ; Buffer address
        CLRQ            8(R2)           ; Return length address, terminator
;+
; Get IMAGPRIV into buffer.
;-
        $GETJPIW_S      ITMLST=(R2), IOSB=16(R2)
        TESTERR         R0
        TESTERR         16(R2)
;+
; Set IMAGPRIV into current privileges.
;-
        $SETPRV_S       PRVADR=24(R2), ENBFLG=#1
        RET
        .END
------------------------------- Cut here ---------------------------------------

