From:	CRDGW2::CRDGW2::MRGATE::"SMTP::CRVAX.SRI.COM::RELAY-INFO-VAX" 10-OCT-1989 18:25
To:	MRGATE::"ARISIA::EVERHART"
Subj:	Re: Installing and privs.

Received: From UCBVAX.BERKELEY.EDU by GIZMO.SRI.COM with TCP; Tue, 10 OCT 89 14:39:19 PDT
Received: by ucbvax.Berkeley.EDU (5.61/1.37)
	id AA22151; Tue, 10 Oct 89 14:14:38 -0700
Received: from USENET by ucbvax.Berkeley.EDU with netnews
	for info-vax@kl.sri.com (info-vax@kl.sri.com)
	(contact usenet@ucbvax.Berkeley.EDU if you have questions)
Date: 10 Oct 89 19:55:38 GMT
From: crdgw1!brspyr1!dave@uunet.uu.net  (Dave Roddy)
Organization: BRS Info Technologies, Latham NY
Subject: Re: Installing and privs.
Message-Id: <6404@brspyr1.BRS.Com>
References: <503*dahls@vax.elab.unit.uninett>
Sender: info-vax-request@kl.sri.com
To: info-vax@kl.sri.com

From article <503*dahls@vax.elab.unit.uninett>, by dahls%vax.elab.unit.uninett@NAC.NO (Joern Yngve Dahl-Stamnes):
> Hello netlanders.
> 
> Problem:
> A program will turn on SYSPRV priv when needed and later turn it off again.
> But this should only be done if the image is installed with SYSPRV, *not* if
> the user (ie. the system manager) have the rights to turn it ON.
> 
> How can I find out witch privs. an image is installed with from within the
> image?

The following can be used to obtain the privileges of both the user process
and the image being run.  This module is written in VAX-C and is used to
determine if the user is authorized to have CMKRNL and if the image being
run is installed with the privilege of SYSLCK.

Please note that several include files are NOT included.  They contain some
macros and definitions of structures.

/*************************** CUT HERE ***************************/
/*
**	Include files
*/
#include <stdio.h>
#include <jpidef.h>
#include <prvdef.h>
#include <ssdef.h>
#include "brs.h"
#include "exit.h"
#include "vmsdef.h"

/*
**	Globals
*/
int vxio_flags = VX_DFW;		/* vxio info flags */
struct vms_secure vms_secinfo = { 0 };	/* secure search info */

vms_jpi (ptr)

char *ptr;
{
	unsigned long rc;		/* return code */
	struct quad_struct authpriv;	/* authorized privileges for user */
	struct quad_struct imagepriv;	/* image privileges */
	struct item_struct itmlst[3];	/* item list */

	/* set up item-list */

	imagepriv.num1 = 0;
	imagepriv.num2 = 0;

	itmlst[0].buf_len = 8;			/* want the images privs */
	itmlst[0].item_code = JPI$_IMAGPRIV;
	itmlst[0].buf_addr = &imagepriv;
	itmlst[0].ret_addr = 0;

	authpriv.num1 = 0;
	authpriv.num2 = 0;

	itmlst[1].buf_len = 8;			/* want user authorized privs */
	itmlst[1].item_code = JPI$_AUTHPRIV;
	itmlst[1].buf_addr = &authpriv;
	itmlst[1].ret_addr = 0;

	itmlst[2].buf_len = 0;			/* end itmlst */
	itmlst[2].item_code = 0;
	itmlst[2].buf_addr = 0;
	itmlst[2].ret_addr = 0;

	rc = sys$getjpiw(0,0,0, itmlst, 0,0,0);

	if (rc != SS$_NORMAL) {
		/* unable to determine the privilege */

		fprintf(stderr,"Improper Installation -- code (03)\n");
		fprintf(stderr,"	Contact your system administrator\n");

		EXIT(X_TRAGIC);
		}

	if (authpriv.num1 & PRV$M_CMKRNL) {
		/* user was authorized for CMKRNL before starting Search */

		vxio_flags |= VX_CMKRNL;
		}
	else {
		/* user not previously authorized for CMKRNL */

		vxio_flags &= ~VX_CMKRNL;
		}

	if (ptr == NULL) {
		/* no VMS:SYSLCK= entry */

		return(0);
		}

	if (*ptr != 'Y' && *ptr != 'y') {
		/* VMS:SYSLCK= not set to YES */

		return(0);
		}

	if (imagepriv.num1 & PRV$M_SYSLCK) {
		/* image has syslck privilege */

		vxio_flags |= VX_SYSLCK;
		}
	else {
		/* error - do not have SYSLCK priv */

		vxio_flags |= VX_NOSYSLCK;
		}

	return(0);	
}
-- 
Dave Roddy		UUCP: dave@brspyr1
BRS Information Technologies Latham, N.Y. 12110 (518) 783-1161	
USENET: uunet!steinmetz!brspyr1!dave

