Controlling access to data is a key concern of
computer security. In SD-UX, file owners and superusers allow or deny
access to files on a need-to-know basis by setting or manipulating
the file’s permission bits to grant or restrict access by owner,
group and others. For example, the following file listing:
-rwxr-xr 1 doug admin 738 Mar 26 12:25 datafile
shows that:
Name of the file is datafile.
Owner permissions are read, write and execute (rwx).
Group permissions are read and execute (r-x).
Other permissions are read only (r-).
SD-UX commands are essentially object managers
that use the SD-UX file system in which to store their objects. There
is no need to obtain access to any objects via the file system, so
the file system protection scheme is based on blocking access to the
file system directories that store these objects.
In addition to SD-UX objects, there are several
administrative files (log, configuration, and session files) that
are used or managed by SD-UX. These files are not actually SD-UX objects
and are accessible via conventional commands such as editors and printing
utilities. These files are protected by conventional file system protection
modes.
Many of the functions that the SD-UX agents do
are privileged. Some operations, such as installing files in system
directories (e.g., in the /etc and /dev directories) and customization of system files
via control scripts, require superuser privileges. For this reason,
SD-UX agents must always run as the superuser.
Any system user may run the SD-UX controller;
it is not restricted to use only by superuser. In general, the controller
does its work by making Remote Procedure Calls (RPC) to target hosts,
but it also requires special privileges occasionally to access critical
log, configuration, and session security files. Controllers are set-uid root programs that run with the superuser
privilege in effect only briefly to do critical privileged operations,
then they switch to the real uid of
the user.
Here is a summary of the SD-UX file system protection
scheme:
SD-UX files are protected
from access by anyone other than the superuser by having the group
and other permissions of crucial directory modes set to 0.
Only agents and daemons
running on the local host access SD-UX files directly. All other facilities
(controllers, utilities, etc.) go through the agents using RPC to
indirectly access files. The agent or daemons perform authentication
and authorization checks on all such operations.
No hard links may exist
that circumvent the directory protection hierarchy of the SD-UX directories
nor may symlinks exist that compromise the secrecy of the contents
of those directories containing objects that might have list restrictions
in effect. Use of only a single (canonical) path to SD-UX objects
avoids any such aliasing problems.
Thus, the SD-UX files are totally protected and
hidden from non-superuser access.
Printable version
