As I recall, on VMS, SYSPRV privilege was effectively granted to any
process whose UIC was in a “system” group. By default this was all UICs from [1,*] to [10,*] (octal), but I recall docs saying the upper limit was configurable.
I also recall that, when you woke up the login prompt, the LOGINOUT
process was created running under UIC [10,40]. I wonder if this was chosen
to ensure that sysadmins would never lower the upper bound below 10 octal, they could only raise it? Did the UIC [10,40] have any other significance? Perhaps something from RSX-11 days?
SYSGEN> help sys_para maxsysgroup
Sys_Parameters
MAXSYSGROUP
MAXSYSGROUP sets the highest value that a group number can have
and still be classified as a system UIC group number.
Here, LOGINOUT is running under [1,4] (usually assigned to the SYSTEM account).
On Fri, 7 Jun 2024 11:20:34 +0200, Hans Bachner wrote:
SYSGEN> help sys_para maxsysgroup
Sys_Parameters
MAXSYSGROUP
MAXSYSGROUP sets the highest value that a group number can have
and still be classified as a system UIC group number.
Did anybody ever assign UICs to users in the [2,*] ... [10,*] groups?
It seems to me that having lots of users with system-level privileges was
not a good idea back then, and is even less desirable nowadays.
DECnet like 376 and TCP/IP like 3655.
On Fri, 7 Jun 2024 08:04:49 -0400, Arne Vajhøj wrote:
DECnet like 376 and TCP/IP like 3655.
Just realized that the separation between usernames and UICs is actually another misfeature of VMS.
On *nix systems, a username is always understood to map to a particular
UID. Which one is not important, just so long as it isn’t zero. This
allows various subsystems to run under their own usernames with privilege isolation, without having to worry about UID clashes.
VMS allows multiple usernames with same UIC, but it practically
never happens.
On Fri, 7 Jun 2024 20:11:13 -0400, Arne Vajhøj wrote:
VMS allows multiple usernames with same UIC, but it practically
never happens.
The point being that privilege separation is done based on UIC, not
username. For example, on *nix, a daemon might start out as root and then call setuid(2) and friends to isolate the current process as a
nonprivileged user. The UID to use can be easily obtained by looking up a symbolic username in the /etc/passwd file. How would you do this on VMS?
On Fri, 7 Jun 2024 20:11:13 -0400, Arne Vajhøj wrote:
VMS allows multiple usernames with same UIC, but it practically
never happens.
The point being that privilege separation is done based on UIC, not
username.
For example, on *nix, a daemon might start out as root and then
call setuid(2) and friends to isolate the current process as a
nonprivileged user. The UID to use can be easily obtained by looking up a symbolic username in the /etc/passwd file. How would you do this on VMS?
On 8/6/24 10:26, Lawrence D'Oliveiro wrote:
The point being that privilege separation is done based on UIC, not
username.
And VMS does it by username.
$assume_persona system service and co. You'll find they're a little
more flexible than setuid. Example here:
https://www.eight-cubed.com/examples/framework.php?file=sys_persona.c
On 8/6/24 10:26, Lawrence D'Oliveiro wrote:
On Fri, 7 Jun 2024 20:11:13 -0400, Arne Vajhøj wrote:
VMS allows multiple usernames with same UIC, but it practically
never happens.
The point being that privilege separation is done based on UIC, not
username.
And VMS does it by username. Some UICs on VMS are defined to be in the system group. Some UIDs on unix are defined to be in the system group.
So what?
For example, on *nix, a daemon might start out as root and then
call setuid(2) and friends to isolate the current process as a
nonprivileged user. The UID to use can be easily obtained by looking up a
symbolic username in the /etc/passwd file. How would you do this on VMS?
How do you change username (and granted identifiers and/or UIC) on VMS?
$assume_persona system service and co. You'll find they're a little
more flexible than setuid. Example here:
https://www.eight-cubed.com/examples/framework.php?file=sys_persona.c
Or did you mean "how would you look up a UIC by username? From DCL, f$identifier lexical:
$ uic = f$identifier ("SYSTEM", "NAME_TO_NUMBER")
$ write sys$output f$fao ("!%U", uic)
[1,4]
$
From an executable, $getuai system service.
On VMS, to start something with privileges and permanently drop them
after initialization and *guarantee* that the process can never get them
back (unlike both setuid and the persona system services, which can both resume their "natural" id):
Set up a user with authorized privs of (for example) NETMBX, TMPMBX, and default privs of SYSPRV, NETMBX, TMPMBX.
When the process starts, it will have SYSPRV, but after dropping the privilege (set proc/priv=nosysprv in DCL, $setprv system service in a program), you cannot re-enable it. Use a captive (or restricted)
command procedure (or run a program without a command interpreter) to
ensure the process cannot retain or regain privs.
You would not do it that way on VMS.
Depending on the specific requirements you would probably
do one of:
- start daemon under a username with a minimum set of privs (if it just
need WORLD and SYSNAM, then it get just those)
- start the daemon under an unpriviliged username and install
executable with the minimum set of privs
- start the daemon under an unpriviliged username, don't install the executable with privs but let the program use an UWSS to do the
priviliged stuff
- start daemon under a username with SETPRV privilige and let the
program use SYS$SETPRV to turn required privs on and off dynamically
- start the daemon under an unpriviliged username and install
executable with with SETPRV privilige and let the programuse SYS$SETPRV
to turn required privs on and off dynamically
So many options.
If you really want to change identity, then there are a bunch of
utilities for it SETUSER, JUMP, PERSONA etc. - I assume that they
change both username and UIC.
BTW(1), UICs are a design that originated in the 1970s and quite probably earlier
"UIC" is a renaming of the concept of project-programmer number, or PPN, introduced in DEC systems with the PDP-6, DEC's first multiuser
mainframe product (April 1964 announcement, June 1964 FCS).
including everybody's favorite [0,0] directory, err, [000000].
And the auxiliary server (also known as inetd) is another common way to
get processes started under a particular context, as a newer version of
using DECnet task-to-task and objects as was common in yet older environments.
On 10 Jun 2024 16:26:20 -0400, Rich Alderson wrote:
"UIC" is a renaming of the concept of project-programmer number, or PPN,
introduced in DEC systems with the PDP-6, DEC's first multiuser
mainframe product (April 1964 announcement, June 1964 FCS).
So "PPN" was the term used in TOPS-10 (and whatever the PDP-6 precursor OS was), and also RSTS-11/RSTS/E, as well. It was decimal in the latter; was
it decimal or octal in the PDP-6/10?
"UIC" was the term used in RSX-11, and passed on from there into VMS. That was octal in both systems.
A separation of terminology indicating some kind of cultural separation within DEC itself?
On Mon, 10 Jun 2024 15:26:11 -0400, Stephen Hoffman wrote:
including everybody's favorite [0,0] directory, err, [000000].
I can remember that "[000000...]" was a valid directory wildcard spec, but "[0,0...]" was not.
Also remember "<" ... ">" was valid for directories, and a dot instead of semicolon for file versions, à la TOPS-10.
If you ever encountered a CompuServe ID, you were looking at a Tops-10
PPN in a different syntax.
RSX-15 was the original; RSX-11 was a reimplementation on the 16-bit hardware.
A separation of terminology indicating some kind of cultural
separation within DEC itself?
Since each product line was a separate culture, by design, that's
hardly surprising.
TOPS-20, not Tops-10.
... where a hierarchical directory specification could be up to 39
characters long, and a file name and file type string cold be up to
39 characters long. The version was a decimal number in the range
1--131071.
In the TENEX predecessor to TOPS-20, the separator for the version
number was a semicolon rather than a period.
On 11 Jun 2024 21:15:57 -0400, Rich Alderson wrote:
TOPS-20, not Tops-10.
Ah. So "< ... >" was an idea copied from BBN, not DEC home-grown?
Did TOPS-10 allow "( ... )" in place of "[ ... ]"? Because I remember
RSTS/E did.
... where a hierarchical directory specification could be up to 39
characters long, and a file name and file type string cold be up to
39 characters long. The version was a decimal number in the range
1--131071.
Signed 18-bit version numbers, of course.
Interesting that VMS should have reduced the filename length to 9-dot-3 (a
la RSX?) in initial versions, then increased it again to 39-dot-39 in VMS
V4.
In the TENEX predecessor to TOPS-20, the separator for the version
number was a semicolon rather than a period.
How odd that DEC should have changed it to a dot in TOPS-20, then brought back the other form as well for VMS ...
One little nicety about version specs was that the DELETE command insisted
on them, whereas most other commands didn't care. This was a subtle way of making file deletion take a little bit of extra mental effort to invoke,
as befitting its potentially dangerous status. (Better than those tedious "Are you sure?" confirmation messages that are all too commonly used.)
However, some users took this to mean you actually had to put an explicit version number in, when all you had to do was have the semicolon present
(or an extra dot), and that would mean "the most recent version" as usual.
Sysop: | Keyop |
---|---|
Location: | Huddersfield, West Yorkshire, UK |
Users: | 430 |
Nodes: | 16 (2 / 14) |
Uptime: | 146:24:09 |
Calls: | 9,065 |
Calls today: | 2 |
Files: | 13,402 |
Messages: | 6,019,404 |