NAME

       lcmaps_posix_enf.mod - LCMAPS plugin to switch user identity

SYNOPSIS

       lcmaps_posix_enf.mod  [-maxuid  number  of  uids]  [-maxpgid  number of primary gids] [-maxsgid number of
       secondary gids]

DESCRIPTION

       The Posix Enforcement plugin will enforce (apply) the  gathered  credentials  that  are  stacked  in  the
       datastructure  of the Plugin Manager.  The plugin will get the credential information that is gathered by
       one or more Acquisition plugins. This implies that at least one Acquisition should have been run prior to
       this  Enforcement.   All of the gathered information will be checked by looking into the 'passwd' file of
       the system (FIXME: shouldn't that be getpwent(2)?).  These files have information  about  all  registered
       system account and its user groups.

       The  Posix  Enforcement  plugin  does  not  check  whether the secondary groups have the primary UID as a
       member, so it is possible to end up with more group  memberships  than  what  is  defined  in  the  group
       database.

       The  (BSD/POSIX) functions setreuid(2), setregid(2) and setgroups(2) are used to change the privileges of
       the process from root to that of a local user.

OPTIONS

       -maxuid number of uids
              In principle, this will set the maximum number of allowed UIDs that this plugin will  handle,  but
              at  the  moment  only the first UID found will be enforced; the others will discarded.  By setting
              the value to a maximum there will be a failure raised when the  amount  of  UIDs  exceed  the  set
              maximum.  Without  this value the plugin will continue and will enforce only the first found value
              in the credential data structure.

       -maxpgid number of primary gids
              This will set the maximum number of allowed Primary GIDs that this plugin will handle, similar  to
              -maxuid.  Also here only the first primary GID found will be taken into account.

       -maxsgid number of secondary gids
              This  will  set  the  maximum allowed Secondary GIDs that this plugin will handle.  This number is
              limited by the system (NGROUPS) and is usually 32. If  the  plugin  cannot  determine  the  system
              value, it limits itself to 32.

       The  remaining  options are considered dangerous, as they have the potential to allow a client process to
       gain root privileges.  The use of these options is strongly discouraged.

       -set_only_euid {yes|no}
              The result of setting this option to 'yes' is that only the effective uid is set.  In other words,
              it  is  still  possible  to  regain  root  (uid)  privileges  for the process.  This is definitely
              undesirable if this module is used from a process like the gatekeeper, since it would be  possible
              for user jobs to get root privileges.

       -set_only_egid {yes|no}
              Analogue  to  the  previous  option  the  result  of setting this option to 'yes' is that only the
              effective (primary) gid is set.  In other words,  it  is  still  possible  to  regain  root  (gid)
              privileges  for the process.  This is definitely undesirable if this module is used from a process
              like the gatekeeper, since it would be possible for user jobs to  get  root  privileges.  Possibly
              this option should be set if the module is used by gridFTP, since this service does not spawn user
              jobs and has to regain root pivileges at the end.

RETURN VALUES

       LCMAPS_MOD_SUCCESS
              Success.

       LCMAPS_MOD_FAIL
              Failure.

BUGS

       Please  report  any  errors  to   the   Nikhef   Grid   Middleware   Security   Team   <grid-mw-security-
       support@nikhef.nl>.

SEE ALSO

       lcmaps.db(5), lcmaps(3), getpwent(3), getgrent(3), setreuid(2), setregid(2), setgroups(2).

AUTHORS

       LCMAPS   and   the  LCMAPS  plug-ins  were  written  by  the  Grid  Middleware  Security  Team  <grid-mw-
       security@nikhef.nl>.

                                                 March 22, 2011                              LCMAPS_POSIX_ENF(8)