F$SETPRV and SYS_SETPRV

This UCL lexical function can set the current process' active privileges. Here is the definition.

F$SETPRV enables or disables one or more user privileges. It returns a list of the current user privileges. A privilege can only be enabled if the user is authorized to have that privilege.

Format
F$SETPRV(privileges)

Return Value
A string containing the privileges for the current process before they were changed by the F$SETPRV function.

Arguments
privileges

A string containing one or more privilege names. If multiple privileges are provided, they must be delimited by commas (,).

Description
The F$SETPRV lexical function invokes the SETPRV system service to enable or disable specific user privileges. It returns a list of user privileges that represent the state of the specified privileges that were held by the process before F$SETPRV was executed. That list can be passed to F$SETPRV to reset the privileges to their original state. Note that attempting to set privileges not authorized to the user will fail.

Example
$ OLDPRIVS = F$SETPRV("BYPASS,GRPPRV")

In this example, OLDPRIVS is set to the current state of the BYPASS and GRPPRV privileges, and the BYPASS and GRPPRV privileges are set.

        Function_SETPRV : begin
                              if( Missing_Parentheses( '(' ) ) then
                              begin
                                  exit ;
                              end ;
                              if( Process_Setprv( Err, Context ) ) then
                              begin
                                  exit ;
                              end ;
                              if( Missing_Parentheses( ')' ) ) then
                              begin
                                  exit ;
                              end ;
                              S := Context ;
                          end ;

This code is added to the Function_Reference.

function Process_Setprv( var Err : integer ; var Context : string ) : boolean ;

var I : integer ;
    P : int64 ;
    Newprivs, S : string ;
    DMask, EMask, Current : int64 ; // Privilege masks to disable, enable, and what is current

begin
    // Setup...
    Result := False ; // Assume no problems
    Context := '' ;

    // Get parameters...
    Newprivs := uppercase( trim( Get_Parameter( Err, Context ) ) ) ;
    if( Err <> 0 ) then
    begin
        exit ;
    end ;
    if( length( Newprivs ) = 0 ) then
    begin
        exit ;
    end ;

This new function obtains the parameter. If the parameter is null, we exit because there is nothing to be done.

    // Get current privileges...
    S := Get_JPI( 0, JPI_CURPRIV ) ;
    Current := Get_Integer_From_String( S ) ;

    // Process the specific privileges...
    DMask := 0 ;
    EMask := 0 ;

Next, we ask for the current process privileges via the GETJPI system service and set Current to that privilege mask. Then we prepare to iterate through the privileges passed to the function.

    I := pos( ',', Newprivs + ',' ) ;
    while( length( Newprivs ) > 0 ) do
    begin
        // Get next privilege in list...
        S := trim( copy( Newprivs, 1, I - 1 ) ) ;
        Newprivs := copy( Newprivs, I + 1, length( Newprivs ) ) ;

        // Process the privilege...
        if( copy( S, 1, 2 ) = 'NO' ) then
        begin
            S := copy( S, 3, length( S ) ) ;
            P := String_To_Privilege( S ) ;
            if( P = 0 ) then
            begin
                Err := UCL_IVKEYW ;
                Context := S ;
                exit ;
            end ;
            DMask := DMask or P ;
        end else
        begin
            P := String_To_Privilege( S ) ;
            if( P = 0 ) then
            begin
                Err := UCL_IVKEYW ;
                Context := S ;
                exit ;
            end ;
            EMask := EMask or P ;
        end ;

Now we iterate through the specified privileges. First we extract the next privilege name in the string (delimited by a comma). If the first two characters are "NO", this is the negation of a privilege name. In that case, we trim the "NO" and then get the privilege flag value. If the privilege name is invalid, P will be 0 - in which case we exit with an error. Otherwise, we add the flag to the DMask. If the name doesn't start with "NO", we get the flag and add it to the EMask variable (exiting if the privilege name is invalid).

        // Build result string...
        if( length( Context ) > 0 ) then
        begin
            Context := Context + ',' ;
        end ;
        if( ( Current and P ) = 0 ) then
        begin
            Context := Context + 'NO' ;
        end ;
        Context := Context + Privileges_To_String( P ) ;

        // Find end of next privilege name
        I := pos( ',', Newprivs + ',' ) ;
    end ; // while( length( Newprivs ) > 0 )

Next, we see if the privilege flag is already set in the current privileges. If so, we add the name to the result string (Context). If not, we add the name to the result string, prefixed with "NO". If this isn't the first time through the loop, we add a comma before the new name.

    // Enable privileges...
    if( EMask <> 0 ) then
    begin
        SYS_SETPRV( 1, int64( @EMask ), 1, 0 ) ;
    end ;

    // Disable privileges...
    if( DMask <> 0 ) then
    begin
        SYS_SETPRV( 0, int64( @DMask ), 1, 0 ) ;
    end ;
end ; // Process_Setprv

Now, we call the SYS_SETPRIV service to enable anything in the EMasks bitmask (assuming it is non-zero). Then we call the service to disable anything in DMasks.

Now let's look at the definition of the SETPRV service, and then it's code.

The SETPRV service enables or disabled the specified privileges for the calling process.

Format
SYS_SETPRV(enflag, privaddr, permanent, curprivaddr)

Arguments
enflag

If 0, the passed privileges are disabled. If 1, the passed privileges are enabled. If any other value is passed, an error is returned.

privaddr

Address of the 64-bit privilege mask indicating which privileges to enabled or disable.

permanent

Indicates whether the privilege change should affect the current image (value of 0), or the process privileges (value of 1.) In the case of permanent privileges being affected, both the process privileges and current privileges are affected.

curprivaddr

Address of where to return the current privilege mask prior to the requested changes. If 0, the current privileges are not returned. The value of the permanent parameter indicates if the current image privileges or the current process privileges are returned.

Description
This system service enables or disabled privileges. When a process is created, the user authorized privileges, process authorized privileges, and current privileges are all set to the UAF privilege mask defined for the user (thus, they are all the same).

SETPRV cannot change the user authorized privileges. Only privileges existing in the user authorized privileges can be set, unless the user authorized privileges include the SETPRV privilege. Any other privileges not in the user authorized privileges bitmask cannot be changed by this service.

When an image is run, any privileges assigned to that image are combined with the current process privileges until the image ends - at which point the process privileges are copied to the current privileges. While the image is running, this service can only be used to modify privileges possessed in the user authorized privileges and/or the privileges authorized for the image. The following table lists the UOS privileges:

Privilege Description

ACNT Allows creation of processes in which accounting is disabled

ALLSPOOL Allows allocation of a spooled device

ALTPRI Allows process to increase its own priority, set the base priority of a target process, and change the priority of its batch and print jobs

AUDIT Allows appending audit records to the system security audit log file

BUGCHK Allows bugcheck error log entries from user, supervisor, or compatibility mode or to send messages to the system error logger

BYPASS Disregard protection

CMEXEC Change to executive mode

CMKRNL Change to kernel mode

DETACH Create detached processes of arbitrary UIC

DIAGNOSE Diagnose devices

DOWNGRADE Write to a lower secrecy object or lower an object's classification

EXQUOTA Allows exceeding any disk volume usage quotas set for the user's account

GROUP Allow control of other processes in its own group(s)

GRPNAM Allows bypassing discretionary access controls on the system logical name tables in order to insert names into, or delete names from, the logical name table for the group(s) that the process belongs to

GRPPRV Allows process with the same group as the object owner the access rights provided by the object's system protection field

IMPORT Mount a nonlabeled tape volume

LOG_IO Issue logical I/O requests

MOUNT Execute mount volume QIO

NETMBX Allow network operations

OPER Allows use of the OPCOM process to reply to users' requests, broadcast messages to all terminals, designate terminals as operator's terminals, etc

PFNMAP Map to specific physical pages

PHY_IO Issue physical I/O requests

PRMCEB Allows creation or deletion of permanent common event flag clusters

PRMGBL Allows creation or deletion of permanent global sections

PRMMBX Allows creation or deletion of a permanent mailbox

PSWARM Allows controlling whether the process can be swapped out of the balance set

READALL Bypass existing restrictions to read an object

SECURITY Allows security-related functions such as modifying the system password or security audit settings

SETPRV Enable any privilege

SHARE Access devices allocated to other users

SHMEM Allows creation of global sections and mailboxes in memory shared by multiple processors if process has other appropriate privileges.

SYSGBL Create system-wide global sections

SYSLCK Allows locking system-wide resources or obtaining information about a system-wide resource

SYSNAM Insert system logical names in the name table

SYSPRV Access objects through system protection field

TMPMBX Allow temporary mailbox creation

UPGRADE Write to a higher integrity object or raise an object's integrity level

VOLPRO Override volume protection

WORLD Allows process to affect other processes on the system

Condition Values Returned

SS_NORMAL All privileges were enabled or disabled as requested.

SS_NOTALLPRIV One or more of the specified privileges were not changed.

SS_IVSTSFLG A value other than 0 or 1 was passed to the permanent or enflag paramters.

function SYS_SETPRV( Flag, Privs, Permanent, PrivAddr : int64 ) : int64 ;

var Status : int64 ;
    SysRequest : TInteger4_Request ;

begin
    Status := 0 ;
    fillchar( SysRequest, sizeof( SysRequest ), 0 ) ;
    SysRequest.Request.Subsystem :=  UOS_Subsystem_USC ;
    SysRequest.Request.Request := UOS_USC_SetPrv ;
    SysRequest.Request.Length := sizeof( SysRequest ) - sizeof( TSystem_Request ) ;
    SysRequest.Request.Status := integer( @Status ) ;
    SysRequest.Int1 := Flag ;
    SysRequest.Int2 := Privs ;
    SysRequest.Int3 := Permanent ;
    SysRequest.Int4 := PrivAddr ;

    Call_To_Ring0( integer( @SysRequest ) ) ;

    Result := Status ;
end ;

This is the SYS unit interface to the SETPRV system service.

        UOS_USC_SETPRV:
            begin
                UE := Enter_System_Call( Request, SReq, PID, MMC, 
                    sizeof( TInteger4_Request ) - sizeof( SReq ), Address ) ;
                if( UE <> nil ) then
                begin
                    Set_Last_Error( UE ) ;
                    exit ;
                end ;
                try
                    I4_Request := PInteger4_Request( Address ) ;
                    Set_Privileges( 0, I4_Request.Int1, I4_Request.Int2, I4_Request.Int3, I4_Request.Int4 ) ;
                finally
                    Exit_System_Call( Request, PID, MMC, sizeof( TItem_Request ) - sizeof( SReq ) ) ;
                end ;
            end ;

We add this code to the USC.API method.

function TProcess.User : TUser ;

begin
    if( This_User = nil ) then
    begin
        This_User := Get_User( _User ) ;
        User_Authorized_Privileges := This_User.Auth_Privileges ;
        Authorized_Privileges := This_User.Privileges ;
        Current_Privileges := Authorized_Privileges ;
    end ;
    Result := This_User ;
end ;

We've added the setting of privileges to this function.

function TUSC.Set_Privileges( PID : TPID ;
    Flag, Privs, Permanent, PrivAddr : int64 ) : int64 ;

var Original : int64 ;
    Process : TProcess ;
    Status : integer ;

begin
    // Setup...
    Result := 0 ;
    if( PID = 0 ) then
    begin
        PID := Kernel.PID ;
    end ;
    Process := Get_Process( PID ) ;
    if( Process = nil ) then
    begin
        Generate_Exception( UOSErr_Nonexistent_Process ) ;
        exit ;
    end ;
    if( ( Permanent <> 0 ) and ( Permanent <> 1 ) ) then
    begin
        Result := SS_IVSTSFLG ;
        exit ;
    end ;

This new method handles the SETPRV service. First, we get the process, exiting if we couldn't get the instance. We also verify that the Permanent parameter is either 0 or 1.

    // Get privilege mask...
    Privs := Get_User_Integer( Kernel, PID, Privs, Status ) ;
    if( Status = UE_Error ) then
    begin
        if( MMC.Last_Error = nil ) then
        begin
            Generate_Exception( UOSErr_Memory_Address_Error ) ;
        end ;
        exit ;
    end ;
    if( Privs = 0 ) then
    begin
        exit ;
    end ;

Next we pull the privilege mask from the provided address. If the mask is 0, there is nothing to do, so we exit.

    // Write current mask...
    if( PrivAddr <> 0 ) then
    begin
        if( Permanent = 0 ) then
        begin
            //TODO:Get image privileges
        end else
        begin
            Status := Write_User_int64( Kernel, PID, PrivAddr, Process.Authorized_Privileges ) ;
        end ;
        if( Status = UE_Error ) then
        begin
            if( MMC.Last_Error = nil ) then
            begin
                Generate_Exception( UOSErr_Memory_Address_Error ) ;
            end ;
        end ;
        Result := Status ;
        exit ;
    end ; // if( PrivAddr <> 0 )

If the current privilege address is passed, we write the current privileges to that address. Note that we have not implemented the case where image privileges are requested here (or later in the code). We will handle images in a future article.

    // Disabled privileges...
    if( Flag = 0 ) then
    begin
        if( Permanent = 0 ) then
        begin
            //TODO:Set image privileges
        end else
        begin
            Process.Authorized_Privileges := Process.Authorized_Privileges and not Privs ;
            Process.Current_Privileges := Process.Current_Privileges and not Privs ;
        end ;
        exit ;
    end else
    if( Flag = 1 ) then
    begin
        // Enabled privileges...
        if( ( Process.Current_Privileges and SETPRV ) = 0 ) then // User doesn't have SETPRV privilege
        begin
            Original := Privs ;
            Privs := Privs and Process.User_Authorized_Privileges ; // Limit changes to those authorized
            if( Original <> Privs ) then
            begin
                Result := SS_NOTALLPRIV ;
            end ;
        end ;
        if( Permanent = 0 ) then
        begin
            //TODO:Set image privileges
        end else
        begin
            Process.Authorized_Privileges := Process.Authorized_Privileges or Privs ;
            Process.Current_Privileges := Process.Current_Privileges or Privs ;
        end ;
    end else
    begin
        Result := SS_IVSTSFLG ;
    end ;
end ; // TUSC.Set_Privileges

If we're being asked to disable privileges, we remove the specified flags from the appropriate privilege mask(s). We don't need to check if the user has authorization because a user can always disable their privileges.

If we're being asked to enable privileges, we need to first clear out any privileges that aren't authorized for the user. However, if the user has the SETPRV privilege, we don't clear anything because that privilege allows the user to set any desired privileges. If we clear any flags, we set the result condition to SS_NOTALLPRIV to inform the user that not all requested privileges were enabled.

Finally, if the flag isn't 0 or 1, we exit with the SS_IVSTSFLG code.

In the next article, we will examine the next lexical function.