December 2004 - Darwin-dev - lists.apple.com

Re: How Do I Run a Java App with Superuser Privileges?
by Paul Forgey 14 Dec '04

14 Dec '04

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com User-agent: Mozilla Thunderbird 0.9 (Windows/20041103) See MHO answered point by point below: Or you could let Apache still run. William C. McCain wrote: 1. Apple lets users run Apache on their Macs, though few non-geek end-users do so. So why not my app, too? At risk of misunderstanding your point and going into facts you probably already know, it's a _system wide_ app running as root (initially, before dropping to the apache user), and the only process which may bind to port 80 while it is running. The per-user stuff you see is part of the apache configuration, and not the result of any daemon listening on port 80 running directly because of that user. Are you requiring users not run any other web server if they run your server? 2. My app has been available for some time on the dominant monopolist's OS, and it runs fine there without any privileges (even on XP SP2). Yeah. Winsuck lets non-priviledged users do a lot of horrible things. Because Microsoft lets you do it doesn't mean it's a good idea. You should see the resulting ms-specific twists on SO_REUSEADDR and related bizarre behaviors which have been needed to hack around this in a way that still lets most applications work while reducing the risk of allowing this. But all that's for another list. On multi users system, privileged ports are privileged for a reason, unless you are Windows where any joe user who can log in can subvert the web server, or any other server, for their own purposes. Windows is not, nor ever will be, a system where unprivileged interactive access may be allowed without significant compromise to security. While this is more or less true for any system, it is especially true for Windows. 3. If I change the port number, I'll have to make it configurable, which is a real PITA (not that I'm lazy, mind you). Of course, if one of my users ever DOES want to run both Apache and my app on the same machine, at least ONE of us will have to be re-configured ... Why not use Rendezvous? Pick a port automatically and advertise it. If your app also runs on Windows, you may want to look into Howl which gives you the same interface on both Windows and Mac-OS. The best way to listen on a free port is to bind to port 0 and then use getsockname after the socket is bound to find out which port the kernel atomically found free and bound the socket to listen on. This doesn't work on all platforms (it isn't part of the original BSD sockets behavior), but it does work at least on Linux, Mac-OS and even Windows. For users that don't want to use Rendezvous or would like to set up firewall rules, make the listening port an application preference. It may be a pain to do, but so else is writing software. 4. It's actually rather convenient for my built-in Web server to be "standard", as it has other uses besides the master/remote interface. For instance, users (and I) can check my product's "log files" from their Web browsers on the remote machines. (Yes, I know you can specify a non-standard port in a URL, but I said this was a "convenience" issue.) If you use Rendezvous, Safari will list your service automatically in the bookmarks menu. You need to find a much better reason to bind to port 80 than to save users' typing. Are you really the only web server on the machine? Unless you have convinced IANA that you deserve to be a known port, you will need to do a combination of automatically finding your own dynamic port to bind to and letting the user set it. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0

Re: How Do I Run a Java App with Superuser Privileges?
by William C. McCain 14 Dec '04

14 Dec '04

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com User-agent: Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.7.3) Gecko/20040910 Bill On Dec 13, 2004, at 22:08, Justin Walker wrote: On Dec 13, 2004, at 21:45, James Berry wrote: On Dec 13, 2004, at 9:24 PM, Justin Walker wrote: [snip] Well, well, well, .... [snip] Regards, _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… All this is very interesting, guys, but a bit academic. After all, as I pointed out in my original question, Apple provides "sudo", which does essentially the same thing, cleanly -- and *IS* supported. In fact, not only does "sudo" work in shell scripts, it works (indirectly) in AppleScripts. It actually works BETTER in AppleScripts than directly in a shell, because it skips the password prompt if you are already logged in as a user with admin privileges. But what I'm really looking for is a simple "property list"-oriented way of doing this. I have a strong suspicion something like that exists -- not a Java property, something external to Java. In the "CF" series of keys, perhaps ... Yes, I have considered changing the port from well-known 80 to the private or reserved range. But I'm reluctant to do so, for the following reasons (none of which are really persuasive, I admit): 1. Apple lets users run Apache on their Macs, though few non-geek end-users do so. So why not my app, too? 2. My app has been available for some time on the dominant monopolist's OS, and it runs fine there without any privileges (even on XP SP2). 3. If I change the port number, I'll have to make it configurable, which is a real PITA (not that I'm lazy, mind you). Of course, if one of my users ever DOES want to run both Apache and my app on the same machine, at least ONE of us will have to be re-configured ... 4. It's actually rather convenient for my built-in Web server to be "standard", as it has other uses besides the master/remote interface. For instance, users (and I) can check my product's "log files" from their Web browsers on the remote machines. (Yes, I know you can specify a non-standard port in a URL, but I said this was a "convenience" issue.) As for letting the Java VM run in su mode the whole time my app is running (and it's a LONG running app, controls the playing of music on external CD changers and could runs for days or weeks) -- THAT doesn't worry me. The Java VM is about the LAST program in the world that I would consider to be a "security risk". And it's only MY instance of the Java VM that is privileged, not anybody else's. Justin Walker wrote: On Dec 13, 2004, at 21:11, James Berry wrote: Most systems will not permit shell scripts to execute 'setuid'. Works for me... (TM). (Note the euid...) It'll take me a while to figure this one out. Seems that bash and sh have somewhat different behaviors: Whilst I mull this over, I have reported it as bug #3919279. Seems like a problem to me, but perhaps there's an explanation... Justin This email sent to site_archiver(a)lists.apple.com

1 0

Re: How Do I Run a Java App with Superuser Privileges?
by Justin Walker 14 Dec '04

14 Dec '04

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com On Dec 13, 2004, at 22:08, Justin Walker wrote: On Dec 13, 2004, at 21:45, James Berry wrote: Well, well, well, .... [snip] Regards, Justin -- Justin C. Walker, Curmudgeon-At-Large * Institute for General Semantics | If you're not confused, | You're not paying attention *--------------------------------------*-------------------------------* _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… On Dec 13, 2004, at 9:24 PM, Justin Walker wrote: On Dec 13, 2004, at 21:11, James Berry wrote: [snip] Most systems will not permit shell scripts to execute 'setuid'. Works for me... (TM). (Note the euid...) It'll take me a while to figure this one out. Seems that bash and sh have somewhat different behaviors: Whilst I mull this over, I have reported it as bug #3919279. Seems like a problem to me, but perhaps there's an explanation... This email sent to site_archiver(a)lists.apple.com

1 0

Re: How Do I Run a Java App with Superuser Privileges?
by Justin Walker 14 Dec '04

14 Dec '04

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com On Dec 13, 2004, at 21:45, James Berry wrote: Well, well, well, .... Thanks for digging in further... Regards, Justin _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… On Dec 13, 2004, at 9:24 PM, Justin Walker wrote: On Dec 13, 2004, at 21:11, James Berry wrote: [snip] Most systems will not permit shell scripts to execute 'setuid'. Works for me... (TM). (Note the euid...) It'll take me a while to figure this one out. Seems that bash and sh have somewhat different behaviors: $ cat foo.sh #!/bin/sh id ps -utp1 $ cat bar.sh #!/bin/bash id ps -utp1 $ls -l *.sh -r-sr-xr-x 1 root staff 24 13 Dec 22:01 bar.sh -r-sr-xr-x 1 root staff 22 13 Dec 22:00 foo.sh $ foo.sh uid=10180(justin) euid=0(root) gid=20(staff) groups=20(staff), 79(appserverusr), 80(admin), 81(appserveradm) USER PID %CPU %MEM VSZ RSS TT STAT STARTED TIME COMMAND justin 281 0.2 0.2 18644 1392 std S 4Dec04 0:01.57 -bash root 279 0.0 0.3 27540 2000 std Ss 4Dec04 0:00.04 login -pf ju root 4373 0.0 0.1 18644 564 std S+ 10:00PM 0:00.03 sh ./foo.sh root 4375 0.0 0.1 18076 684 std R+ 10:00PM 0:00.02 ps -utp1 $ bar.sh uid=10180(justin) gid=20(staff) groups=20(staff), 79(appserverusr), 80(admin), 81(appserveradm) USER PID %CPU %MEM VSZ RSS TT STAT STARTED TIME COMMAND justin 4378 3.0 0.1 18644 1012 std S+ 10:01PM 0:00.01 bash ./bar.s root 279 0.0 0.3 27540 2000 std Ss 4Dec04 0:00.04 login -pf ju justin 281 0.0 0.2 18644 1392 std S 4Dec04 0:01.57 -bash root 4380 0.0 0.0 18076 308 std R+ 10:01PM 0:00.01 ps -utp1 Looks to me like there is either a compatibility issue at play, or a bug in the system somewhere... 'tcsh' and 'bash' behave the same: scripts can't execute as setuid root. For 'sh', it appears they can...weird. -- Justin C. Walker, Curmudgeon-At-Large * Institute for General Semantics | "Weaseling out of things is what | separates us from the animals. | Well, except the weasel." | - Homer J Simpson *--------------------------------------*-------------------------------* This email sent to site_archiver(a)lists.apple.com

1 0

Re: How Do I Run a Java App with Superuser Privileges?
by James Berry 14 Dec '04

14 Dec '04

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Works for me... (TM). (Note the euid...) _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… On Dec 13, 2004, at 9:24 PM, Justin Walker wrote: On Dec 13, 2004, at 21:11, James Berry wrote: Java won't do this for you automatically. Ultimately you've got to get it running at superuser privilege. Common techniques include using a script to run it with su privileges by setting the ownership to root, and setting the suid bit. FWIW, I don't think this will work on most recent unices. It definitely doesn't on Mac OS X, 10.3.6: $ cat foo.sh id $ ls -l foo.sh -r-sr-xr-x 1 root staff 3 13 Dec 21:22 foo.sh $ foo.sh uid=10180(justin) gid=20(staff) groups=20(staff), 79(appserverusr), 80(admin), 81(appserveradm) Most systems will not permit shell scripts to execute 'setuid'. caddy:jberry ~/bin % cat > test #!/bin/sh id caddy:jberry ~/bin % sudo chown root test caddy:jberry ~/bin % sudo chmod +xs test caddy:jberry ~/bin % ls -l test -rwsr-sr-x 1 root jberry 14 13 Dec 21:41 test caddy:jberry ~/bin % ./test uid=501(jberry) euid=0(root) gid=501(jberry) groups=501(jberry), 79(appserverusr), 80(admin), 81(appserveradm), 505(svn) caddy:jberry ~/bin % uname -v Darwin Kernel Version 7.6.0: Sun Oct 10 12:05:27 PDT 2004; root:xnu/xnu-517.9.4.obj~1/RELEASE_PPC This email sent to site_archiver(a)lists.apple.com

1 0

Re: How Do I Run a Java App with Superuser Privileges?
by Justin Walker 14 Dec '04

14 Dec '04

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com On Dec 13, 2004, at 21:11, James Berry wrote: On Dec 13, 2004, at 8:55 PM, William C. McCain wrote: Most systems will not permit shell scripts to execute 'setuid'. Regards, Justin _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… Is there a property in Info.plist that I can set to give my Java application, packaged as a .app bundle, the superuser privilege? Or some other simple way to run a Java app with superuser privileges? Java won't do this for you automatically. Ultimately you've got to get it running at superuser privilege. Common techniques include using a script to run it with su privileges by setting the ownership to root, and setting the suid bit. FWIW, I don't think this will work on most recent unices. It definitely doesn't on Mac OS X, 10.3.6: $ cat foo.sh id $ ls -l foo.sh -r-sr-xr-x 1 root staff 3 13 Dec 21:22 foo.sh $ foo.sh uid=10180(justin) gid=20(staff) groups=20(staff), 79(appserverusr), 80(admin), 81(appserveradm) -- Justin C. Walker, Curmudgeon-At-Large * Institute for General Semantics | "Weaseling out of things is what | separates us from the animals. | Well, except the weasel." | - Homer J Simpson *--------------------------------------*-------------------------------* This email sent to site_archiver(a)lists.apple.com

1 0

Re: How Do I Run a Java App with Superuser Privileges?
by James Berry 14 Dec '04

14 Dec '04

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com On Dec 13, 2004, at 8:55 PM, William C. McCain wrote: -jdb Any ideas? Bill _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/james%40jberry.us This email sent to james(a)jberry.us _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… Is there a property in Info.plist that I can set to give my Java application, packaged as a .app bundle, the superuser privilege? Or some other simple way to run a Java app with superuser privileges? Java won't do this for you automatically. Ultimately you've got to get it running at superuser privilege. Common techniques include using a script to run it with su privileges by setting the ownership to root, and setting the suid bit. But you really don't want to run the java vm as superuser (for long) if you can help it. One reasonable technique is to be superuser just long enough to acquire the port, then drop su privileges. There is a tool and set of classes called Jakarta commons-daemon that were written to help you do this with java. The jsvc tool that commons-daemon supplies will invoke your java code initially as root to initialized itself (and get the privileged port), then drop privileges while the rest of the code runs. The best way to get commons-daemon for Mac OS X is through darwinports, as that port fixes several bugs in the code, and gets it to build on OS X. Tomcat5 as built for darwinports, uses commons-daemon to run so that it can acquire its ports this way. You might look at this as an example. Ultimately a better question, however, might be whether you can use non-privileged ports for your communication. It doesn't sound like there's anything in particular about your setup that would require you to choose a well-known privileged port, and if you pick a non-privileged port you won't need to gain superuser privs in the first place. My application exposes a small, low-function, secure HTTP server (this is not the main function of my application, but it is needed to support a master/remote interface between machines on a local area network in a user's home). This requires superuser privileges. It works fine in a shell when I prefix my application with "sudo". But I can't ask users to do that! I have also been able to get it to work from an AppleScript (something like 'do shell script "sudo open MyApp"'). That will be what I will have to ship, unless there is a better, more "transparent" solution. This email sent to site_archiver(a)lists.apple.com

1 0

How Do I Run a Java App with Superuser Privileges?
by William C. McCain 14 Dec '04

14 Dec '04

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com User-agent: Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.7.3) Gecko/20040910 Any ideas? Bill _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… Is there a property in Info.plist that I can set to give my Java application, packaged as a .app bundle, the superuser privilege? Or some other simple way to run a Java app with superuser privileges? My application exposes a small, low-function, secure HTTP server (this is not the main function of my application, but it is needed to support a master/remote interface between machines on a local area network in a user's home). This requires superuser privileges. It works fine in a shell when I prefix my application with "sudo". But I can't ask users to do that! I have also been able to get it to work from an AppleScript (something like 'do shell script "sudo open MyApp"'). That will be what I will have to ship, unless there is a better, more "transparent" solution. This email sent to site_archiver(a)lists.apple.com

1 0

Re: cvs vulnerability
by Markus Weissmann 13 Dec '04

13 Dec '04

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com -Markus On Dec 13, 2004, at 20:51, Alex v.Below wrote: Hope this helps Alex Am 13.12.2004 um 20:03 schrieb Ed Zaron: Hello All, Ed .............................................. Edward D. Zaron, PhD Research Associate (postdoc) College of Oceanic and Atmospheric Sciences Oregon State University Corvallis, OR 97331-5503 Phone: (541) 737-3504 Fax: (541) 737-2064 ezaron(a)coas.oregonstate.edu ............................................... _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/mww%40opendarwin.org This email sent to mww(a)opendarwin.org --- Markus W. Weissmann http://www.mweissmann.de/ http://www.opendarwin.org/~mww/ _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com As cvs probably contains more security holes, it is imho a good idea to use cvs over ssh only. As of this writing, Mac OS X (or rather, the development tools) ship with CVS 1.10 Something which worries me is that any update of the devtools will revert the installed CVS version back to 1.10. I have filed this as a security related bug (3720902), but so far Apple does not consider it worth changing. And to make this perfectly clear: cvs is not updated with Security Updates as of yet. To keep your OS X machines safe, update cvs manually. This works well without porting issues of any kind. Forgive me if this isn't the best place to ask about this, but I was looking for some guidance regarding a security problem with cvs which is discussed here: http://lists.gnu.org/archive/html/bug-cvs/2004-05/msg00380.html Does anyone know if this hole has been patched in any of he OS X security updates? A quick search on security-announce did not indicate that it was patched. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/ newsletters%40vonbelow.com This email sent to newsletters(a)vonbelow.com PGP.sig

1 0

Re: cvs vulnerability
by Alex v.Below 13 Dec '04

13 Dec '04

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Hope this helps Alex Am 13.12.2004 um 20:03 schrieb Ed Zaron: Hello All, Ed .............................................. Edward D. Zaron, PhD Research Associate (postdoc) College of Oceanic and Atmospheric Sciences Oregon State University Corvallis, OR 97331-5503 Phone: (541) 737-3504 Fax: (541) 737-2064 ezaron(a)coas.oregonstate.edu ............................................... _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… As of this writing, Mac OS X (or rather, the development tools) ship with CVS 1.10 Something which worries me is that any update of the devtools will revert the installed CVS version back to 1.10. I have filed this as a security related bug (3720902), but so far Apple does not consider it worth changing. And to make this perfectly clear: cvs is not updated with Security Updates as of yet. To keep your OS X machines safe, update cvs manually. This works well without porting issues of any kind. Forgive me if this isn't the best place to ask about this, but I was looking for some guidance regarding a security problem with cvs which is discussed here: http://lists.gnu.org/archive/html/bug-cvs/2004-05/msg00380.html Does anyone know if this hole has been patched in any of he OS X security updates? A quick search on security-announce did not indicate that it was patched. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/ newsletters%40vonbelow.com This email sent to newsletters(a)vonbelow.com This email sent to site_archiver(a)lists.apple.com

1 0