HP Serviceguard Manager Plug-in Security Whitepaper, March 2009
To
include privilege
-
appropriate
information (e.g. property sheet) in the returned web page.
To
enable and disable
privileged
operations
(e.g. delete a p
ackage
) in
the returned web page.
To
apply
access
-
control check
s
before performing
Serviceguard
operations to ser
v
ice this
request.
The access
-
control process will be discussed in the next
section
.
Authorization
Smhrun
To service a request from a clien
t, SgmgrPI needs to retrieve, modify, and/or store data
pertaining
to
the managed cluster. It does so by calling one or more standard Serviceguard commands (e.g.
cmviewcl
,
cmapplyconf
,
cmgetconf
etc
.
), or shell scripts supplied by
SgmgrPI
,
on behalf of the
a
uthenticated user. To
execute these commands using the identity t
hat has been authenticated by
SMH
and PAM
in the lo
gin process, SgmgrPI uses the
SMH's command,
smhrun
. This command is
designed as the uni
fied
mechanism
shared by all
SMH plug
-
ins to
execute
a command with
an
intended
identity and
privilege sets
.
To execute a Serviceguard command or SgmgrPI script, SgmgrPI spawns a process (see path 4 or
figure 1) and execute
s
the
smhrun
command with the user identity, the name of the command or
script, and
a set of
command
parameters. The child process is owned
by
the user
hpsmh
, and
command
output is read directly into SgmgrPI process memory.
Note that
smhrun
w
i
ll
only run the
commands which have been configured into its secure database; this provides an
additional level of
protection
a
gainst
executing arbitrary commands.
Some Serviceguard commands require communication between
other
Serviceguard nodes (see path 5
in figure 1). This communication path is protected by Serviceguard and
t
he
detail
s of its
operation
a
re
beyond the scope of this white
paper.
S
ee
the document "
Securing Serviceguard
"
,
listed in the
Related Documents section
,
for detail
s
.
Access Control
Policy
The
u
ser identity es
tablis
hed by PAM is referenced by SMH and
SgmgrPI
.
SMH uses this identity
to
control access to system management functions.
SgmgrPI
uses the identity to control access to the
cluster
-
specific
data through Serviceguard command
s
.
However, SMH and
SgmgrPI
each
have thei
r
own access
-
control policy. This section describes how the tw
o systems work in conjunction
.
SMH categorizes all users into one of
three
roles,
A
dmin
,
O
perator
,
and
User
.
Table 1 below
summarizes how SMH users/roles are mapped by SgmgrPI to Serviceguard
roles: