restrict-shell-cmd(8)

NAME

restrict-shell-cmd - privileged helper granting a user their own zone console

SYNOPSIS

/opt/omnicube/sbin/restrict-shell-cmd zlogin zone

/opt/omnicube/sbin/restrict-shell-cmd kill pid

pfexec /opt/omnicube/sbin/restrict-shell-cmd action argument

DESCRIPTION

restrict-shell-cmd is the only privileged component of the OmniCube restricted-shell mechanism. It is invoked through pfexec by restrict-shell(8) and implements exactly two actions, each of which it authorises itself before carrying out. It is not intended to be run interactively.

The complete set of permitted operations is:

zlogin zone

Attach to the console of zone with zlogin -e '#' -C. A non-root caller may only name the zone that matches its own login name.

kill pid

Send SIGHUP to pid, but only if pid is the zlogin console process of the caller's own zone. This is what lets a user reclaim a console left behind by a dropped session.

Any other first argument is rejected with "Action not supported". There is no action that runs a shell, a command of the caller's choosing, or any other signal. Both arguments are mandatory; a missing one produces "Unexpected parameters !" and status 1.

Caller identity

The caller is taken from SUDO_USER, falling back to id -urn, i.e. the login name of the real uid. This works because the exec_attr entry grants euid=0 rather than uid=0, so the real uid remains that of the invoking user and cannot be forged - unlike the LOGNAME or USER environment variables, which the caller controls. sudo is still accepted for transition, but the RBAC profile is preferred. The derived name must itself match ^[a-zA-Z_][a-zA-Z0-9._-]*$.

A caller whose real uid is 0 (root) is unrestricted: it may open any zone console and HUP any pid.

Authorisation

For zlogin, the zone name must match ^[a-zA-Z_][a-zA-Z0-9._-]*$ and, for a non-root caller, must be string-equal to the caller name; the convention is that a zone's console account is named after the zone.

For kill, pid must be entirely numeric, and the argument list of that pid, read with ps -o args= -p pid, must end in zlogin ... -C caller. Ownership cannot be used for this check because the console process runs as root, having been spawned through this same helper; the command line is therefore the authoritative link between the process and the caller. Earlier revisions accepted any numeric pid, which allowed a restricted user to HUP arbitrary root processes.

The helper sets PATH to /usr/bin:/usr/sbin:/sbin and does not source /opt/omnicube/lib/common/utils.sh, so no SMF configuration, locking or run-level guard applies.

OPERANDS

action

Either zlogin or kill. Required.

argument

The zone name for zlogin, or the pid for kill. Required.

USAGE

Example 1: how restrict-shell calls it

pfexec /opt/omnicube/sbin/restrict-shell-cmd kill 4711
pfexec /opt/omnicube/sbin/restrict-shell-cmd zlogin win2022

Example 2: granting a user the right to run it

usermod -P 'OmniCube Restricted Shell' win2022

The option replaces the profiles= list in user_attr(5); illumos has no + modifier, so pass every profile the account should keep in one comma-separated argument.

Example 3: a refused request

User win2022 trying to reach another zone's console:

$ pfexec /opt/omnicube/sbin/restrict-shell-cmd zlogin sql01
Refusing console access to zone 'sql01' for user 'win2022'

EXIT STATUS

0

The console session ran, or the SIGHUP was delivered. Note that the exit status of zlogin and of kill is not propagated.

1

The request was refused or malformed: an invalid caller name, a missing action or argument, a non-numeric pid, a pid that is not the caller's own zone console, an invalid zone name, a zone other than the caller's own, or an unsupported action.

FILES

/opt/omnicube/sbin/restrict-shell-cmd

This command.

/opt/omnicube/sbin/restrict-shell

The unprivileged login shell that drives it.

/etc/security/exec_attr.d/omnicube

Contains the single entry that makes this work:

OmniCube Restricted Shell:solaris:cmd:::\\
    /opt/omnicube/sbin/restrict-shell-cmd:euid=0

/etc/security/prof_attr.d/omnicube

Defines the OmniCube Restricted Shell profile.

ENVIRONMENT

SUDO_USER

Preferred source of the caller name when the helper is reached through sudo, which is supported for transition only. When unset, the caller is derived from the real uid, which is the intended path.

PATH

Ignored on entry and reset by the helper.

SECURITY

This is the wrapper-script pattern that /etc/security/exec_attr.d/omnicube recommends for genuinely least-privilege operators: instead of granting a user uid=0 execution of zlogin and kill - which would let them enter any zone and signal any process - the profile grants euid=0 execution of one script that validates its own arguments.

Two properties carry the security of the design. First, euid=0 preserves the real uid, making id -urn a tamper-proof caller identity; nothing in the authorisation decision comes from the environment except the optional SUDO_USER used by the legacy sudo path. Second, both arguments are constrained to a strict character set before use, and the kill target is verified against the process table rather than trusted.

The profile replaced an earlier sudo rule so that a single privilege framework has to be audited. pfexec logs the resolved command, which gives a per-invocation audit trail of console access.

SEE ALSO

omnicube_utils(3), omnicube(7), manage_zone.sh(8), restrict-shell(8).

NOTES

Because the status of the underlying zlogin or kill is not propagated, a successful authorisation always yields status 0 even if the console could not be opened, for example when the zone is configured but not running.

The kill check depends on the console having been started as zlogin -e '#' -C zone. A console attached by other means, or with a different argument order, will not match and cannot be reclaimed through this helper.

The zone-name-equals-login-name convention is not enforced anywhere else; if a console account is created under a different name, this helper will refuse every request it makes.