LCMAPS_POSIX_ENF(8)

💖 lcmaps_posix_enf.mod — the manual page (section 8, System Manager's Manual) 💖

okay bestie, gather round, because we're about to talk about the LCMAPS plugin that switches user identity, and honestly? it's giving main character energy. this is lcmaps_posix_enf.mod, and it lives in section 8 of the manual (the System Manager's Manual, for the sysadmin girlies). let's get into it ✨

---

🌸 NAME 🌸

lcmaps_posix_enf.mod — the LCMAPS plugin that switches user identity 💅

---

🦋 SYNOPSIS 🦋

lcmaps_posix_enf.mod [-maxuid number of uids] [-maxpgid number of primary gids] [-maxsgid number of secondary gids]

---

✨ DESCRIPTION ✨

so the Posix Enforcement plugin does exactly what it says on the tin: it enforces (aka applies, aka makes it real, no take-backsies) all the credentials that got gathered and stacked up in the datastructure of the Plugin Manager. 🫶

where did those credentials come from? one or more Acquisition plugins, bestie. which means — and this is important — at least one Acquisition should have been run prior to this Enforcement. like, you can't enforce vibes that were never acquired, you know?

all that gathered info gets checked by looking into the 'passwd' file of the system. and yes, the original authors really did leave us a lil note in there: (FIXME: shouldn't that be getpwent(2)?) 😭 iconic honestly. anyway, those files hold the info about every registered system account and its user groups.

⚠️ real talk: the Posix Enforcement plugin does not check whether the secondary groups have the primary UID as a member, so it's entirely possible to end up with more group memberships than what is defined in the group database. yes, fr fr. more than the database says. that's just how it is.

and how does it actually flip the switch? the (BSD/POSIX) functions setreuid(2), setregid(2) and setgroups(2) are used to change the privileges of the process from root to that of a local user. 💀 root ➡️ local user, just like that.

---

🎀 OPTIONS 🎀

• -maxuid number of uids — in principle this sets the max number of allowed UIDs this plugin will handle, but ngl, at the moment only the first UID found will be enforced; the others get discarded. 🗑️ by setting this value to a maximum, a failure gets raised when the amount of UIDs exceeds that set maximum. if you don't set this value, the plugin just keeps going and enforces only the first found value in the credential data structure. lowkey unbothered.
• -maxpgid number of primary gids — sets the max number of allowed Primary GIDs this plugin will handle, similar to -maxuid. same energy here too: only the first primary GID found will be taken into account. 🫡
• -maxsgid number of secondary gids — sets the max allowed Secondary GIDs this plugin will handle. this number is limited by the system (NGROUPS) and is usually 32. and if the plugin can't determine the system value? it limits itself to 32. self-care, honestly. 💅

---

💀 the dangerous ones 💀

the remaining options are considered dangerous, as they have the potential to allow a client process to gain root privileges. the use of these options is strongly discouraged. not me warning you twice, but like, i am warning you twice. 🙈

• -set_only_euid {yes|no} — setting this to 'yes' means only the effective uid is set. in other words, it's still possible to regain root (uid) privileges for the process. this is definitely undesirable if this module is used from a process like the gatekeeper, since it would be possible for user jobs to get root privileges. 😭 so much nope.
• -set_only_egid {yes|no} — analogue to the previous option: setting this to 'yes' means only the effective (primary) gid is set. in other words, it's still possible to regain root (gid) privileges for the process. this is definitely undesirable if this module is used from a process like the gatekeeper, since it would be possible for user jobs to get root privileges. possibly this option should be set if the module is used by gridFTP, since this service does not spawn user jobs and has to regain root pivileges at the end. (yes, "pivileges" — that's the original spelling and i am not touching it, it's part of the lore now 🧚)

---

🌈 RETURN VALUES 🌈

• LCMAPS_MOD_SUCCESS — success! slay! you ate! 🎉
• LCMAPS_MOD_FAIL — failure. 💀 it did not eat.

---

🐛 BUGS 🐛

please report any errors to the Nikhef Grid Middleware Security Team <grid-mw-security-support@nikhef.nl>. they're lovely, they'll help. 🫶

---

👑 SEE ALSO 👑

lcmaps.db(5), lcmaps(3), getpwent(3), getgrent(3), setreuid(2), setregid(2), setgroups(2).

---

💜 AUTHORS 💜

LCMAPS and the LCMAPS plug-ins were written by the Grid Middleware Security Team <grid-mw-security@nikhef.nl>. absolute icons, honestly. ⭐

---

and that's the whole page, bestie! 🎀 this was LCMAPS_POSIX_ENF(8) from the System Manager's Manual, dated March 22, 2011 — so yeah, it's been serving looks since 2011 and it's still here. no cap. go enforce some credentials responsibly, and remember: don't touch the dangerous options unless you truly know what you're doing. byeeee 💖✨🦋