From owner-freebsd-dtrace@freebsd.org Thu Jun 15 14:16:36 2017 Return-Path: Delivered-To: freebsd-dtrace@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 6D14CD8B4A8 for ; Thu, 15 Jun 2017 14:16:36 +0000 (UTC) (envelope-from rm@joyent.com) Received: from mail-pf0-x231.google.com (mail-pf0-x231.google.com [IPv6:2607:f8b0:400e:c00::231]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority G2" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 3F31C76BF1 for ; Thu, 15 Jun 2017 14:16:36 +0000 (UTC) (envelope-from rm@joyent.com) Received: by mail-pf0-x231.google.com with SMTP id l89so8047870pfi.2 for ; Thu, 15 Jun 2017 07:16:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=joyent.com; s=google; h=subject:to:references:from:message-id:date:user-agent:mime-version :in-reply-to:content-language:content-transfer-encoding; bh=vN7firj715HT2IqY+Zku1FlG1Vf9r5DqgTxppBOA5SU=; b=QS1z5QJh0mjicXUZI7znRkyCV/B2gapsU1H2MWVxIgNsvymOM6DxnpD5xRIPFeB3AH GVaj/WylsT2ghXNQu0Fj0vNG4Rt0aOrTvejJcPj6TxGcdp/dr9MSGVNqDyK7/cep5aSO ef5ZNkYRdNDfnQgbVxpB2jN7F5QCM7eFi+zdQ= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=vN7firj715HT2IqY+Zku1FlG1Vf9r5DqgTxppBOA5SU=; b=Iy7UJxPceNikuhShCVrMcdrk8lT/0uOxD74TaP/qg5STNOxaf1CvNiT5PliApdKajm 6t24qBPImH3Wm5eTb/AGe5eEu50qupzGo6h01ivVUu5jkG7DSRhJG/D/CsuJl0HGYs21 VVgOQuAqM2RQKX1HhM1nDjNxZ+WDYW5Cv5d6Df9OFfSJOhQzxCJX+4WnvqKBT2OeJ0eW nF0a4oRmjiKOn0C0r59hynDhtugF40MWPcQOLafBreynrs2FR/wObMAWyAO+saFhFBwl LMKtfxh7390dDvqhwi2r78iIhwDCezRZvcm3e9lixz7ILXe+cdDup5zbwrDav7DW4f23 nxoA== X-Gm-Message-State: AKS2vOwMuvfE67BBbsOdwWPzd5uvuyMyoArIdZ7g28WKm8gIOBHwFAX3 BKC94sT223tKV5LILQ+Sjg== X-Received: by 10.99.100.135 with SMTP id y129mr5708723pgb.5.1497536195310; Thu, 15 Jun 2017 07:16:35 -0700 (PDT) Received: from zanarkand.local (c-73-241-83-139.hsd1.ca.comcast.net. [73.241.83.139]) by smtp.gmail.com with ESMTPSA id o2sm574446pgq.44.2017.06.15.07.16.34 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 15 Jun 2017 07:16:34 -0700 (PDT) Subject: Re: Creating a dtrace group? To: Matthew Seaman , freebsd-dtrace@freebsd.org References: <2909a957-80a9-8f14-079f-972d18143747@FreeBSD.org> From: Robert Mustacchi Message-ID: <8edf4d3d-625c-8a09-c541-61bc61f5f3d1@joyent.com> Date: Thu, 15 Jun 2017 07:16:33 -0700 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:52.0) Gecko/20100101 Thunderbird/52.1.1 MIME-Version: 1.0 In-Reply-To: <2909a957-80a9-8f14-079f-972d18143747@FreeBSD.org> Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit X-BeenThere: freebsd-dtrace@freebsd.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: "A discussion list for developers working on DTrace in FreeBSD." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Jun 2017 14:16:36 -0000 On 6/15/17 3:45 , Matthew Seaman wrote: > This is something that came up while I was flailing about trying to get > dtrace working with postgresql during BSDCan. Many thanks to markj and > swills and others for their help. > > By default the permissions/ownership on /dev/dtrace/helper look like this: > > crw-rw---- 1 root wheel 0x5 Jun 3 11:42 helper > > In order to dtrace a userland application it needs read/write access to > that device. Now, that's not the case for example with postgresql which > switches to a non-root uid on startup. Most persistent daemon processes > with network access will do this for obvious security reasons.> > The effect is that running 'dtrace -l -m postgres' shows no available > probes. > > One solution is to create a new 'dtrace' unix group, which the userids > those daemons run under can be added to, and make /dev/dtrace/helper > owned by that group. Like so: > > # pw group add -n dtrace -g 141 -M postgres > # cat /etc/devfs.rules > [userdtrace=10] > add path dtrace/helper mode 0660 group dtrace > # sysrc devfs_system_ruleset="userdtrace" > > (GID 141 is just the first available from /usr/ports/GIDs) This make > /dev/dtrace/helper look like so: > > crw-rw---- 1 root dtrace 0x5 Jun 3 11:42 helper > > and the postgres user account: > > # id postgres > uid=770(postgres) gid=770(postgres) groups=770(postgres),141(dtrace) > > Would it be possible to create a dtrace group like this in the default > /etc/group and change the devfs settings so that /dev/dtrace/helper is > group owned by the new dtrace by default? Preferably if this could go > into the upcoming 11.1 and 10.4 releases? Hi Matthew, Have you looked at the DTrace privilege model? If you haven't, it seems worth pointing out that DTrace has a notion of different privilege levels that are tied into different probes. Though this has never been ported over into FreeBSD. We use this a lot in illumos to solve problems like this. Importantly, for example, kernel probes require different privileges from USDT / pid probes. This means, for example, that destructive actions that can modify kernel memory can be taken away from things that just want to look at user land probes. In illumos, it also ties into privileges around what processes a user is allowed to see and modify (think what can I attach a debugger to), which helps from a notion of multi-tenancy. I'm not personally familiar with the FreeBSD privilege model, but seems like something you may want to think about, especially if this is coming up in the context of non-privileged users being used for security-conscious reasons. Robert