HP OpenVMS Systems

Personna security, execvp vs $creprc?

» close window

The Question is:

 
Dear Wizard,
 
I'm working on an ALPHA system with OpenVMS 7.2 and I'm having problems to
 start a program using a different username from a "C" daemon.
The daemon is doing the following :
 
   switch(vfork())
   {
 
   case 0:
     /* create the persona */
     iflags  = IMP$M_ASSUME_DEFPRIV;
     istatus = sys$persona_create(
             &persona_handle,
             &username,
             iflags);
     if (istatus != SS$_NORMAL)
     {
      ... error
     }
 
     iflags =   IMP$M_ASSUME_SECURITY
             | IMP$M_ASSUME_ACCOUNT
             | IMP$M_ASSUME_JOB_WIDE;
     istatus = sys$persona_assume(
                 &persona_handle,
                 iflags);
     if (istatus != SS$_NORMAL)
     {
        ... error
     }
 
 
     strcpy(childpath, "CHILD.EXE");
     istatus = execvp(childpath, argv);
     if (istatus == -1)
     {
       ... error
     }
 
     istatus = sys$persona_assume(
                  &persona_revert,
                  iflags);
     if (istatus != SS$_NORMAL)
     {
        ... error
     }
     break;
   } /* end case 0: */
 
   istatus = sys$persona_delete(
                 &persona_handle );
   if (istatus != SS$_NORMAL)
   {
      ... error
   }
 
The problem is that the execvp returns -1 and the errno is "1" EPERM (Not
 super-user). I have all privileges (set proc/priv=all) and always the same
 error.
But, when I comment the "persona_...." functions, the execvp() function starts
 the CHILD.EXE program without problems. (Of course, with myt username not with
 a different username)
 
The OpenVMS documentation saids that the persona_.... functions should be used
 with the function sys$creprc, but I don't know why when I use this function
 never the CHILD.EXE program is started (probably I'm doing some thing wrong).
 
Please, could you help me ? or send me a small example of how to use the creprc
 function to start a child.exe program ?
 
Why the execvp function is returning -1, errno=1 ?
 
Note: My daemon is started in detach mode.
 
Thanks for your help.
Andres
 

The Answer is :

 
  The OpenVMS Wizard would tend to use sys$creprc here, and not execvp.
 
  The CHILD process itself will be operating without a CLI, meaning
  that certain API calls (system, lib$spawn, etc) that expect a CLI
  will return a NOCLI error.  For details on NOCLI, please see the
  OpenVMS FAQ.
 
  An example of using sys$creprc from C follows:
 
 
#pragma module srh_creprc "V1.0"
 
/*
**++
**  FACILITY:  examples
**
**  MODULE DESCRIPTION:
**
**      performs a lib$spawn, but doesn't need a cli around
**
**  AUTHORS:
**
**      Stephen Hoffman, Compaq OpenVMS Engineering
**
**  CREATION DATE:  2-jul-1993
**
**  DESIGN ISSUES:
**
**      while this routine performs the indicated task of spawning
**	a subprocess, note that use of the sys$sndjbc() system service
**	to submit the specified procedure may also be appropriate.
**
**  MODIFICATION HISTORY:
**
**      19-Apr-2000, Hoffman, example updated for Compaq C
**
**      {@tbs@}...
**--
*/
 
#include <descrip.h>
#include <pqldef.h>
#include <ssdef.h>
#include <starlet.h>
#include <stddef.h>
#include <stdio.h>
#include <stsdef.h>
 
int srh_creprc( struct dsc$descriptor_s *cmdspec_a,
    struct dsc$descriptor_s *logspec_a,
    unsigned long int *pid_a,
    struct dsc$descriptor_s *prcnam_a )
    {
    unsigned long int retstat;
    struct dsc$descriptor *logspec;
    struct dsc$descriptor *prcnam;
    $DESCRIPTOR( nla0, "_NLA0:" );
    $DESCRIPTOR( loginout, "SYS$SYSTEM:LOGINOUT.EXE" );
    $DESCRIPTOR( srh, "SRH" );
    unsigned long int *pid;
    unsigned long int pid_bogus;
    unsigned long int baspri = 4;
    unsigned long int mbxunt = 0;
    unsigned long int uic = 0;
    unsigned long int stsflgs = 0;
    struct
	{
	unsigned char pql_code;
	unsigned long int pql_value;
	} pql[] =
	    {
	    {	PQL$_ASTLM,        600	    },
	    {	PQL$_BIOLM,        100	    },
	    {	PQL$_BYTLM,        131072   },
	    {	PQL$_CPULM,        0	    },
	    {	PQL$_DIOLM,        100	    },
	    {	PQL$_FILLM,        50	    },
	    {	PQL$_PGFLQUOTA,    40960    },
	    {	PQL$_PRCLM,        16	    },
	    {	PQL$_TQELM,        600	    },
	    {	PQL$_WSDEFAULT,    512	    },
	    {	PQL$_WSQUOTA,      2048	    },
	    {	PQL$_ENQLM,        600	    },
	    {	PQL$_WSEXTENT,     4096	    },
	    {	PQL$_JTQUOTA,      4096	    },
	    {	PQL$_LISTEND,      0	    }
	    };
 
    /*
    **	Allow the log file specification and the process name
    **	specification to be defaulted.
    */
    logspec = ((int) logspec_a) ? (void *) logspec_a : (void *) &nla0;
    prcnam = ((int) prcnam_a) ? (void *) prcnam_a : (void *) &srh;
    pid = ((int) pid_a) ? pid_a : &pid_bogus;
 
    /*
    **	Perform the process creation.
    */
    retstat = sys$creprc( pid,
	&loginout, cmdspec_a, logspec, &nla0, 0,
	pql, prcnam, baspri, uic, mbxunt, stsflgs );
 
    return retstat;
 
    }
main()
    {
    unsigned long int retstat;
    $DESCRIPTOR( log, "SYS$MANAGER:X.LOG" );
    $DESCRIPTOR( cmd, "SYS$MANAGER:LOGIN.COM" );
 
    retstat = srh_creprc( &cmd, &log, NULL, NULL );
    return SS$_NORMAL;
    }
 
 
 

  

     

     
answer written or last revised on ( 11-JAN-2001 )
     
» close window