SESSION(1)

NAME
session, drop, runlow - substitute labels temporarily

SYNOPSIS
session [ option ... ]

priv session [ option ... ]

runlow command

drop [ -l label ] [ command-arg ... ]

DESCRIPTION
Session sets a temporary security label for the duration of one command. The ceiling is raised sufficiently to cover the requested label, up to the authorization recorded for the current login name. If no command-args are given, the command is taken to be a shell: sh(1) above the system floor, or nosh(8) below. With command-args, the specified command is run; there is no shell-like path search.

If the current ceiling does not dominate the new ceiling, or the the new process label is below the system floor and does not dominate the current label session must be invoked through priv(1).

The options are

-l label
    Set the process label and the label of the standard input to the given value, specified as in atolab; see labtoa(3). If the value does not dominate the current process label, clear the environment and pass no arguments to the invoked command. If label is missing, it is taken to be the system floor.

-C label
    Set the process ceiling at or above the given value. If label is missing, it is taken to be the process label.

-u user
    The password for user will be demanded. The fact that the password has been presented will be recorded in the stream identifier (see stream(4)) of the standard input. For the duration of the session, further queries for that password will succeed automatically. If user is missing, it is taken to be the current login name.

-x  Replace current session instead of suspending it for the duration of the new session (like exec in sh(1)).

-c command-arg ...
    Instead of a shell, run the given command with the given arguments. This option must come last.

To change labels, the input source must come over a trustable channel, in particular neither from an untrusted computer nor from a terminal into which untrusted code has been downloaded. The request may require confirmation to assure that no software has tampered with it; answer for yes. Confirmation and password inquiries happen under cover of pex(4). In a mux(9.1) window, this gives a visible indication; a missing indication is a sign of spoofing.

Runlow runs a command, starting the label at bottom, somewhat like session -l 0, but without changing the label of the standard input. The executable file is located according to environment variable $PATH as in sh(1). The command receives empty argument and environment lists, but inherits open file descriptors; only descriptors 0-3 are allowed. The process label will immediately rise to dominate that of the executable file.

Drop sets the process ceiling to label (by default to the process label) for the running of one command with the given arguments. If no command is given, is run.

The current process label, process licenses, terminal label, and environment are preserved.

EXAMPLES

priv session -C ffff...
    Change ceiling to the maximum authorized for the current user.

priv session -l 0

cd /usr/src
    Enter a bottom-label interactive terminal subsession. Get out of the black-hole directory that priv(1) leaves you in.

runlow /bin/sh # not useful
    An attempt to fool the system into giving a bottom-label interactive shell. When the shell reads from standard input, its label will revert to that of the current session.

drop ls -l *

drop pwd
    Prevent the process label from rising to cover the labels of files in the directories examined by ls or pwd. (If the label did rise, the output could not get to the terminal.)

FILES

SEE ALSO
sh(1), getflab(2), getplab(2), exec(2), pwfile(5), login(8), nosh(8), pwserv(8)

DIAGNOSTICS
`Sorry', instead of asking for a password: untrusted channel.