pagsh                      AFS Commands                   pagsh


NAME

   pagsh -- create new process authentication group (PAG).


   pagsh

DESCRIPTION

   Creates  a  new  command  shell  (owned by the issuer of the
   command) and associates a new "process authentication group"
   (PAG)  with  the  shell  and  the  user.   A PAG is a number
   guaranteed to identify the issuer of  commands  in  the  new
   shell uniquely to the local Cache Manager.  The PAG is used,
   instead of the issuer's UNIX UID, to identify him or her  in
   the  credential  structure that the Cache Manager creates to
   track each user.

   Any additional tokens issued to  the  user  (presumably  for
   other  cells)  become  associated  with the PAG, rather than
   with the user's UNIX UID.  This  method  for  distinguishing
   users has two advantages.

      - It  means  that  processes  spawned  by  the  user
        inherit the PAG and so share the token; thus  they
        gain  access to AFS as the authenticated user.  In
        many environments, for example, printer and  other
        daemons run under identities (such as "root") that
        the  AFS  server  processes  recognize   only   as
        anonymous.    Unless  PAGs  are used, such daemons
        cannot    access    files    protected     against
        system:anyuser.

      - It  closes  a  potential  security  loophole: UNIX
        allows anyone already logged in  as  "root"  on  a
        machine  to  assume  any other identity by issuing
        su.  If the credential structure  were  identified
        by a UNIX UID rather than a PAG, then assuming the
        same UID would mean being able to use  the  token,
        too.    Use  of  a PAG as an identifier eliminates
        that possibility.

WARNINGS AND REQUIREMENTS

   Each PAG created uses two  of  the  memory  slots  that  the
   kernel  uses  to  record  the  UNIX groups associated with a
   user.  If none of  these  slots  are  available,  the  pagsh
   command  fails.    This is not a problem with most operating
   systems, which make at least 16 slots available per user.

   Users in cells not using the AFS  version  of  login  should
   issue  this  command  before  issuing klog.  If they do not,
   then the Cache Manager stores  the  token  in  a  credential
   structure  identified  by  UNIX  UID  rather than PAG.  This
   creates the potential security  loophole  described  in  the
   DESCRIPTION section.

   If  the  command  is to be issued on NFS client machines for
   which AFS is available, the pagsh binary accessed by the NFS
   client  must  be  owned  by,  and grant setuid privilege to,
   "root."  The complete set of mode bits should be -rwsr-xr-x.



   This  is not a requirement when the command is issued on AFS
   client machines.

EXAMPLE

   The following shows the only possible use of the command.

   % pagsh

PRIVILEGE REQUIRED

   None.

MORE INFORMATION

   klog

   login (AFS version)
