OpenPKG Specs: openpkg/uuid.8@0ba300bdf30a (annotated)

openpkg/uuid.8@0ba300bdf30a (annotated)

openpkg/uuid.8

Mon, 20 Apr 2009 19:22:00 +0200

author: Michael Schloh von Bennewitz <michael@schloh.com>
date: Mon, 20 Apr 2009 19:22:00 +0200
changeset 178: 0ba300bdf30a
child 428: f880f219c566
permissions: -rw-r--r--

Change unfortunate but partly useful overreaching security tradeoff.
The principle of allocating each running process an individual system
user and group can have security benefits, however maintining a plethora
of users, groups, processes, file modes, file permissions, and even
nonportable file ACLs on a host serving from a hundred processes has
some security disadvantages. This tradeoff is even worse for systems
like OpenPKG which benefit from administration transparency through the
use of minimal system intrusion and only three usage privilege levels.

 .\" Automatically generated by Pod::Man v1.37, Pod::Parser v1.32
 .\"
 .\" Standard preamble:
 .\" ========================================================================
 .de Sh \" Subsection heading
 .br
 .if t .Sp
 .ne 5
 .PP
 \fB\\$1\fR
 .PP
 ..
 .de Sp \" Vertical space (when we can't use .PP)
 .if t .sp .5v
 .if n .sp
 ..
 .de Vb \" Begin verbatim text
 .ft CW
 .nf
 .ne \\$1
 ..
 .de Ve \" End verbatim text
 .ft R
 .fi
 ..
 .\" Set up some character translations and predefined strings.  \*(-- will
 .\" give an unbreakable dash, \*(PI will give pi, \*(L" will give a left
 .\" double quote, and \*(R" will give a right double quote.  | will give a
 .\" real vertical bar.  \*(C+ will give a nicer C++.  Capital omega is used to
 .\" do unbreakable dashes and therefore won't be available.  \*(C` and \*(C'
 .\" expand to `' in nroff, nothing in troff, for use with C<>.
 .tr \(*W-|\(bv\*(Tr
 .ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p'
 .ie n \{\
 .    ds -- \(*W-
 .    ds PI pi
 .    if (\n(.H=4u)&(1m=24u) .ds -- \(*W\h'-12u'\(*W\h'-12u'-\" diablo 10 pitch
 .    if (\n(.H=4u)&(1m=20u) .ds -- \(*W\h'-12u'\(*W\h'-8u'-\"  diablo 12 pitch
 .    ds L" ""
 .    ds R" ""
 .    ds C`
 .    ds C'
 'br\}
 .el\{\
 .    ds -- \|\(em\|
 .    ds PI \(*p
 .    ds L" ``
 .    ds R" ''
 'br\}
 .\"
 .\" If the F register is turned on, we'll generate index entries on stderr for
 .\" titles (.TH), headers (.SH), subsections (.Sh), items (.Ip), and index
 .\" entries marked with X<> in POD.  Of course, you'll have to process the
 .\" output yourself in some meaningful fashion.
 .if \nF \{\
 .    de IX
 .    tm Index:\\$1\t\\n%\t"\\$2"
 ..
 .    nr % 0
 .    rr F
 .\}
 .\"
 .\" For nroff, turn off justification.  Always turn off hyphenation; it makes
 .\" way too many mistakes in technical documents.
 .hy 0
 .if n .na
 .\"
 .\" Accent mark definitions (@(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2).
 .\" Fear.  Run.  Save yourself.  No user-serviceable parts.
 .    \" fudge factors for nroff and troff
 .if n \{\
 .    ds #H 0
 .    ds #V .8m
 .    ds #F .3m
 .    ds #[ \f1
 .    ds #] \fP
 .\}
 .if t \{\
 .    ds #H ((1u-(\\\\n(.fu%2u))*.13m)
 .    ds #V .6m
 .    ds #F 0
 .    ds #[ \&
 .    ds #] \&
 .\}
 .    \" simple accents for nroff and troff
 .if n \{\
 .    ds ' \&
 .    ds ` \&
 .    ds ^ \&
 .    ds , \&
 .    ds ~ ~
 .    ds /
 .\}
 .if t \{\
 .    ds ' \\k:\h'-(\\n(.wu*8/10-\*(#H)'\'\h"|\\n:u"
 .    ds ` \\k:\h'-(\\n(.wu*8/10-\*(#H)'\`\h'|\\n:u'
 .    ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'^\h'|\\n:u'
 .    ds , \\k:\h'-(\\n(.wu*8/10)',\h'|\\n:u'
 .    ds ~ \\k:\h'-(\\n(.wu-\*(#H-.1m)'~\h'|\\n:u'
 .    ds / \\k:\h'-(\\n(.wu*8/10-\*(#H)'\z\(sl\h'|\\n:u'
 .\}
 .    \" troff and (daisy-wheel) nroff accents
 .ds : \\k:\h'-(\\n(.wu*8/10-\*(#H+.1m+\*(#F)'\v'-\*(#V'\z.\h'.2m+\*(#F'.\h'|\\n:u'\v'\*(#V'
 .ds 8 \h'\*(#H'\(*b\h'-\*(#H'
 .ds o \\k:\h'-(\\n(.wu+\w'\(de'u-\*(#H)/2u'\v'-.3n'\*(#[\z\(de\v'.3n'\h'|\\n:u'\*(#]
 .ds d- \h'\*(#H'\(pd\h'-\w'~'u'\v'-.25m'\f2\(hy\fP\v'.25m'\h'-\*(#H'
 .ds D- D\\k:\h'-\w'D'u'\v'-.11m'\z\(hy\v'.11m'\h'|\\n:u'
 .ds th \*(#[\v'.3m'\s+1I\s-1\v'-.3m'\h'-(\w'I'u*2/3)'\s-1o\s+1\*(#]
 .ds Th \*(#[\s+2I\s-2\h'-\w'I'u*3/5'\v'-.3m'o\v'.3m'\*(#]
 .ds ae a\h'-(\w'a'u*4/10)'e
 .ds Ae A\h'-(\w'A'u*4/10)'E
 .    \" corrections for vroff
 .if v .ds ~ \\k:\h'-(\\n(.wu*9/10-\*(#H)'\s-2\u~\d\s+2\h'|\\n:u'
 .if v .ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'\v'-.4m'^\v'.4m'\h'|\\n:u'
 .    \" for low resolution devices (crt and lpr)
 .if \n(.H>23 .if \n(.V>19 \
 \{\
 .    ds : e
 .    ds 8 ss
 .    ds o a
 .    ds d- d\h'-1'\(ga
 .    ds D- D\h'-1'\(hy
 .    ds th \o'bp'
 .    ds Th \o'LP'
 .    ds ae ae
 .    ds Ae AE
 .\}
 .rm #[ #] #H #V #F C
 .\" ========================================================================
 .\"
 .IX Title "UUID 8"
 .TH UUID 8 "OpenPKG" "UUID(8)" "OpenPKG"
 .SH "NAME"
 \&\fBopenpkg uuid\fR \- OpenPKG UUID Update Utility
 .SH "SYNOPSIS"
 .IX Header "SYNOPSIS"
 \&\fBopenpkg uuid\fR [\fB\-\-verbose\fR] [\fB\-\-multicast\fR] \fBreset\fR|\fBupdate\fR|\fBinfo\fR
 .SH "DESCRIPTION"
 .IX Header "DESCRIPTION"
 The \fBopenpkg uuid\fR command is the maintenance utility for the \s-1DCE\s0 1.1
 and \s-1ISO/IEC\s0 11578:1996 compliant \fIUniversally Unique Identifiers\fR
 (\s-1UUID\s0) of an \fBOpenPKG\fR instance. It is internally based on \fB\s-1OSSP\s0
 uuid\fR.
 .PP
 UUIDs are 128 bit numbers which are intended to have a high likelihood
 of uniqueness over space and time and are computationally difficult
 to guess. They are globally unique identifiers which can be locally
 generated without contacting a global registration authority. UUIDs are
 intended as unique identifiers for both mass tagging objects with an
 extremely short lifetime and to reliably identifying very persistent
 objects across a network. The three classical \s-1UUID\s0 variants are \s-1DCE\s0 1.1
 UUIDs of version 1 (time and node based), version 3 (name based) and
 version 4 (random number based).
 .PP
 For an \fBOpenPKG\fR instance, three different UUIDs are used:
 .ie n .IP "1. \fBOpenPKG Registry\fR (\*(C`UUID_REGISTRY\*(C')" 3
 .el .IP "1. \fBOpenPKG Registry\fR (\f(CW\*(C`UUID_REGISTRY\*(C'\fR)" 3
 .IX Item "1. OpenPKG Registry (UUID_REGISTRY)"
 This is a version 1 \s-1UUID\s0 which uniquely identifiers the \fBOpenPKG\fR
 instance for global registration purposes. It is generated just once in
 the lifetime of the \fBOpenPKG\fR instance. The value of this \s-1UUID\s0 cannot
 be recalculated deterministically.
 .ie n .IP "2. \fBOpenPKG Instance\fR (\*(C`UUID_INSTANCE\*(C')" 3
 .el .IP "2. \fBOpenPKG Instance\fR (\f(CW\*(C`UUID_INSTANCE\*(C'\fR)" 3
 .IX Item "2. OpenPKG Instance (UUID_INSTANCE)"
 This is a version 3 \s-1UUID\s0 which summarizes the \fBOpenPKG\fR
 instance parameters. Currently the values of the following
 particular OpenPKG \s-1RPM\s0 macros are uses as input:
 .Sp
 .Vb 5
 \& %{l_openpkg_release} %{l_prefix}
 \& %{l_susr} %{l_suid} %{l_sgrp} %{l_sgid}
 \& %{l_musr} %{l_muid} %{l_mgrp} %{l_mgid}
 \& %{l_rusr} %{l_ruid} %{l_rgrp} %{l_rgid}
 \& %{l_nusr} %{l_nuid} %{l_ngrp} %{l_ngid}
 .Ve
 .Sp
 The value of this \s-1UUID\s0 can be recalculated deterministically and will
 not chance as long as none of the values of the above macro do not
 change. This \s-1UUID\s0 can be used for detecting OpenPKG release upgrades,
 accidentally changed UIDs or GIDs, etc. Notice that version 3 UUIDs are
 message digests (actually \s-1MD5\s0 based) and so are one-way functions which do
 not allow one to recalculate the input values from the \s-1UUID\s0.
 .ie n .IP "3. \fBOpenPKG Platform\fR (\*(C`UUID_PLATFORM\*(C')" 3
 .el .IP "3. \fBOpenPKG Platform\fR (\f(CW\*(C`UUID_PLATFORM\*(C'\fR)" 3
 .IX Item "3. OpenPKG Platform (UUID_PLATFORM)"
 This is a version 3 \s-1UUID\s0 which summarizes the \fBOpenPKG\fR platform
 parameters. Currently the OpenPKG \s-1RPM\s0 platform id plus the \s-1FQDN\s0 and \s-1IP\s0
 address of the underlying host are used as input. This \s-1UUID\s0 can be used
 for detecting operating system and host changes. Notice that version
 UUIDs are message digests (actually \s-1MD5\s0 based) and so are one-way
 functions which do not allow one to recalculate the input values from
 the \s-1UUID\s0.
 .SH "OPTIONS"
 .IX Header "OPTIONS"
 .IP "\fB\-\-verbose\fR" 4
 .IX Item "--verbose"
 Print verbose messages during operation.
 .IP "\fB\-\-multicast\fR" 4
 .IX Item "--multicast"
 Generate a random multicast \s-1MAC\s0 address instead of using the real \s-1IEEE\s0
 \s-1MAC\s0 address of the underlying host when generating the version 1
 \&\s-1UUID\s0 \f(CW\*(C`UUID_REGISTRY\*(C'\fR.
 .SH "COMMANDS"
 .IX Header "COMMANDS"
 .IP "\fBreset\fR" 4
 .IX Item "reset"
 This resets the three UUIDs \f(CW\*(C`UUID_REGISTRY\*(C'\fR, \f(CW\*(C`UUID_INSTANCE\*(C'\fR and
 \&\f(CW\*(C`UUID_PLATFORM\*(C'\fR to the \*(L"Nil \s-1UUID\s0\*(R". They are then automatically
 regenerated within one day if already done explicitly afterward with
 "\f(CW\*(C`openpkg uuid update\*(C'\fR".
 .IP "\fBupdate\fR" 4
 .IX Item "update"
 This updates the three UUIDs \f(CW\*(C`UUID_REGISTRY\*(C'\fR, \f(CW\*(C`UUID_INSTANCE\*(C'\fR and
 \&\f(CW\*(C`UUID_PLATFORM\*(C'\fR to the \*(L"Nil \s-1UUID\s0\*(R". \f(CW\*(C`UUID_REGISTRY\*(C'\fR is kept unless it
 is the \*(L"Nil \s-1UUID\s0\*(R" (see "\f(CW\*(C`openpkg uuid reset\*(C'\fR" command above). The UUIDs
 \&\f(CW\*(C`UUID_INSTANCE\*(C'\fR and \f(CW\*(C`UUID_PLATFORM\*(C'\fR are updated only if their input
 values (and this way the resulting UUIDs) have changed. This operation
 is performed daily automatically.
 .IP "\fBinfo\fR" 4
 .IX Item "info"
 This print summary page of identification information, including all
 UUIDs and all of their calculation inputs.
 .SH "FILES"
 .IX Header "FILES"
 The three UUIDs of the \fBOpenPKG\fR instance are stored in the file
 \&\f(CW\*(C`@l_prefix@/etc/openpkg/uuid\*(C'\fR in Bourne-Shell syntax. An example
 content is:
 .PP
 .Vb 3
 \& UUID_REGISTRY="81eca44e-4d18-11d8-a837-0090272ff725"
 \& UUID_INSTANCE="c55a8d2d-31bb-3ae0-9edb-68337af61acc"
 \& UUID_PLATFORM="05ec2532-9e3f-37dc-a7ed-b291c2c463ed"
 .Ve
 .SH "CAVEATS"
 .IX Header "CAVEATS"
 By default and in full compliance with \s-1DCE\s0 1.1 and \s-1ISO/IEC\s0 11578:1996,
 the OpenPKG Registry \s-1UUID\s0 (\f(CW\*(C`UUID_REGISTRY\*(C'\fR) contains the \s-1IEEE\s0 802 \s-1MAC\s0
 address of the underlying host. If this is not acceptable by local
 security policies you can easily at any time generate a new OpenPKG
 Registry \s-1UUID\s0 with a random multicast \s-1MAC\s0 address instead by running:
 .PP
 .Vb 2
 \& $ openpkg uuid reset
 \& $ openpkg uuid --multicast update
 .Ve
 .SH "SEE ALSO"
 .IX Header "SEE ALSO"
 \&\fB\s-1OSSP\s0 uuid\fR <http://www.ossp.org/pkg/lib/uuid/>.
 .SH "HISTORY"
 .IX Header "HISTORY"
 The \fBopenpkg uuid\fR command first appeared in \fBOpenPKG 2.0\fR.

OpenPKG Specs / annotate

openpkg/uuid.8@0ba300bdf30a (annotated)

openpkg/uuid.8