MAINT is possible as Guest

[Herald ten Dam]

Hi,

I can register the user MAINT as a guest through the REGISTER_VM action for a guest. I think (but I did not try) it is also now possible to delete this guest. But that means that MAINT will be deleted (maybe the SMAPI will prevent this).

What I want to propose, is there a possibility to make that a Linux geust can be defined by some regular expressions or something like that? The customer where we work now has always the guest start with SLD or SLB, others are not allowed. This means for the API that there needs to be made some checking before making or registering a guest.

With kind regards
Herald ten Dam

[Huang Rui (bjhuangr)]

Thanks for your finding.

[jichenjc (jichenjc)]

I'd suggest considering a black list, we define this as a configuration item and then
user is eligible to modify it .. MAINT640, MAINT, DIRMAINT , TCPMAINT etc should all be prevented
so a configuration item + (possible a REGEX) is something we need consider

[Herald ten Dam (damsteen)]

My collegue also mentioned a black list, but be aware this can mean at least a list of about 100 userid beforehand (z/VM has a lot of system users), so maybe a mix of include/exclude can make the configuration items smaller.

Herald

[Shu Juan Zhang (zshujuan)]

Herald,

This bug was assigned to me. I'm curious do we have to use a black/white list? Are there any properties of one user id that mark it as a system user, such as its user directory? Then we can decide if the user id is a system user by querying its property.

I'm newbie to z/VM, forgive me if it's not practical.

Daisy

[Herald ten Dam (damsteen)]

Hi Daisy,

there is no such as a label or comment or even property in the user directory which tells us if an user is a system user or something special.

Some options although for some pre-checking:
1. Normally Linux Servers haven only class G, so users with more than this class are meaning something special, Maint for example has ABCDEFG
2. The use of include set by user_profile is an indication for a Linux Server made by CC. But is also not waterproof because it is an optional parameter.

So you see, nothing is waterproof from the perspective of the user directory. So I think a black/white list is for now the best option.

And being a newbie is not a problem, I work just 1 year with z/VM and still a lot to learn ;-)

Herald

[Shu Juan Zhang (zshujuan)]

Herald,

Thanks for your detailed explanation. I also consulted internal z/VM experts, they gave me the same advice. Then in this case, a blacklist that contains a list of system users, and also allows customers to configure, is the best option. I will fix in this way. Thanks.