Legion 1.4
System Administrator Manual

6.0 Using security features

You are not required to use any of Legion's security options. We realize that not all systems will benefit from our security and we have therefore designed Legion to run with or without security. However, you must decide whether or not to enable Legion security when you first start your new system: legion_init_security (the command-line tool that starts the security mode) will not run correctly if you have added new hosts, started new classes, or created new users. If you do not run this command, you will still be able to run the system normally, but none of your processes will be protected.

If you are running a multi-architecture system, you will need to register other implementations for the AuthenticationObject (an implementation for your current architecture is automatically created when the system is first initialized). Use the following command on each different architecture:

$ legion_create_implementation \ 
  $LEGION/bin/$LEGION_ARCH/AuthenticationObject \
  $LEGION_ARCH -c /class/AuthenticationObjectClass

If you choose to enable the security features (see Choose your security setting), you must run legion_init_security immediately after you have started a new system and you must log in as admin.

6.1 Creating new users

Please note that you must be logged in as admin in order to create new users in a security-enabled system.

You can now add users to your system, by creating user ids. A user id is an entry in context space that represents an AuthenticationObject. It is also used to signify ownership of all objects that a logged in user creates. The admin creates user ids with the legion_create_user command. This command will also create a home context for the new user. To create a user id for "nemo," for example, you would enter:

$ legion_create_user nemo
New Legion password: xxxx 
Retype password: xxxx
Creating a Home context: /home/nemo
Creating context "nemo" in parent "/home".
New context LOID = "1.3622a3eb.05.11000000.000001fc..."
Changing ACLs on /home/nemo

The command will prompt for a password for the new user and will print the user's AuthenticationObject LOID. It will also create a home context for the user in the /home context.1 Please allow about five minutes for the new user to propagate in your system before using the new id. (Until then the user will get security errors when he tries to create objects.)

The legion_create_user command is actually a simple wrapper around legion_create_user_object. The full command can give more control to the creation of AuthenticationObjects; execute it without arguments for a summary of its options.

Once a user is created, log in is achieved by giving the context path of the user object and a password to legion_login.

$ legion_login /users/nemo

On a successful log in, a new shell is created. Note that user nemo must move to his /home/nemo context: while all users can "read" (i.e., look at and move to) all of the new context space, all non-admin users can "write" (i.e., create new context objects) only in the /home, /etc, /tmp, /mpi, and /pvm contexts. Only admin can "write" in the all parts of context space (Figure 5).

Figure 5: Context space access in a secure Legion system