From: louis@BARRA.COM (Louis Dunne)
Newsgroups: comp.os.vms
Subject: Re: HELP: Knighting the underprivileged
Date: 9 Oct 92 17:42:21 GMT
Distribution: world
Organization: BARRA Inc., Berkeley, California.

On Oct 8, 10:14pm, van-bc!cs.ubc.ca!destroyer!caen!spool.mu.edu!umn.e wrote:
> Subject: HELP: Knighting the underprivileged
>HELP!!
>	I am writing an application that must be an installed task which
>can grant its installation privileges to a "underprivileged" user during
>the execution of certain tasks. LIB$SPAWN runs with user privs and cannot
>(methinks) be made to use task privs. 

	LIB$SPAWN can use what you call "task" privileges. If you do a
	LIB$SPAWN, when DCL is invoked by LOGINOUT.EXE, it (DCL) notices
	that it's running in a subprocess. It takes information from a
	mailbox, that the creator writes to. The first record passed in
	this mailbox includes the current process privileges
	(CTL$GQ_PROCPRIV) of the caller. DCL (in the subprocess) does a
	$SETPRV using this value.

	So, if you do a $SETPRV before calling LIB$SPAWN, your (the creator's)
	current process privileges will be changed. Then when DCL starts
	up in the subprocess, it will set the current process privileges
	of the subprocess. You could then reset the creator's privileges
	using $SETPRV is required.

	You may want to note that using LIB$SPAWN may cost you because
	much of your current processes context is passed to DCL in the
	subprocesses. Which of course takes time to read from the mailbox
	and set up for the subprocess.

>SYS$CREPRC allows the task to specify the privilege mask to be used, and
>works for this purpose, but it is *PAINFULLY* slow to wheeze out a spawned
>task (presumably due to the fact that it goes through SYS$SYSTEM:LOGINOUT.EXE
>for each invocation.)

	It is not necessary to get $CREPRC to run LOGINOUT.EXE. Only do
	this if you want a CLI (usually DCL). If you can get away without
	DCL in your created process, then don't specify LOGINOUT as the
	image for $CREPRC. Although, you may very well need DCL if your
	going to use some of the RTL's, because many of them use DCL
	callbacks.

	[ Hmm... a though comes to mind: where could one find a complete
	  list of LIB$ routines etc, that need a CLI to execute. ]

>
>	Does anybody know of an alternative method of getting a spawned task
>to execute with task vs. user privs without going through LOGINOUT.EXE?
>
>	Thanks in advance for any replies.
>
>-Dave Devoy; Network Products Group; Management Graphics, Inc.; Mpls, MN
>

	I hope this clarifies the use of $CREPRC/LIB$SPAWN/LOGINOUT.EXE.

Louis
       -------------------------------------------------------------------------
      / Louis Dunne                          /                                /
     /  VMS/UNIX Systems                    /  Internet:   louis@barra.com   /
    /                                      /   Phone:      (510) 649-4229   / 
   /    BARRA, Inc.                       /    Fax:        (510) 548-4374  /
  /     1995 University Ave., Suite 400  /                                /
 /      Berkeley, CA 94704              /                                /
-------------------------------------------------------------------------