Re: Web Access to Informix SE -- Security issues

> > A question to people generating Web pages from Informix data. > > My first solution was have the http server run as an unprivileged user > and SUID the CGI script owned by a full db user. The http server > authenticates the remote users and passes the requests to the CGI > interface, which handles the real db permissions. > > Well, this approach fails. Subprocesses generated by the SUID program > inherit only the EFFECTIVE USER ID from the parent process, but Informix > SE checks the REAL USER ID for the db permissions. The NCR OS won't > allow non root logins to set the REAL USER ID (by design they say). If your NCR opsys can't handle (or don't know) about the 'setreuid', there is no secure solution. Maybe one idea: Call a simple cgi-script (setuid root), which then uses 'su -u $REALUSER -c $COMMAND'. It's depending on your opsys, but it works on lot of UNIX'es. -- Chris Drauch ...................................................................... . c/o DRAUCH Ges.m.b.H. Tel. 43/ 3135/46387-0 . . Gewerbestrasse 5 Fax 43/ 3135/4638728 . . A-8071 Hausmannstaetten EMail cdr@xteam.co.at . ......................................................................