Re: Question on Access Privileges

In <20c0p4INNmhn@emory.mathcs.emory.edu> obelix.informix.com!johnl@emory.mathcs.emory.edu (Jonathan Leffler) writes: >>From: uunet!iti.gov.sg!cmlow (Low Chee Meng) >>Subject: Question on Access Privilleges >>Date: Thu, 24 Jun 1993 04:26:27 GMT >>X-Informix-List-Id: <news.3630> >>2) If I have an ESQL/C program that has the SET_UID bit set, will whoever >>that runs this program have the same access privileges as me? In other >>words, does Informix check the REAL user-id or the EFFECTIVE user-id when >>checking for access violations? >It could use either, but the two user IDs are always the same. >Both Informix-OnLine and Informix-SE are themselves SUID root, SGID >informix programs. When the engine is run, these setXid privileges >effectively lose the SUID-ness (and SGID-ness) of the program which runs >the engine. The application real and effective IDs are not changed, of >course, because they are a separate process from the engine process. >The root privileges are used briefly to set ulimit to infinity (or near >enough), and then the effective UID is reset to the real UID. The group ^^^^^ But the effective UID was NOT previously the real UID, so can you reconfirm that the effective UID is *set* to the real UID and not *reset* to the effective UID of the calling process? I thought it did the latter, (although I haven't checked). And I think I think that it *should* do the latter. >informix privileges are retained and are the normal source of access rights >on the database tables. Hence, no-one except user informix should belong >to group informix. graeme -- Disclaimer: The author's opinions are his own, and not necessarily those of Pyramid Technology Ltd. or Pyramid Technology Inc. --------------------------------------------------------------------------- -m------- Graeme Sargent Voice: +44 (0)252 373035 ---mmm----- Senior Database Consultant Fax : +44 (0)252 373135 -----mmmmm--- Pyramid Technology Ltd. Telex: Tell who??? -------mmmmmmm- Farnborough, Hants GU14 7PL Email: graeme@pyra.co.uk --------------------------------------------------------------------------- We have the technology. The tricky bit is learning how to use it.