Re: permissions

James F. Van Valkenburg <jfv@cbnewsk.att.com> writes - > you are allowing database access and you think that table > permissions are going to save you. restrict database connect priviledes from > public and allow only authorize users. Use table level for restricting access > once they are in. > > I am working on a database here at AT&T, and I needed access to another > database. It said I wasn't an authorized user do to a shell script at the > front end, but I looked at sysusers.dat with a binary scanner, ok it was > octal, and noticed that public had connect. I made a default form from the > sysusers table and authorized myself. > > Close off the database level, or anyone can enter and scan all the records. Not true, with an SE database (created as informix) I should get: drwxrwx--- 2 informix informix 5632 Oct 16 19:26 /tmp/foo.dbs The backend process (sqlexec) is setgid informix and therefore is able to read/search the directory. However, no other users should be group informix. Under these restraints, I have no way of reading any files under the directory without invoking the engine (or equiv. setuid/setgid program). I cannot read the files directly unless I've created the DB. When requests are passed to the engine, permissions are automatically checked. With only connect permission, the user is able to read the system catalogs via the engine, *but not the data*, and cannot make any updates. In other words, it is not possible to increase permissions. If you see something different from this, you either have a buggy version of the product or incorrectly-set groupids/userids. On the "binary scanners" front, strings(1), cat -v and less(1) are very useful for looking at systables.dat in times of crisis (where did I leave the logfile ?). You can go straight in and patch with emacs, too %-) Cheers - Tony. PS. Is it time for an FAQ yet ? ____________________________________________________________________________ Tony Heskett: theskett@lhr-sys.ssf-sys.dhl.com | Vox: (+44) 81 747 8330 DHL Systems : Kings House, Great West Road, TW8 9HS | Fax: (+44) 81 747 0875