set-uid root files in bin/

I was building up an AT&T 3B2 OS release to be installed on all field offices, and in the process I installed Informix Online. I do all kind of stuff, such as stripping down (removing demo/, release/, postscript files, etc), and changing file permissions for tighter security, and so on. I then looked at Informix's bin/ set-uid and set-gid executables, and wondered if they really need to be set-uid root, since they are also set-gid informix. Running with id of informix alone should give access to informix raw partition, and shared memory. I could experiment by turning off set-uid root bits, and then running Informix through its paces, but I do not have enough time to do a full test, to make sure Online is still fully functional. I want to minimize number of set-uid root files. Another interesting security issue is bin/sgidsh, whose name implies that it will run scripts with root user id and informix group id, since it is both set-uid root and set-gid informix. Release/Platform Information: Informix-SQL Runtime 4.11.UC1 Media No: 11204121-0011084 Informix-4GL Runtime 4.11.UC2 Media No: 11205121-0011083 Informix-Online Rumtime 5.00.UD1 Media No: 102-07051-001108-1 AT&T Unix System V Release 3.2.3, Load 30, Upgrade 3 (Tape L) AT&T 3B2/600G Many, and many thanks for any information, and discussion. -- ------------------------------------------------------- | Paul T. Pryor | Computer Data Systems, Inc | | (703) 756-8350 Voice/TDD | Falls Church, VA USA | |-------------------------------------------------------| | ptp@fallschurch-acirs2.army.mil [192.86.95.3] | -------------------------------------------------------