Re: Informix 4GL 1.10.03K on SCO

>From: Sam Liddicott <sam@csluk.demon.co.uk> >Date: Tue, 22 Jul 1997 17:14:10 +0100 >X-Informix-List-Id: <news.40720> > >Quick question; our copy of Salesforce relies on this informix 4GL (and on >some other). > >When salesforce starts it sets the default "salesforce login" to the >current users username. Make sense. The guys who supply Salesforce say >they get this from a standard 4GL system call. When you say 'it sets the default ... to the users username', I presume that you mean that the database uses the normal login name to control the privileges? If so, saying that you get this from a standard 4GL system call is misleading. When the program is run by UserA, the o/s (and hence Informix) thinks that the user running the program is UserA because this information is always carried around by processes (and it is *not* part of the environment, unlike INFORMIXDIR). >We would like to be able to fake out this value with some other value >(like setting USER or LOGNAME, or even faking out `logname` or `id` or >even mucking about with the utmp file. (We have our own nefarious reasons >for wanting to do this). There's only one way to do this, and that involves a SUID root program. You run a SUID root program which maps the real (and effective) UID to the required alternative value, and then have that program run Salesforce. The fact that a SUID root program is involved opens the door to a large variety of security risks, but no other way will work. One possible SUID program is 'su'; you'd run: su newuid -c "salesforce" This is one of the less risky approaches; the user who does this needs to provide the correct password for the newuid, so it is backed with the same level of security as logging in as newuid. If you want to bypass the password, then you are writing a custom program. I've got such code if you really need it, but you'll inevitably need to customize it to meet your needs. Walt Hultgren (walt@rmy.emory.edu) wrote a program called appstart for this sort of thing back in 1992; I think it was going to be presented at a conference that year, so it is probably available in the IIUG archives (http://www.iiug.org). He's at IWUC so he probably won't be able to answer in person this week. Note that running a non-root SUID program does not help; Informix databases only pay attention to the real UID and a only root can change the real UID, in general. You may be able to do things with setruid() if it is available on your machine, but I have my doubts, both about it being available on your platform and whether it could do anything useful if it was available. (I've not read the manual page carefully enough to know exactly what it can do). >However none of the above tricks works, so does someone know hoe this >"standard 4gl call" actually gets its idea of the current user. And I'm >sorry I don't know exactly WHAT standard call it is, but I think someone >au fait may be able to take a good guess... Yours, Jonathan Leffler (johnl@informix.com) #include <disclaimer.h> PS: Warning I do not reply to messages with anti-spam in the return path.