Re: a follow-up question on permissions

First, this is tested on pre-4.* 4GL, so forgive me if it's all changed. Warren Saccente writes: > My first workaround was to change to effective user of the programs that > create/delete dbs/tables by running chmod 6755 on those executable. This > should have made informix think that the owner of the executable was the > user at run time and that login would be the dba/creator. This did not work, > apparently informix uses the real user rather than the effective. We are > running att universe, so you can only change the real user if you are root. It's a shame that the prog has to be setuid root (from a security point of view) but apart from that it doesn't really matter. On Bezerkely, it could just be setuid to the user you want to pretend to be, of course. So, the prog has to be chmod'd setuid root. What you have to do is make a setuid(dba) call (call a little C funtion from the 4GL code, or dead easy if you're already in ESQL) before you issue the "DATABASE foo" statement - after that, informix will return USER = dba rather than your id. In other words, you've successfully fooled it. If you do the setuid after the DATABASE statement, informix knows who you really are and it all falls over. The slight problem with this is that you normally want "DATABASE foo" at the very top of all your files, so that the LIKE stuff works (sorry about all the capitals, I promise I'll stop soon ...) I ended up making the main() "function" miniscule; it just called the setuid function and then the function which did all the work. I also found it useful to keep the real user id (using a C static variable) so that I could figure out who I *really* was after the setuid call had taken effect. I've got a (small :-) bunch of functions which do all this, but I can't get to them for a couple of days. You should get the idea, tho', it's pretty easy. If this doesn't make (enough) sense, mail/post/etc . Incidentally, make very sure that they can't do shell escapes and that you don't RUN anything they can break outta. > thanks, > > Warren J. Saccente > Bellcore > Hope that helps some .... Cheers - Tony. PS.I only got one bite on the FAQ idea (from someone who obviously didn't need it, but thanks for your support :-) so I'll shut up on that one ... __________________________________________________________________________ Tony Heskett th@bnr.co.uk Voice: (+44) 279 429531 x 2637 BNR, London Road, Harlow, Essex, CM17 9NA Fax: (+44) 279 454187