New security check?

Posted in 2017

Summary

Art Kagel renamed oninit and put a wrapper script in its place to set the environment, but on 12.10 startup failed with complaints about root chunk permissions, though the chunk permissions were unchanged. Suggestions included using a shell alias instead (with warnings that aliases don't expand in bash/ksh scripts without shopt -s expand_aliases). David traced oninit stat-ing itself: because the wrapper was owned by informix, the engine assumed a non-root install, which requires 600 chunk permissions rather than 660. Making the wrapper root-owned and setuid root fixed it, though Jonathan Leffler cautioned against setuid shell scripts.

Auto-generated by DrWatson from the posts below — may be imperfect; read the full thread.

Topics: Storage & Space Management, Jobs, Consulting & Announcements

Art Kagel — Thu, 10 Aug 2017 17:31:38 — source: IIUG Forums & Mailing Lists

Folks: I renamed oninit and replaced it with a script that sets the environment then runs the renamed oninit binary. Wanted this to make certain that a manual restart has the correct environment settings. On startup using either the script or the renamed oninit the engine complains about the permissions on the root chunk and aborts the startup. Name oninit back to itself and all is well. Permissions on the root chunk and all the other chunk files are fine. I have done this many times in the past on earlier releases of Informix with no issues. Is there some new security check in v12.10? Is there are way around it? Art Art S. Kagel, President and Principal Consultant ASK Database Management www.askdbmgt.com Blog: http://informix-myview.blogspot.com/ Disclaimer: Please keep in mind that my own opinions are my own opinions and do not reflect on the IIUG, nor any other organization with which I am associated either explicitly, implicitly, or by inference. Neither do those opinions reflect those of other individuals affiliated with any entity with which I am affiliated nor those of the entities themselves.

↪ replying to Art Kagel

Mueller, Daniel D. — Thu, 10 Aug 2017 17:48:39 — source: IIUG Forums & Mailing Lists

We do something similar except we used an alias named oninit. Do what you want with the alias and then call the real oninit. Dan -----Original Message----- From: ids-bounces@iiug.org [mailto:ids-bounces@iiug.org] On Behalf Of Art Kagel Sent: Thursday, August 10, 2017 1:32 PM To: ids@iiug.org Subject: New security check? [39678] Folks: I renamed oninit and replaced it with a script that sets the environment then runs the renamed oninit binary. Wanted this to make certain that a manual restart has the correct environment settings. On startup using either the script or the renamed oninit the engine complains about the permissions on the root chunk and aborts the startup. Name oninit back to itself and all is well. Permissions on the root chunk and all the other chunk files are fine. I have done this many times in the past on earlier releases of Informix with no issues. Is there some new security check in v12.10? Is there are way around it? Art Art S. Kagel, President and Principal Consultant ASK Database Management www.askdbmgt.com Blog: http://informix-myview.blogspot.com/ Disclaimer: Please keep in mind that my own opinions are my own opinions and do not reflect on the IIUG, nor any other organization with which I am associated either explicitly, implicitly, or by inference. Neither do those opinions reflect those of other individuals affiliated with any entity with which I am affiliated nor those of the entities themselves. ******************************************************************************* Forum Note: Use "Reply" to post a response in the discussion forum.

↪ replying to Mueller, Daniel D.

Art Kagel — Thu, 10 Aug 2017 18:35:55 — source: IIUG Forums & Mailing Lists

Interesting idea Dan. Have to think if that works in all circumstances, but it sounds like a winner. Art Art S. Kagel, President and Principal Consultant ASK Database Management www.askdbmgt.com Blog: http://informix-myview.blogspot.com/ Disclaimer: Please keep in mind that my own opinions are my own opinions and do not reflect on the IIUG, nor any other organization with which I am associated either explicitly, implicitly, or by inference. Neither do those opinions reflect those of other individuals affiliated with any entity with which I am affiliated nor those of the entities themselves. On Thu, Aug 10, 2017 at 12:48 PM, Mueller, Daniel D. <DDMueller@west.com> wrote: > We do something similar except we used an alias named oninit. Do what you > want > with the alias and then call the real oninit. > > Dan > > -----Original Message----- > From: ids-bounces@iiug.org [mailto:ids-bounces@iiug.org] On Behalf Of Art > Kagel > Sent: Thursday, August 10, 2017 1:32 PM > To: ids@iiug.org > Subject: New security check? [39678] > > Folks: > > I renamed oninit and replaced it with a script that sets the environment > then > runs the renamed oninit binary. Wanted this to make certain that a manual > restart has the correct environment settings. > > On startup using either the script or the renamed oninit the engine > complains > about the permissions on the root chunk and aborts the startup. > Name oninit back to itself and all is well. Permissions on the root chunk > and > all the other chunk files are fine. > > I have done this many times in the past on earlier releases of Informix > with > no issues. Is there some new security check in v12.10? Is there are way > around > it? > > Art > > Art S. Kagel, President and Principal Consultant ASK Database Management > www.askdbmgt.com > > Blog: http://informix-myview.blogspot.com/ > > Disclaimer: Please keep in mind that my own opinions are my own opinions > and > do not reflect on the IIUG, nor any other organization with which I am > associated either explicitly, implicitly, or by inference. Neither do those > opinions reflect those of other individuals affiliated with any entity with > which I am affiliated nor those of the entities themselves. > > > ************************************************************ > ******************* > Forum Note: Use "Reply" to post a response in the discussion forum. > > > ************************************************************ > ******************* > Forum Note: Use "Reply" to post a response in the discussion forum. > >

↪ replying to Art Kagel

Cesar Martins — Thu, 10 Aug 2017 18:58:05 — source: IIUG Forums & Mailing Lists

Be careful, I also use alias to oninit here too. Alias is very tricky. It wasn't recognized into bash scripts, either if you set it into the same shell (to work, you must set some shopt expand_aliases). for ksh , works partially. So, if you have scripts to automate the start of the engine, test before... This is a bash on AIX : [cinacio]/home/cinacio>alias xyz='echo "hello"' [cinacio]/home/cinacio>xyz hello [cinacio]/home/cinacio>cat -n ./x.sh 1 xyz 2 alias zyx='echo olleh' 3 zyx [cinacio]/home/cinacio>bash ./x.sh ./x.sh: line 1: xyz: command not found ./x.sh: line 3: zyx: command not found [cinacio]/home/cinacio>./x.sh ./x.sh: line 1: xyz: command not found ./x.sh: line 3: zyx: command not found [cinacio]/home/cinacio>ksh ./x.sh ./x.sh: xyz: not found. olleh [cinacio]/home/cinacio>. ./x.sh hello olleh [cinacio]/home/cinacio>cat -n x.sh 1 shopt -s expand_aliases 2 xyz 3 alias zyx='echo olleh' 4 zyx [cinacio]/home/cinacio>./x.sh ./x.sh: line 2: xyz: command not found olleh Em qui, 10 de ago de 2017 15:36, Art Kagel <art.kagel@gmail.com> escreveu: > Interesting idea Dan. Have to think if that works in all circumstances, but > it sounds like a winner. > > Art > > Art S. Kagel, President and Principal Consultant > ASK Database Management > www.askdbmgt.com > >

↪ replying to Cesar Martins

Art Kagel — Thu, 10 Aug 2017 19:06:13 — source: IIUG Forums & Mailing Lists

Works in ksh on AIX here: informix @ ucu00038:/wic/informix/askdbm: cat do alias fred="echo I am Fred" fred informix @ ucu00038:/wic/informix/askdbm: ./do I am Fred informix @ ucu00038:/wic/informix/askdbm: I do see that bash would require the script to include an shopt call to expand aliases though. Thanks. Art Art S. Kagel, President and Principal Consultant ASK Database Management www.askdbmgt.com Blog: http://informix-myview.blogspot.com/ Disclaimer: Please keep in mind that my own opinions are my own opinions and do not reflect on the IIUG, nor any other organization with which I am associated either explicitly, implicitly, or by inference. Neither do those opinions reflect those of other individuals affiliated with any entity with which I am affiliated nor those of the entities themselves. On Thu, Aug 10, 2017 at 1:58 PM, Cesar Martins < cesar.inacio.martins@gmail.com> wrote: > Be careful, I also use alias to oninit here too. > > Alias is very tricky. > It wasn't recognized into bash scripts, either if you set it into the same > shell (to work, you must set some shopt expand_aliases). > > for ksh , works partially. > So, if you have scripts to automate the start of the engine, test before... > > This is a bash on AIX : > > [cinacio]/home/cinacio>alias xyz='echo "hello"' > > [cinacio]/home/cinacio>xyz > > hello > > [cinacio]/home/cinacio>cat -n ./x.sh > > 1 xyz > > 2 alias zyx='echo olleh' > > 3 zyx > > [cinacio]/home/cinacio>bash ./x.sh > > ../x.sh: line 1: xyz: command not found > > ../x.sh: line 3: zyx: command not found > > [cinacio]/home/cinacio>./x.sh > > ../x.sh: line 1: xyz: command not found > > ../x.sh: line 3: zyx: command not found > > [cinacio]/home/cinacio>ksh ./x.sh > > ../x.sh: xyz: not found. > > olleh > > [cinacio]/home/cinacio>. ./x.sh > > hello > > olleh > > [cinacio]/home/cinacio>cat -n x.sh > > 1 shopt -s expand_aliases > > 2 xyz > > 3 alias zyx='echo olleh' > > 4 zyx > > [cinacio]/home/cinacio>./x.sh > > ../x.sh: line 2: xyz: command not found > > olleh > > Em qui, 10 de ago de 2017 15:36, Art Kagel <art.kagel@gmail.com> escreveu: > > > Interesting idea Dan. Have to think if that works in all circumstances, > but > > it sounds like a winner. > > > > Art > > > > Art S. Kagel, President and Principal Consultant > > ASK Database Management > > www.askdbmgt.com > > > > > > > ************************************************************ > ******************* > Forum Note: Use "Reply" to post a response in the discussion forum. > >

↪ replying to Art Kagel

david@smooth1.co.uk — Thu, 10 Aug 2017 19:15:41 — source: IIUG Forums & Mailing Lists

Art, Solved by making the oninit script setuid root, I wonder if this is to do oninit checking for a non-root installation? INVESTIGATION: Tested with 12.10.xC9 on "CentOS Linux release 7.3.1611 (Core)" Playing with strace I found that oninit does a stat of itself! I created my oninit script as user informix hence it did not have the same permissons as the original oninit binary. Gradually matching permissions with the oninit binary I found that if you make the oninit script to be setuid root then the issue is resolved. chown root oninit chmod o-r oninit chmod o-x oninit chmod u+s oninit (Solved!) ls -l oninit* -rwsrwx---. 1 root informix 99 Aug 10 20:20 oninit -rwsr-sr--. 1 root informix 25528408 Aug 9 06:38 oninit.su I suppose for completness we could do chmod g-w oninit chmod g+s oninit chmod o+r oninit ls -l oninit* -rwsr-sr--. 1 root informix 99 Aug 10 20:20 oninit -rwsr-sr--. 1 root informix 25528408 Aug 9 06:38 oninit.su Regards, David. > On 10 August 2017 at 19:35 Art Kagel <art.kagel@gmail.com> wrote: > > > Interesting idea Dan. Have to think if that works in all circumstances, but > it sounds like a winner. > > Art > > Art S. Kagel, President and Principal Consultant > ASK Database Management > www.askdbmgt.com > > Blog: http://informix-myview.blogspot.com/ > > Disclaimer: Please keep in mind that my own opinions are my own opinions > and do not reflect on the IIUG, nor any other organization with which I am > associated either explicitly, implicitly, or by inference. Neither do > those opinions reflect those of other individuals affiliated with any > entity with which I am affiliated nor those of the entities themselves. > > On Thu, Aug 10, 2017 at 12:48 PM, Mueller, Daniel D. <DDMueller@west.com> > wrote: > > > We do something similar except we used an alias named oninit. Do what you > > want > > with the alias and then call the real oninit. > > > > Dan > > > > -----Original Message----- > > From: ids-bounces@iiug.org [mailto:ids-bounces@iiug.org] On Behalf Of Art > > Kagel > > Sent: Thursday, August 10, 2017 1:32 PM > > To: ids@iiug.org > > Subject: New security check? [39678] > > > > Folks: > > > > I renamed oninit and replaced it with a script that sets the environment > > then > > runs the renamed oninit binary. Wanted this to make certain that a manual > > restart has the correct environment settings. > > > > On startup using either the script or the renamed oninit the engine > > complains > > about the permissions on the root chunk and aborts the startup. > > Name oninit back to itself and all is well. Permissions on the root chunk > > and > > all the other chunk files are fine. > > > > I have done this many times in the past on earlier releases of Informix > > with > > no issues. Is there some new security check in v12.10? Is there are way > > around > > it? > > > > Art > > > > Art S. Kagel, President and Principal Consultant ASK Database Management > > www.askdbmgt.com > > > > Blog: http://informix-myview.blogspot.com/ > > > > Disclaimer: Please keep in mind that my own opinions are my own opinions > > and > > do not reflect on the IIUG, nor any other organization with which I am > > associated either explicitly, implicitly, or by inference. Neither do those > > opinions reflect those of other individuals affiliated with any entity with > > which I am affiliated nor those of the entities themselves. > > > > > > ************************************************************ > > ******************* > > Forum Note: Use "Reply" to post a response in the discussion forum. > > > > > > ************************************************************ > > ******************* > > Forum Note: Use "Reply" to post a response in the discussion forum. > > > > > > > ******************************************************************************* > Forum Note: Use "Reply" to post a response in the discussion forum. >

↪ replying to david@smooth1.co.uk

david@smooth1.co.uk — Thu, 10 Aug 2017 19:21:28 — source: IIUG Forums & Mailing Lists

Answer my own question...yes non-root installation require different chunk permissions than that expected for root installations. https://www.ibm.com/support/knowledgecenter/en/SSGU8G_12.1.0/com.ibm.sec.doc/ids _us_011.htm "For Informix® security, store data in chunk files that are owned by user informix, belong to group informix, and have 660 permissions." "Chunk files for non-root installations of Informix must have permissions set to 600." Regards, David. > On 10 August 2017 at 20:15 "david@smooth1.co.uk" <david@smooth1.co.uk> wrote: > > > Art, > > Solved by making the oninit script setuid root, I wonder if this is to do > oninit checking for a non-root installation? > > INVESTIGATION: > > Tested with 12.10.xC9 on "CentOS Linux release 7.3.1611 (Core)" > > Playing with strace I found that oninit does a stat of itself! > > I created my oninit script as user informix hence it did not have the same > permissons as the original oninit binary. > > Gradually matching permissions with the oninit binary I found that if you make > the oninit script to be setuid root then the issue is resolved. > > chown root oninit > chmod o-r oninit > chmod o-x oninit > chmod u+s oninit (Solved!) > > ls -l oninit* > -rwsrwx---. 1 root informix 99 Aug 10 20:20 oninit > -rwsr-sr--. 1 root informix 25528408 Aug 9 06:38 oninit.su > > I suppose for completness we could do > > chmod g-w oninit > chmod g+s oninit > chmod o+r oninit > > ls -l oninit* > -rwsr-sr--. 1 root informix 99 Aug 10 20:20 oninit > -rwsr-sr--. 1 root informix 25528408 Aug 9 06:38 oninit.su > > Regards, > David. > > > On 10 August 2017 at 19:35 Art Kagel <art.kagel@gmail.com> wrote: > > > > > > Interesting idea Dan. Have to think if that works in all circumstances, but > > it sounds like a winner. > > > > Art > > > > Art S. Kagel, President and Principal Consultant > > ASK Database Management > > www.askdbmgt.com > > > > Blog: http://informix-myview.blogspot.com/ > > > > Disclaimer: Please keep in mind that my own opinions are my own opinions > > and do not reflect on the IIUG, nor any other organization with which I am > > associated either explicitly, implicitly, or by inference. Neither do > > those opinions reflect those of other individuals affiliated with any > > entity with which I am affiliated nor those of the entities themselves. > > > > On Thu, Aug 10, 2017 at 12:48 PM, Mueller, Daniel D. <DDMueller@west.com> > > wrote: > > > > > We do something similar except we used an alias named oninit. Do what you > > > want > > > with the alias and then call the real oninit. > > > > > > Dan > > > > > > -----Original Message----- > > > From: ids-bounces@iiug.org [mailto:ids-bounces@iiug.org] On Behalf Of Art > > > Kagel > > > Sent: Thursday, August 10, 2017 1:32 PM > > > To: ids@iiug.org > > > Subject: New security check? [39678] > > > > > > Folks: > > > > > > I renamed oninit and replaced it with a script that sets the environment > > > then > > > runs the renamed oninit binary. Wanted this to make certain that a manual > > > restart has the correct environment settings. > > > > > > On startup using either the script or the renamed oninit the engine > > > complains > > > about the permissions on the root chunk and aborts the startup. > > > Name oninit back to itself and all is well. Permissions on the root chunk > > > and > > > all the other chunk files are fine. > > > > > > I have done this many times in the past on earlier releases of Informix > > > with > > > no issues. Is there some new security check in v12.10? Is there are way > > > around > > > it? > > > > > > Art > > > > > > Art S. Kagel, President and Principal Consultant ASK Database Management > > > www.askdbmgt.com > > > > > > Blog: http://informix-myview.blogspot.com/ > > > > > > Disclaimer: Please keep in mind that my own opinions are my own opinions > > > and > > > do not reflect on the IIUG, nor any other organization with which I am > > > associated either explicitly, implicitly, or by inference. Neither do > those > > > opinions reflect those of other individuals affiliated with any entity > with > > > which I am affiliated nor those of the entities themselves. > > > > > > > > > ************************************************************ > > > ******************* > > > Forum Note: Use "Reply" to post a response in the discussion forum. > > > > > > > > > ************************************************************ > > > ******************* > > > Forum Note: Use "Reply" to post a response in the discussion forum. > > > > > > > > > > > > > ******************************************************************************* > > Forum Note: Use "Reply" to post a response in the discussion forum. > > > > > ******************************************************************************* > Forum Note: Use "Reply" to post a response in the discussion forum. >

↪ replying to Art Kagel

Art Kagel — Thu, 10 Aug 2017 19:29:48 — source: IIUG Forums & Mailing Lists

David: I think you are right. The oninit sees that the file "oninit" is owned by "informix" and assumes a non-root install so only the 'owner' should have write privs on the chunks. For a root install both owsner and group informix have privs. I'll have to get a sysadmin involved for this since I can't chown the script to root as informix. Art Art S. Kagel, President and Principal Consultant ASK Database Management www.askdbmgt.com Blog: http://informix-myview.blogspot.com/ Disclaimer: Please keep in mind that my own opinions are my own opinions and do not reflect on the IIUG, nor any other organization with which I am associated either explicitly, implicitly, or by inference. Neither do those opinions reflect those of other individuals affiliated with any entity with which I am affiliated nor those of the entities themselves. On Thu, Aug 10, 2017 at 2:15 PM, <david@smooth1.co.uk> wrote: > Art, > > Solved by making the oninit script setuid root, I wonder if this is to do > oninit checking for a non-root installation? > > INVESTIGATION: > > Tested with 12.10.xC9 on "CentOS Linux release 7.3.1611 (Core)" > > Playing with strace I found that oninit does a stat of itself! > > I created my oninit script as user informix hence it did not have the same > permissons as the original oninit binary. > > Gradually matching permissions with the oninit binary I found that if you > make the oninit script to be setuid root then the issue is resolved. > > chown root oninit > chmod o-r oninit > chmod o-x oninit > chmod u+s oninit (Solved!) > > ls -l oninit* > -rwsrwx---. 1 root informix 99 Aug 10 20:20 oninit > -rwsr-sr--. 1 root informix 25528408 Aug 9 06:38 oninit.su > > I suppose for completness we could do > > chmod g-w oninit > chmod g+s oninit > chmod o+r oninit > > ls -l oninit* > -rwsr-sr--. 1 root informix 99 Aug 10 20:20 oninit > -rwsr-sr--. 1 root informix 25528408 Aug 9 06:38 oninit.su > > Regards, > David. > > > On 10 August 2017 at 19:35 Art Kagel <art.kagel@gmail.com> wrote: > > > > > > Interesting idea Dan. Have to think if that works in all circumstances, > but > > it sounds like a winner. > > > > Art > > > > Art S. Kagel, President and Principal Consultant > > ASK Database Management > > www.askdbmgt.com > > > > Blog: http://informix-myview.blogspot.com/ > > > > Disclaimer: Please keep in mind that my own opinions are my own opinions > > and do not reflect on the IIUG, nor any other organization with which I > am > > associated either explicitly, implicitly, or by inference. Neither do > > those opinions reflect those of other individuals affiliated with any > > entity with which I am affiliated nor those of the entities themselves. > > > > On Thu, Aug 10, 2017 at 12:48 PM, Mueller, Daniel D. <DDMueller@west.com > > > > wrote: > > > > > We do something similar except we used an alias named oninit. Do what > you > > > want > > > with the alias and then call the real oninit. > > > > > > Dan > > > > > > -----Original Message----- > > > From: ids-bounces@iiug.org [mailto:ids-bounces@iiug.org] On Behalf Of > Art > > > Kagel > > > Sent: Thursday, August 10, 2017 1:32 PM > > > To: ids@iiug.org > > > Subject: New security check? [39678] > > > > > > Folks: > > > > > > I renamed oninit and replaced it with a script that sets the > environment > > > then > > > runs the renamed oninit binary. Wanted this to make certain that a > manual > > > restart has the correct environment settings. > > > > > > On startup using either the script or the renamed oninit the engine > > > complains > > > about the permissions on the root chunk and aborts the startup. > > > Name oninit back to itself and all is well. Permissions on the root > chunk > > > and > > > all the other chunk files are fine. > > > > > > I have done this many times in the past on earlier releases of Informix > > > with > > > no issues. Is there some new security check in v12.10? Is there are way > > > around > > > it? > > > > > > Art > > > > > > Art S. Kagel, President and Principal Consultant ASK Database > Management > > > www.askdbmgt.com > > > > > > Blog: http://informix-myview.blogspot.com/ > > > > > > Disclaimer: Please keep in mind that my own opinions are my own > opinions > > > and > > > do not reflect on the IIUG, nor any other organization with which I am > > > associated either explicitly, implicitly, or by inference. Neither do > those > > > opinions reflect those of other individuals affiliated with any entity > with > > > which I am affiliated nor those of the entities themselves. > > > > > > > > > ************************************************************ > > > ******************* > > > Forum Note: Use "Reply" to post a response in the discussion forum. > > > > > > > > > ************************************************************ > > > ******************* > > > Forum Note: Use "Reply" to post a response in the discussion forum. > > > > > > > > > > > > ************************************************************ > ******************* > > Forum Note: Use "Reply" to post a response in the discussion forum. > > >

↪ replying to david@smooth1.co.uk

Jonathan Leffler — Thu, 10 Aug 2017 19:33:24 — source: IIUG Forums & Mailing Lists

Be very cautious about making a shell script setuid. On Thu, Aug 10, 2017 at 12:15 PM, david@smooth1.co.uk <david@smooth1.co.uk> wrote: > Art, > > Solved by making the oninit script setuid root, I wonder if this is to do > oninit checking for a non-root installation? > > INVESTIGATION: > > Tested with 12.10.xC9 on "CentOS Linux release 7.3.1611 (Core)" > > Playing with strace I found that oninit does a stat of itself! > > I created my oninit script as user informix hence it did not have the same > permissons as the original oninit binary. > > Gradually matching permissions with the oninit binary I found that if you > make > the oninit script to be setuid root then the issue is resolved. > > chown root oninit > chmod o-r oninit > chmod o-x oninit > chmod u+s oninit (Solved!) > > ls -l oninit* > -rwsrwx---. 1 root informix 99 Aug 10 20:20 oninit > -rwsr-sr--. 1 root informix 25528408 Aug 9 06:38 oninit.su > > I suppose for completness we could do > > chmod g-w oninit > chmod g+s oninit > chmod o+r oninit > > ls -l oninit* > -rwsr-sr--. 1 root informix 99 Aug 10 20:20 oninit > -rwsr-sr--. 1 root informix 25528408 Aug 9 06:38 oninit.su > > Regards, > David. > > > On 10 August 2017 at 19:35 Art Kagel <art.kagel@gmail.com> wrote: > > > > > > Interesting idea Dan. Have to think if that works in all circumstances, > but > > it sounds like a winner. > > > > Art > > > > Art S. Kagel, President and Principal Consultant > > ASK Database Management > > www.askdbmgt.com > > > > Blog: http://informix-myview.blogspot.com/ > > > > Disclaimer: Please keep in mind that my own opinions are my own opinions > > and do not reflect on the IIUG, nor any other organization with which I > am > > associated either explicitly, implicitly, or by inference. Neither do > > those opinions reflect those of other individuals affiliated with any > > entity with which I am affiliated nor those of the entities themselves. > > > > On Thu, Aug 10, 2017 at 12:48 PM, Mueller, Daniel D. <DDMueller@west.com > > > > wrote: > > > > > We do something similar except we used an alias named oninit. Do what > you > > > want > > > with the alias and then call the real oninit. > > > > > > Dan > > > > > > -----Original Message----- > > > From: ids-bounces@iiug.org [mailto:ids-bounces@iiug.org] On Behalf Of > Art > > > Kagel > > > Sent: Thursday, August 10, 2017 1:32 PM > > > To: ids@iiug.org > > > Subject: New security check? [39678] > > > > > > Folks: > > > > > > I renamed oninit and replaced it with a script that sets the > environment > > > then > > > runs the renamed oninit binary. Wanted this to make certain that a > manual > > > restart has the correct environment settings. > > > > > > On startup using either the script or the renamed oninit the engine > > > complains > > > about the permissions on the root chunk and aborts the startup. > > > Name oninit back to itself and all is well. Permissions on the root > chunk > > > and > > > all the other chunk files are fine. > > > > > > I have done this many times in the past on earlier releases of Informix > > > with > > > no issues. Is there some new security check in v12.10? Is there are way > > > around > > > it? > > > > > > Art > > > > > > Art S. Kagel, President and Principal Consultant ASK Database > Management > > > www.askdbmgt.com > > > > > > Blog: http://informix-myview.blogspot.com/ > > > > > > Disclaimer: Please keep in mind that my own opinions are my own > opinions > > > and > > > do not reflect on the IIUG, nor any other organization with which I am > > > associated either explicitly, implicitly, or by inference. Neither do > those > > > opinions reflect those of other individuals affiliated with any entity > with > > > which I am affiliated nor those of the entities themselves. > > > > > > > > > ************************************************************ > > > ******************* > > > Forum Note: Use "Reply" to post a response in the discussion forum. > > > > > > > > > ************************************************************ > > > ******************* > > > Forum Note: Use "Reply" to post a response in the discussion forum. > > > > > > > > > > > > > ************************************************************ > ******************* > > Forum Note: Use "Reply" to post a response in the discussion forum. > > > > > ************************************************************ > ******************* > Forum Note: Use "Reply" to post a response in the discussion forum. > > -- Jonathan Leffler <jonathan.leffler@gmail.com> #include <disclaimer.h> Guardian of DBD::Informix - v2015.1101 - http://dbi.perl.org "Blessed are we who can laugh at ourselves, for we shall never cease to be amused."

↪ replying to Art Kagel

Paul Watson — Thu, 10 Aug 2017 19:34:24 — source: IIUG Forums & Mailing Lists

Which is amusing cos you can't do a non-root install as Informix, you must be someone other than root or Informix Not all the kinks have been removed from the non-root stuff yet Cheers Paul -----Original Message----- From: ids-bounces@iiug.org [mailto:ids-bounces@iiug.org] On Behalf Of Art Kagel Sent: Thursday, August 10, 2017 2:30 PM To: ids@iiug.org Subject: Re: New security check? [39685] David: I think you are right. The oninit sees that the file "oninit" is owned by "informix" and assumes a non-root install so only the 'owner' should have write privs on the chunks. For a root install both owsner and group informix have privs. I'll have to get a sysadmin involved for this since I can't chown the script to root as informix. Art Art S. Kagel, President and Principal Consultant ASK Database Management www.askdbmgt.com Blog: http://informix-myview.blogspot.com/ Disclaimer: Please keep in mind that my own opinions are my own opinions and do not reflect on the IIUG, nor any other organization with which I am associated either explicitly, implicitly, or by inference. Neither do those opinions reflect those of other individuals affiliated with any entity with which I am affiliated nor those of the entities themselves. On Thu, Aug 10, 2017 at 2:15 PM, <david@smooth1.co.uk> wrote: > Art, > > Solved by making the oninit script setuid root, I wonder if this is to do > oninit checking for a non-root installation? > > INVESTIGATION: > > Tested with 12.10.xC9 on "CentOS Linux release 7.3.1611 (Core)" > > Playing with strace I found that oninit does a stat of itself! > > I created my oninit script as user informix hence it did not have the same > permissons as the original oninit binary. > > Gradually matching permissions with the oninit binary I found that if you > make the oninit script to be setuid root then the issue is resolved. > > chown root oninit > chmod o-r oninit > chmod o-x oninit > chmod u+s oninit (Solved!) > > ls -l oninit* > -rwsrwx---. 1 root informix 99 Aug 10 20:20 oninit > -rwsr-sr--. 1 root informix 25528408 Aug 9 06:38 oninit.su > > I suppose for completness we could do > > chmod g-w oninit > chmod g+s oninit > chmod o+r oninit > > ls -l oninit* > -rwsr-sr--. 1 root informix 99 Aug 10 20:20 oninit > -rwsr-sr--. 1 root informix 25528408 Aug 9 06:38 oninit.su > > Regards, > David. > > > On 10 August 2017 at 19:35 Art Kagel <art.kagel@gmail.com> wrote: > > > > > > Interesting idea Dan. Have to think if that works in all circumstances, > but > > it sounds like a winner. > > > > Art > > > > Art S. Kagel, President and Principal Consultant > > ASK Database Management > > www.askdbmgt.com > > > > Blog: http://informix-myview.blogspot.com/ > > > > Disclaimer: Please keep in mind that my own opinions are my own opinions > > and do not reflect on the IIUG, nor any other organization with which I > am > > associated either explicitly, implicitly, or by inference. Neither do > > those opinions reflect those of other individuals affiliated with any > > entity with which I am affiliated nor those of the entities themselves. > > > > On Thu, Aug 10, 2017 at 12:48 PM, Mueller, Daniel D. <DDMueller@west.com > > > > wrote: > > > > > We do something similar except we used an alias named oninit. Do what > you > > > want > > > with the alias and then call the real oninit. > > > > > > Dan > > > > > > -----Original Message----- > > > From: ids-bounces@iiug.org [mailto:ids-bounces@iiug.org] On Behalf Of > Art > > > Kagel > > > Sent: Thursday, August 10, 2017 1:32 PM > > > To: ids@iiug.org > > > Subject: New security check? [39678] > > > > > > Folks: > > > > > > I renamed oninit and replaced it with a script that sets the > environment > > > then > > > runs the renamed oninit binary. Wanted this to make certain that a > manual > > > restart has the correct environment settings. > > > > > > On startup using either the script or the renamed oninit the engine > > > complains > > > about the permissions on the root chunk and aborts the startup. > > > Name oninit back to itself and all is well. Permissions on the root > chunk > > > and > > > all the other chunk files are fine. > > > > > > I have done this many times in the past on earlier releases of Informix > > > with > > > no issues. Is there some new security check in v12.10? Is there are way > > > around > > > it? > > > > > > Art > > > > > > Art S. Kagel, President and Principal Consultant ASK Database > Management > > > www.askdbmgt.com > > > > > > Blog: http://informix-myview.blogspot.com/ > > > > > > Disclaimer: Please keep in mind that my own opinions are my own > opinions > > > and > > > do not reflect on the IIUG, nor any other organization with which I am > > > associated either explicitly, implicitly, or by inference. Neither do > those > > > opinions reflect those of other individuals affiliated with any entity > with > > > which I am affiliated nor those of the entities themselves. > > > > > > > > > ************************************************************ > > > ******************* > > > Forum Note: Use "Reply" to post a response in the discussion forum. > > > > > > > > > ************************************************************ > > > ******************* > > > Forum Note: Use "Reply" to post a response in the discussion forum. > > > > > > > > > > > > ************************************************************ > ******************* > > Forum Note: Use "Reply" to post a response in the discussion forum. > > > **************************************************************************** *** Forum Note: Use "Reply" to post a response in the discussion forum.

↪ replying to Jonathan Leffler

Paul Watson — Thu, 10 Aug 2017 19:40:08 — source: IIUG Forums & Mailing Lists

Is it even portable across all OS's - thinking back to the very distance past I think at least one wouldn't allow it Cheers Paul -----Original Message----- From: ids-bounces@iiug.org [mailto:ids-bounces@iiug.org] On Behalf Of Jonathan Leffler Sent: Thursday, August 10, 2017 2:33 PM To: ids@iiug.org Subject: Re: New security check? [39686] Be very cautious about making a shell script setuid. On Thu, Aug 10, 2017 at 12:15 PM, david@smooth1.co.uk <david@smooth1.co.uk> wrote: > Art, > > Solved by making the oninit script setuid root, I wonder if this is to do > oninit checking for a non-root installation? > > INVESTIGATION: > > Tested with 12.10.xC9 on "CentOS Linux release 7.3.1611 (Core)" > > Playing with strace I found that oninit does a stat of itself! > > I created my oninit script as user informix hence it did not have the same > permissons as the original oninit binary. > > Gradually matching permissions with the oninit binary I found that if you > make > the oninit script to be setuid root then the issue is resolved. > > chown root oninit > chmod o-r oninit > chmod o-x oninit > chmod u+s oninit (Solved!) > > ls -l oninit* > -rwsrwx---. 1 root informix 99 Aug 10 20:20 oninit > -rwsr-sr--. 1 root informix 25528408 Aug 9 06:38 oninit.su > > I suppose for completness we could do > > chmod g-w oninit > chmod g+s oninit > chmod o+r oninit > > ls -l oninit* > -rwsr-sr--. 1 root informix 99 Aug 10 20:20 oninit > -rwsr-sr--. 1 root informix 25528408 Aug 9 06:38 oninit.su > > Regards, > David. > > > On 10 August 2017 at 19:35 Art Kagel <art.kagel@gmail.com> wrote: > > > > > > Interesting idea Dan. Have to think if that works in all circumstances, > but > > it sounds like a winner. > > > > Art > > > > Art S. Kagel, President and Principal Consultant > > ASK Database Management > > www.askdbmgt.com > > > > Blog: http://informix-myview.blogspot.com/ > > > > Disclaimer: Please keep in mind that my own opinions are my own opinions > > and do not reflect on the IIUG, nor any other organization with which I > am > > associated either explicitly, implicitly, or by inference. Neither do > > those opinions reflect those of other individuals affiliated with any > > entity with which I am affiliated nor those of the entities themselves. > > > > On Thu, Aug 10, 2017 at 12:48 PM, Mueller, Daniel D. <DDMueller@west.com > > > > wrote: > > > > > We do something similar except we used an alias named oninit. Do what > you > > > want > > > with the alias and then call the real oninit. > > > > > > Dan > > > > > > -----Original Message----- > > > From: ids-bounces@iiug.org [mailto:ids-bounces@iiug.org] On Behalf Of > Art > > > Kagel > > > Sent: Thursday, August 10, 2017 1:32 PM > > > To: ids@iiug.org > > > Subject: New security check? [39678] > > > > > > Folks: > > > > > > I renamed oninit and replaced it with a script that sets the > environment > > > then > > > runs the renamed oninit binary. Wanted this to make certain that a > manual > > > restart has the correct environment settings. > > > > > > On startup using either the script or the renamed oninit the engine > > > complains > > > about the permissions on the root chunk and aborts the startup. > > > Name oninit back to itself and all is well. Permissions on the root > chunk > > > and > > > all the other chunk files are fine. > > > > > > I have done this many times in the past on earlier releases of Informix > > > with > > > no issues. Is there some new security check in v12.10? Is there are way > > > around > > > it? > > > > > > Art > > > > > > Art S. Kagel, President and Principal Consultant ASK Database > Management > > > www.askdbmgt.com > > > > > > Blog: http://informix-myview.blogspot.com/ > > > > > > Disclaimer: Please keep in mind that my own opinions are my own > opinions > > > and > > > do not reflect on the IIUG, nor any other organization with which I am > > > associated either explicitly, implicitly, or by inference. Neither do > those > > > opinions reflect those of other individuals affiliated with any entity > with > > > which I am affiliated nor those of the entities themselves. > > > > > > > > > ************************************************************ > > > ******************* > > > Forum Note: Use "Reply" to post a response in the discussion forum. > > > > > > > > > ************************************************************ > > > ******************* > > > Forum Note: Use "Reply" to post a response in the discussion forum. > > > > > > > > > > > > > ************************************************************ > ******************* > > Forum Note: Use "Reply" to post a response in the discussion forum. > > > > > ************************************************************ > ******************* > Forum Note: Use "Reply" to post a response in the discussion forum. > > -- Jonathan Leffler <jonathan.leffler@gmail.com> #include <disclaimer.h> Guardian of DBD::Informix - v2015.1101 - http://dbi.perl.org "Blessed are we who can laugh at ourselves, for we shall never cease to be amused." **************************************************************************** *** Forum Note: Use "Reply" to post a response in the discussion forum.

↪ replying to Jonathan Leffler

Art Kagel — Thu, 10 Aug 2017 20:03:12 — source: IIUG Forums & Mailing Lists

I agree Jonathan. No SUID script. I am going to go with the alias route. There's an environment script that user informix runs out of its profile. Will alias oninit there to a script somewhere outside of $INFORMIXDIR so I don't have to remember to copy it after an upgrade, the script won't be suid anything and will be owned by informix. It will execute "$INFORMIXDIR/bin/oninit $*" after reexecuting the environment script to make sure that the environment is correct. That will get around the problem we are trying to solve which is someone modifying their environment after logging in and starting the engine manually (perhaps after a crash) with the wrong environment. Art Art S. Kagel, President and Principal Consultant ASK Database Management www.askdbmgt.com Blog: http://informix-myview.blogspot.com/ Disclaimer: Please keep in mind that my own opinions are my own opinions and do not reflect on the IIUG, nor any other organization with which I am associated either explicitly, implicitly, or by inference. Neither do those opinions reflect those of other individuals affiliated with any entity with which I am affiliated nor those of the entities themselves. On Thu, Aug 10, 2017 at 2:33 PM, Jonathan Leffler < jonathan.leffler@gmail.com> wrote: > Be very cautious about making a shell script setuid. > > On Thu, Aug 10, 2017 at 12:15 PM, david@smooth1.co.uk <david@smooth1.co.uk > > > wrote: > > > Art, > > > > Solved by making the oninit script setuid root, I wonder if this is to do > > oninit checking for a non-root installation? > > > > INVESTIGATION: > > > > Tested with 12.10.xC9 on "CentOS Linux release 7.3.1611 (Core)" > > > > Playing with strace I found that oninit does a stat of itself! > > > > I created my oninit script as user informix hence it did not have the > same > > permissons as the original oninit binary. > > > > Gradually matching permissions with the oninit binary I found that if you > > make > > the oninit script to be setuid root then the issue is resolved. > > > > chown root oninit > > chmod o-r oninit > > chmod o-x oninit > > chmod u+s oninit (Solved!) > > > > ls -l oninit* > > -rwsrwx---. 1 root informix 99 Aug 10 20:20 oninit > > -rwsr-sr--. 1 root informix 25528408 Aug 9 06:38 oninit.su > > > > I suppose for completness we could do > > > > chmod g-w oninit > > chmod g+s oninit > > chmod o+r oninit > > > > ls -l oninit* > > -rwsr-sr--. 1 root informix 99 Aug 10 20:20 oninit > > -rwsr-sr--. 1 root informix 25528408 Aug 9 06:38 oninit.su > > > > Regards, > > David. > > > > > On 10 August 2017 at 19:35 Art Kagel <art.kagel@gmail.com> wrote: > > > > > > > > > Interesting idea Dan. Have to think if that works in all circumstances, > > but > > > it sounds like a winner. > > > > > > Art > > > > > > Art S. Kagel, President and Principal Consultant > > > ASK Database Management > > > www.askdbmgt.com > > > > > > Blog: http://informix-myview.blogspot.com/ > > > > > > Disclaimer: Please keep in mind that my own opinions are my own > opinions > > > and do not reflect on the IIUG, nor any other organization with which I > > am > > > associated either explicitly, implicitly, or by inference. Neither do > > > those opinions reflect those of other individuals affiliated with any > > > entity with which I am affiliated nor those of the entities themselves. > > > > > > On Thu, Aug 10, 2017 at 12:48 PM, Mueller, Daniel D. < > DDMueller@west.com > > > > > > wrote: > > > > > > > We do something similar except we used an alias named oninit. Do what > > you > > > > want > > > > with the alias and then call the real oninit. > > > > > > > > Dan > > > > > > > > -----Original Message----- > > > > From: ids-bounces@iiug.org [mailto:ids-bounces@iiug.org] On Behalf > Of > > Art > > > > Kagel > > > > Sent: Thursday, August 10, 2017 1:32 PM > > > > To: ids@iiug.org > > > > Subject: New security check? [39678] > > > > > > > > Folks: > > > > > > > > I renamed oninit and replaced it with a script that sets the > > environment > > > > then > > > > runs the renamed oninit binary. Wanted this to make certain that a > > manual > > > > restart has the correct environment settings. > > > > > > > > On startup using either the script or the renamed oninit the engine > > > > complains > > > > about the permissions on the root chunk and aborts the startup. > > > > Name oninit back to itself and all is well. Permissions on the root > > chunk > > > > and > > > > all the other chunk files are fine. > > > > > > > > I have done this many times in the past on earlier releases of > Informix > > > > with > > > > no issues. Is there some new security check in v12.10? Is there are > way > > > > around > > > > it? > > > > > > > > Art > > > > > > > > Art S. Kagel, President and Principal Consultant ASK Database > > Management > > > > www.askdbmgt.com > > > > > > > > Blog: http://informix-myview.blogspot.com/ > > > > > > > > Disclaimer: Please keep in mind that my own opinions are my own > > opinions > > > > and > > > > do not reflect on the IIUG, nor any other organization with which I > am > > > > associated either explicitly, implicitly, or by inference. Neither do > > those > > > > opinions reflect those of other individuals affiliated with any > entity > > with > > > > which I am affiliated nor those of the entities themselves. > > > > > > > > > > > > ************************************************************ > > > > ******************* > > > > Forum Note: Use "Reply" to post a response in the discussion forum. > > > > > > > > > > > > ************************************************************ > > > > ******************* > > > > Forum Note: Use "Reply" to post a response in the discussion forum. > > > > > > > > > > > > > > > > > > > ************************************************************ > > ******************* > > > Forum Note: Use "Reply" to post a response in the discussion forum. > > > > > > > > > ************************************************************ > > ******************* > > Forum Note: Use "Reply" to post a response in the discussion forum. > > > > > > -- > Jonathan Leffler <jonathan.leffler@gmail.com> #include <disclaimer.h> > Guardian of DBD::Informix - v2015.1101 - http://dbi.perl.org > "Blessed are we who can laugh at ourselves, for we shall never cease to be > amused." > > > ************************************************************ > ******************* > Forum Note: Use "Reply" to post a response in the discussion forum. > >

↪ replying to Paul Watson

david@smooth1.co.uk — Thu, 10 Aug 2017 20:06:45 — source: IIUG Forums & Mailing Lists

https://unix.stackexchange.com/questions/364/allow-setuid-on-shell-scripts Warnings in here about TOCTTOU (time of check to time of use) with links to setuid shell scripts and how modern UNIX passes the file descriptor to resolve the issue. Still not a great thing to do! The article also mentions that "Linux ignores the setuid¹ bit on all interpreted executables (i.e. executables starting with a #! line). " If I change my oninit script to spawn /usr/bin/sleep we see that the setuid on the script is not honoured on the CentOS release I am using: informix 10596 3571 0 21:37 pts/0 00:00:00 /bin/bash ./oninit informix 10597 10596 0 21:37 pts/0 00:00:00 /usr/bin/sleep 300 grep "^[UG]id:" /proc/10596/status Uid: 1001 1001 1001 1001 Gid: 1001 1001 1001 1001 grep "^[UG]id:" /proc/10597/status Uid: 1001 1001 1001 1001 Gid: 1001 1001 1001 1001 Where as with the oninit binary: root 10543 1 1 21:34 ? 00:00:00 ./oninit.su grep "^[UG]id:" /proc/10543/status Uid: 1001 0 0 0 Gid: 1001 1001 1001 1001 Regards, David. > On 10 August 2017 at 20:40 Paul Watson <paul@oninit.com> wrote: > > > Is it even portable across all OS's - thinking back to the very distance > past I think at least one wouldn't allow it > > Cheers > Paul > > -----Original Message----- > From: ids-bounces@iiug.org [mailto:ids-bounces@iiug.org] On Behalf Of > Jonathan Leffler > Sent: Thursday, August 10, 2017 2:33 PM > To: ids@iiug.org > Subject: Re: New security check? [39686] > > Be very cautious about making a shell script setuid. > > On Thu, Aug 10, 2017 at 12:15 PM, david@smooth1.co.uk <david@smooth1.co.uk> > wrote: > > > Art, > > > > Solved by making the oninit script setuid root, I wonder if this is to do > > oninit checking for a non-root installation? > > > > INVESTIGATION: > > > > Tested with 12.10.xC9 on "CentOS Linux release 7.3.1611 (Core)" > > > > Playing with strace I found that oninit does a stat of itself! > > > > I created my oninit script as user informix hence it did not have the same > > > permissons as the original oninit binary. > > > > Gradually matching permissions with the oninit binary I found that if you > > make > > the oninit script to be setuid root then the issue is resolved. > > > > chown root oninit > > chmod o-r oninit > > chmod o-x oninit > > chmod u+s oninit (Solved!) > > > > ls -l oninit* > > -rwsrwx---. 1 root informix 99 Aug 10 20:20 oninit > > -rwsr-sr--. 1 root informix 25528408 Aug 9 06:38 oninit.su > > > > I suppose for completness we could do > > > > chmod g-w oninit > > chmod g+s oninit > > chmod o+r oninit > > > > ls -l oninit* > > -rwsr-sr--. 1 root informix 99 Aug 10 20:20 oninit > > -rwsr-sr--. 1 root informix 25528408 Aug 9 06:38 oninit.su > > > > Regards, > > David. > > > > > On 10 August 2017 at 19:35 Art Kagel <art.kagel@gmail.com> wrote: > > > > > > > > > Interesting idea Dan. Have to think if that works in all circumstances, > > but > > > it sounds like a winner. > > > > > > Art > > > > > > Art S. Kagel, President and Principal Consultant > > > ASK Database Management > > > www.askdbmgt.com > > > > > > Blog: http://informix-myview.blogspot.com/ > > > > > > Disclaimer: Please keep in mind that my own opinions are my own opinions > > > > and do not reflect on the IIUG, nor any other organization with which I > > am > > > associated either explicitly, implicitly, or by inference. Neither do > > > those opinions reflect those of other individuals affiliated with any > > > entity with which I am affiliated nor those of the entities themselves. > > > > > > On Thu, Aug 10, 2017 at 12:48 PM, Mueller, Daniel D. <DDMueller@west.com > > > > > > > wrote: > > > > > > > We do something similar except we used an alias named oninit. Do what > > you > > > > want > > > > with the alias and then call the real oninit. > > > > > > > > Dan > > > > > > > > -----Original Message----- > > > > From: ids-bounces@iiug.org [mailto:ids-bounces@iiug.org] On Behalf Of > > Art > > > > Kagel > > > > Sent: Thursday, August 10, 2017 1:32 PM > > > > To: ids@iiug.org > > > > Subject: New security check? [39678] > > > > > > > > Folks: > > > > > > > > I renamed oninit and replaced it with a script that sets the > > environment > > > > then > > > > runs the renamed oninit binary. Wanted this to make certain that a > > manual > > > > restart has the correct environment settings. > > > > > > > > On startup using either the script or the renamed oninit the engine > > > > complains > > > > about the permissions on the root chunk and aborts the startup. > > > > Name oninit back to itself and all is well. Permissions on the root > > chunk > > > > and > > > > all the other chunk files are fine. > > > > > > > > I have done this many times in the past on earlier releases of > Informix > > > > with > > > > no issues. Is there some new security check in v12.10? Is there are > way > > > > around > > > > it? > > > > > > > > Art > > > > > > > > Art S. Kagel, President and Principal Consultant ASK Database > > Management > > > > www.askdbmgt.com > > > > > > > > Blog: http://informix-myview.blogspot.com/ > > > > > > > > Disclaimer: Please keep in mind that my own opinions are my own > > opinions > > > > and > > > > do not reflect on the IIUG, nor any other organization with which I am > > > > > associated either explicitly, implicitly, or by inference. Neither do > > those > > > > opinions reflect those of other individuals affiliated with any entity > > > with > > > > which I am affiliated nor those of the entities themselves. > > > > > > > > > > > > ************************************************************ > > > > ******************* > > > > Forum Note: Use "Reply" to post a response in the discussion forum. > > > > > > > > > > > > ************************************************************ > > > > ******************* > > > > Forum Note: Use "Reply" to post a response in the discussion forum. > > > > > > > > > > > > > > > > > > > ************************************************************ > > ******************* > > > Forum Note: Use "Reply" to post a response in the discussion forum. > > > > > > > > > ************************************************************ > > ******************* > > Forum Note: Use "Reply" to post a response in the discussion forum. > > > > > > -- > Jonathan Leffler <jonathan.leffler@gmail.com> #include <disclaimer.h> > Guardian of DBD::Informix - v2015.1101 - http://dbi.perl.org > "Blessed are we who can laugh at ourselves, for we shall never cease to be > amused." > > **************************************************************************** > *** > Forum Note: Use "Reply" to post a response in the discussion forum. > > > ******************

↪ replying to Art Kagel

Paul Watson — Thu, 10 Aug 2017 20:31:12 — source: IIUG Forums & Mailing Lists

FYI my got to page for what gets run by scripts and in what order http://blog.flowblok.id.au/2013-02/shell-startup-scripts.html Cheers Paul -----Original Message----- From: ids-bounces@iiug.org [mailto:ids-bounces@iiug.org] On Behalf Of Art Kagel Sent: Thursday, August 10, 2017 3:03 PM To: ids@iiug.org Subject: Re: New security check? [39689] I agree Jonathan. No SUID script. I am going to go with the alias route. There's an environment script that user informix runs out of its profile. Will alias oninit there to a script somewhere outside of $INFORMIXDIR so I don't have to remember to copy it after an upgrade, the script won't be suid anything and will be owned by informix. It will execute "$INFORMIXDIR/bin/oninit $*" after reexecuting the environment script to make sure that the environment is correct. That will get around the problem we are trying to solve which is someone modifying their environment after logging in and starting the engine manually (perhaps after a crash) with the wrong environment. Art Art S. Kagel, President and Principal Consultant ASK Database Management www.askdbmgt.com Blog: http://informix-myview.blogspot.com/ Disclaimer: Please keep in mind that my own opinions are my own opinions and do not reflect on the IIUG, nor any other organization with which I am associated either explicitly, implicitly, or by inference. Neither do those opinions reflect those of other individuals affiliated with any entity with which I am affiliated nor those of the entities themselves. On Thu, Aug 10, 2017 at 2:33 PM, Jonathan Leffler < jonathan.leffler@gmail.com> wrote: > Be very cautious about making a shell script setuid. > > On Thu, Aug 10, 2017 at 12:15 PM, david@smooth1.co.uk <david@smooth1.co.uk > > > wrote: > > > Art, > > > > Solved by making the oninit script setuid root, I wonder if this is to do > > oninit checking for a non-root installation? > > > > INVESTIGATION: > > > > Tested with 12.10.xC9 on "CentOS Linux release 7.3.1611 (Core)" > > > > Playing with strace I found that oninit does a stat of itself! > > > > I created my oninit script as user informix hence it did not have the > same > > permissons as the original oninit binary. > > > > Gradually matching permissions with the oninit binary I found that if you > > make > > the oninit script to be setuid root then the issue is resolved. > > > > chown root oninit > > chmod o-r oninit > > chmod o-x oninit > > chmod u+s oninit (Solved!) > > > > ls -l oninit* > > -rwsrwx---. 1 root informix 99 Aug 10 20:20 oninit > > -rwsr-sr--. 1 root informix 25528408 Aug 9 06:38 oninit.su > > > > I suppose for completness we could do > > > > chmod g-w oninit > > chmod g+s oninit > > chmod o+r oninit > > > > ls -l oninit* > > -rwsr-sr--. 1 root informix 99 Aug 10 20:20 oninit > > -rwsr-sr--. 1 root informix 25528408 Aug 9 06:38 oninit.su > > > > Regards, > > David. > > > > > On 10 August 2017 at 19:35 Art Kagel <art.kagel@gmail.com> wrote: > > > > > > > > > Interesting idea Dan. Have to think if that works in all circumstances, > > but > > > it sounds like a winner. > > > > > > Art > > > > > > Art S. Kagel, President and Principal Consultant > > > ASK Database Management > > > www.askdbmgt.com > > > > > > Blog: http://informix-myview.blogspot.com/ > > > > > > Disclaimer: Please keep in mind that my own opinions are my own > opinions > > > and do not reflect on the IIUG, nor any other organization with which I > > am > > > associated either explicitly, implicitly, or by inference. Neither do > > > those opinions reflect those of other individuals affiliated with any > > > entity with which I am affiliated nor those of the entities themselves. > > > > > > On Thu, Aug 10, 2017 at 12:48 PM, Mueller, Daniel D. < > DDMueller@west.com > > > > > > wrote: > > > > > > > We do something similar except we used an alias named oninit. Do what > > you > > > > want > > > > with the alias and then call the real oninit. > > > > > > > > Dan > > > > > > > > -----Original Message----- > > > > From: ids-bounces@iiug.org [mailto:ids-bounces@iiug.org] On Behalf > Of > > Art > > > > Kagel > > > > Sent: Thursday, August 10, 2017 1:32 PM > > > > To: ids@iiug.org > > > > Subject: New security check? [39678] > > > > > > > > Folks: > > > > > > > > I renamed oninit and replaced it with a script that sets the > > environment > > > > then > > > > runs the renamed oninit binary. Wanted this to make certain that a > > manual > > > > restart has the correct environment settings. > > > > > > > > On startup using either the script or the renamed oninit the engine > > > > complains > > > > about the permissions on the root chunk and aborts the startup. > > > > Name oninit back to itself and all is well. Permissions on the root > > chunk > > > > and > > > > all the other chunk files are fine. > > > > > > > > I have done this many times in the past on earlier releases of > Informix > > > > with > > > > no issues. Is there some new security check in v12.10? Is there are > way > > > > around > > > > it? > > > > > > > > Art > > > > > > > > Art S. Kagel, President and Principal Consultant ASK Database > > Management > > > > www.askdbmgt.com > > > > > > > > Blog: http://informix-myview.blogspot.com/ > > > > > > > > Disclaimer: Please keep in mind that my own opinions are my own > > opinions > > > > and > > > > do not reflect on the IIUG, nor any other organization with which I > am > > > > associated either explicitly, implicitly, or by inference. Neither do > > those > > > > opinions reflect those of other individuals affiliated with any > entity > > with > > > > which I am affiliated nor those of the entities themselves. > > > > > > > > > > > > ************************************************************ > > > > ******************* > > > > Forum Note: Use "Reply" to post a response in the discussion forum. > > > > > > > > > > > > ************************************************************ > > > > ******************* > > > > Forum Note: Use "Reply" to post a response in the discussion forum. > > > > > > > > > > > > > > > > > > > ************************************************************ > > ******************* > > > Forum Note: Use "Reply" to post a response in the discussion forum. > > > > > > > > > ************************************************************ > > ******************* > > Forum Note: Use "Reply" to post a response in the discussion forum. > > > > > > -- > Jonathan Leffler <jonathan.leffler@gmail.com> #include <disclaimer.h> > Guardian of DBD::Informix - v2015.1101 - http://dbi.perl.org > "Blessed are we who can laugh at ourselves, for we shall never cease to be > amused." > > > ************************************************************ > *******************@@

↪ replying to Art Kagel

david@smooth1.co.uk — Thu, 10 Aug 2017 20:48:21 — source: IIUG Forums & Mailing Lists

..and all because the oninit binary checks $INFORMIXDIR/bin/oninit rather than being non-portable and doing something like checking argv[0] or /proc/<pid>/exe on Linux! Jonathan, clearly a bug needs to be logged ;->> Regards, David. > On 10 August 2017 at 21:03 Art Kagel <art.kagel@gmail.com> wrote: > > > I agree Jonathan. No SUID script. I am going to go with the alias route. > There's an environment script that user informix runs out of its profile. > Will alias oninit there to a script somewhere outside of $INFORMIXDIR so I > don't have to remember to copy it after an upgrade, the script won't be > suid anything and will be owned by informix. It will execute > "$INFORMIXDIR/bin/oninit $*" after reexecuting the environment script to > make sure that the environment is correct. That will get around the problem > we are trying to solve which is someone modifying their environment after > logging in and starting the engine manually (perhaps after a crash) with > the wrong environment. > > Art > > Art S. Kagel, President and Principal Consultant > ASK Database Management > www.askdbmgt.com > > Blog: http://informix-myview.blogspot.com/ > > Disclaimer: Please keep in mind that my own opinions are my own opinions > and do not reflect on the IIUG, nor any other organization with which I am > associated either explicitly, implicitly, or by inference. Neither do > those opinions reflect those of other individuals affiliated with any > entity with which I am affiliated nor those of the entities themselves. > > On Thu, Aug 10, 2017 at 2:33 PM, Jonathan Leffler < > jonathan.leffler@gmail.com> wrote: > > > Be very cautious about making a shell script setuid. > > > > On Thu, Aug 10, 2017 at 12:15 PM, david@smooth1.co.uk <david@smooth1.co.uk > > > > > wrote: > > > > > Art, > > > > > > Solved by making the oninit script setuid root, I wonder if this is to do > > > oninit checking for a non-root installation? > > > > > > INVESTIGATION: > > > > > > Tested with 12.10.xC9 on "CentOS Linux release 7.3.1611 (Core)" > > > > > > Playing with strace I found that oninit does a stat of itself! > > > > > > I created my oninit script as user informix hence it did not have the > > same > > > permissons as the original oninit binary. > > > > > > Gradually matching permissions with the oninit binary I found that if you > > > make > > > the oninit script to be setuid root then the issue is resolved. > > > > > > chown root oninit > > > chmod o-r oninit > > > chmod o-x oninit > > > chmod u+s oninit (Solved!) > > > > > > ls -l oninit* > > > -rwsrwx---. 1 root informix 99 Aug 10 20:20 oninit > > > -rwsr-sr--. 1 root informix 25528408 Aug 9 06:38 oninit.su > > > > > > I suppose for completness we could do > > > > > > chmod g-w oninit > > > chmod g+s oninit > > > chmod o+r oninit > > > > > > ls -l oninit* > > > -rwsr-sr--. 1 root informix 99 Aug 10 20:20 oninit > > > -rwsr-sr--. 1 root informix 25528408 Aug 9 06:38 oninit.su > > > > > > Regards, > > > David. > > > > > > > On 10 August 2017 at 19:35 Art Kagel <art.kagel@gmail.com> wrote: > > > > > > > > > > > > Interesting idea Dan. Have to think if that works in all circumstances, > > > but > > > > it sounds like a winner. > > > > > > > > Art > > > > > > > > Art S. Kagel, President and Principal Consultant > > > > ASK Database Management > > > > www.askdbmgt.com > > > > > > > > Blog: http://informix-myview.blogspot.com/ > > > > > > > > Disclaimer: Please keep in mind that my own opinions are my own > > opinions > > > > and do not reflect on the IIUG, nor any other organization with which I > > > am > > > > associated either explicitly, implicitly, or by inference. Neither do > > > > those opinions reflect those of other individuals affiliated with any > > > > entity with which I am affiliated nor those of the entities themselves. > > > > > > > > On Thu, Aug 10, 2017 at 12:48 PM, Mueller, Daniel D. < > > DDMueller@west.com > > > > > > > > wrote: > > > > > > > > > We do something similar except we used an alias named oninit. Do what > > > you > > > > > want > > > > > with the alias and then call the real oninit. > > > > > > > > > > Dan > > > > > > > > > > -----Original Message----- > > > > > From: ids-bounces@iiug.org [mailto:ids-bounces@iiug.org] On Behalf > > Of > > > Art > > > > > Kagel > > > > > Sent: Thursday, August 10, 2017 1:32 PM > > > > > To: ids@iiug.org > > > > > Subject: New security check? [39678] > > > > > > > > > > Folks: > > > > > > > > > > I renamed oninit and replaced it with a script that sets the > > > environment > > > > > then > > > > > runs the renamed oninit binary. Wanted this to make certain that a > > > manual > > > > > restart has the correct environment settings. > > > > > > > > > > On startup using either the script or the renamed oninit the engine > > > > > complains > > > > > about the permissions on the root chunk and aborts the startup. > > > > > Name oninit back to itself and all is well. Permissions on the root > > > chunk > > > > > and > > > > > all the other chunk files are fine. > > > > > > > > > > I have done this many times in the past on earlier releases of > > Informix > > > > > with > > > > > no issues. Is there some new security check in v12.10? Is there are > > way > > > > > around > > > > > it? > > > > > > > > > > Art > > > > > > > > > > Art S. Kagel, President and Principal Consultant ASK Database > > > Management > > > > > www.askdbmgt.com > > > > > > > > > > Blog: http://informix-myview.blogspot.com/ > > > > > > > > > > Disclaimer: Please keep in mind that my own opinions are my own > > > opinions > > > > > and > > > > > do not reflect on the IIUG, nor any other organization with which I > > am > > > > > associated either explicitly, implicitly, or by inference. Neither do > > > those > > > > > opinions reflect those of other individuals affiliated with any > > entity > > > with > > > > > which I am affiliated nor those of the entities themselves. > > > > > > > > > > > > > > > ************************************************************ > > > > > ******************* > > > > > Forum Note: Use "Reply" to post a response in the discussion forum. > > > > > > > > > > > > > > > ************************************************************ > > > > > ******************* > > > > > Forum Note: Use "Reply" to post a response in the discussion forum. > > > > > > > > > > > > > > > > > > > > > > > > > ************************************************************ > > > ******************* > > > > Forum Note: Use "Reply" to post a response in the discussion forum. > > > > > > > > > > > > > ************************************************************ > > > ******************* > > > Forum Note: Use "Reply" to post a response in the discussion forum. > > > > > > > > > > -- > > Jonathan Leffler <jonathan.leffler@gmail.com> #include <disclaimer.h> >

↪ replying to Paul Watson

Clive Eisen — Fri, 11 Aug 2017 07:40:46 — source: IIUG Forums & Mailing Lists

On linux it is simply ignored Clive > On 10 Aug 2017, at 20:40, Paul Watson <paul@oninit.com> wrote: > > Is it even portable across all OS's - thinking back to the very distance > past I think at least one wouldn't allow it > > Cheers > Paul

↪ replying to Art Kagel

Fernando Nunes — Fri, 11 Aug 2017 09:44:41 — source: IIUG Forums & Mailing Lists

Out of curiosity.... What are you trying to prevent? Something happened before? What would a DBSA change that could hurt the engine startup?... Considering a DBSA must know what he's doing.... I usually have a script that allows choosing among the machine instances and that's it... no one customizes the environment apart things that are "personal". One thing you can consider is the use of -FILE but again if someone doesn't use it... Regards. On Thu, Aug 10, 2017 at 9:03 PM, Art Kagel <art.kagel@gmail.com> wrote: > I agree Jonathan. No SUID script. I am going to go with the alias route. > There's an environment script that user informix runs out of its profile. > Will alias oninit there to a script somewhere outside of $INFORMIXDIR so I > don't have to remember to copy it after an upgrade, the script won't be > suid anything and will be owned by informix. It will execute > "$INFORMIXDIR/bin/oninit $*" after reexecuting the environment script to > make sure that the environment is correct. That will get around the problem > we are trying to solve which is someone modifying their environment after > logging in and starting the engine manually (perhaps after a crash) with > the wrong environment. > > Art > > Art S. Kagel, President and Principal Consultant > ASK Database Management > www.askdbmgt.com > > Blog: http://informix-myview.blogspot.com/ > > Disclaimer: Please keep in mind that my own opinions are my own opinions > and do not reflect on the IIUG, nor any other organization with which I am > associated either explicitly, implicitly, or by inference. Neither do > those opinions reflect those of other individuals affiliated with any > entity with which I am affiliated nor those of the entities themselves. > > On Thu, Aug 10, 2017 at 2:33 PM, Jonathan Leffler < > jonathan.leffler@gmail.com> wrote: > > > Be very cautious about making a shell script setuid. > > > > On Thu, Aug 10, 2017 at 12:15 PM, david@smooth1.co.uk < > david@smooth1.co.uk > > > > > wrote: > > > > > Art, > > > > > > Solved by making the oninit script setuid root, I wonder if this is to > do > > > oninit checking for a non-root installation? > > > > > > INVESTIGATION: > > > > > > Tested with 12.10.xC9 on "CentOS Linux release 7.3.1611 (Core)" > > > > > > Playing with strace I found that oninit does a stat of itself! > > > > > > I created my oninit script as user informix hence it did not have the > > same > > > permissons as the original oninit binary. > > > > > > Gradually matching permissions with the oninit binary I found that if > you > > > make > > > the oninit script to be setuid root then the issue is resolved. > > > > > > chown root oninit > > > chmod o-r oninit > > > chmod o-x oninit > > > chmod u+s oninit (Solved!) > > > > > > ls -l oninit* > > > -rwsrwx---. 1 root informix 99 Aug 10 20:20 oninit > > > -rwsr-sr--. 1 root informix 25528408 Aug 9 06:38 oninit.su > > > > > > I suppose for completness we could do > > > > > > chmod g-w oninit > > > chmod g+s oninit > > > chmod o+r oninit > > > > > > ls -l oninit* > > > -rwsr-sr--. 1 root informix 99 Aug 10 20:20 oninit > > > -rwsr-sr--. 1 root informix 25528408 Aug 9 06:38 oninit.su > > > > > > Regards, > > > David. > > > > > > > On 10 August 2017 at 19:35 Art Kagel <art.kagel@gmail.com> wrote: > > > > > > > > > > > > Interesting idea Dan. Have to think if that works in all > circumstances, > > > but > > > > it sounds like a winner. > > > > > > > > Art > > > > > > > > Art S. Kagel, President and Principal Consultant > > > > ASK Database Management > > > > www.askdbmgt.com > > > > > > > > Blog: http://informix-myview.blogspot.com/ > > > > > > > > Disclaimer: Please keep in mind that my own opinions are my own > > opinions > > > > and do not reflect on the IIUG, nor any other organization with > which I > > > am > > > > associated either explicitly, implicitly, or by inference. Neither do > > > > those opinions reflect those of other individuals affiliated with any > > > > entity with which I am affiliated nor those of the entities > themselves. > > > > > > > > On Thu, Aug 10, 2017 at 12:48 PM, Mueller, Daniel D. < > > DDMueller@west.com > > > > > > > > wrote: > > > > > > > > > We do something similar except we used an alias named oninit. Do > what > > > you > > > > > want > > > > > with the alias and then call the real oninit. > > > > > > > > > > Dan > > > > > > > > > > -----Original Message----- > > > > > From: ids-bounces@iiug.org [mailto:ids-bounces@iiug.org] On Behalf > > Of > > > Art > > > > > Kagel > > > > > Sent: Thursday, August 10, 2017 1:32 PM > > > > > To: ids@iiug.org > > > > > Subject: New security check? [39678] > > > > > > > > > > Folks: > > > > > > > > > > I renamed oninit and replaced it with a script that sets the > > > environment > > > > > then > > > > > runs the renamed oninit binary. Wanted this to make certain that a > > > manual > > > > > restart has the correct environment settings. > > > > > > > > > > On startup using either the script or the renamed oninit the engine > > > > > complains > > > > > about the permissions on the root chunk and aborts the startup. > > > > > Name oninit back to itself and all is well. Permissions on the root > > > chunk > > > > > and > > > > > all the other chunk files are fine. > > > > > > > > > > I have done this many times in the past on earlier releases of > > Informix > > > > > with > > > > > no issues. Is there some new security check in v12.10? Is there are > > way > > > > > around > > > > > it? > > > > > > > > > > Art > > > > > > > > > > Art S. Kagel, President and Principal Consultant ASK Database > > > Management > > > > > www.askdbmgt.com > > > > > > > > > > Blog: http://informix-myview.blogspot.com/ > > > > > > > > > > Disclaimer: Please keep in mind that my own opinions are my own > > > opinions > > > > > and > > > > > do not reflect on the IIUG, nor any other organization with which I > > am > > > > > associated either explicitly, implicitly, or by inference. Neither > do > > > those > > > > > opinions reflect those of other individuals affiliated with any > > entity > > > with > > > > > which I am affiliated nor those of the entities themselves. > > > > > > > > > > > > > > > ************************************************************ > > > > > ******************* > > > > > Forum Note: Use "Reply" to post a response in the discussion forum. > > > > > > > > > > > > > > > ************************************************************ > > > > > ******************* > > > > > Forum Note: Use "Reply" to post a response in the discussion forum. > > > > > > > > > > > > > > > > > > > > > > > > > ************************************************************ > > > ******************* > > > > Forum Note: Use "Reply" to post a response in the discussion forum. > > > > > > > > > > > > > *************

↪ replying to Fernando Nunes

Art Kagel — Fri, 11 Aug 2017 11:31:57 — source: IIUG Forums & Mailing Lists

Fernando: Indeed the DBA could change something personal that can affect the engine. I'm trying to prevent a real actual problem caused by someone (OK me) changing the TZ timezone in his personal environment. At all of my clients I have an environment file that mostly sets some personal aliases that I have become used to using, like "dir" for "ls -laF", emacs shell edit mode instead of vi mode, etc. I run this script manually when I am logged into a client's servers so only I have this environment. At this one site which is in US Central Time they run their servers on US Eastern time for historical reasons and applications depend on that timezone. A couple of years ago the timezone difference must have annoyed me and I set TZ to Central Time in my environment file. Recently we had to bounce their production engine to fix a problem (open PMR). I bounced it manually using my environment. So, for several hours until we realized the problem and bounced it again, taking another 5 minute downtime, the server was running with the "wrong" timezone which caused application problems. This is what I am trying to avoid. So, there is now an oninit.sh script that sets the environment exactly to the desired one and calls the actual oninit with a full path ($INFORMIXDIR/bin/oninit). The "informix" environment has an alias for "oninit" that calls oninit.sh. The oninit.sh is placed in a bin directory outside of INFORMIXDIR so it is independent of version upgrades. My thanks to Daniel and everyone else on this discussion thread for helping me get to a workable solution. Art Art S. Kagel, President and Principal Consultant ASK Database Management www.askdbmgt.com Blog: http://informix-myview.blogspot.com/ Disclaimer: Please keep in mind that my own opinions are my own opinions and do not reflect on the IIUG, nor any other organization with which I am associated either explicitly, implicitly, or by inference. Neither do those opinions reflect those of other individuals affiliated with any entity with which I am affiliated nor those of the entities themselves. On Fri, Aug 11, 2017 at 4:44 AM, Fernando Nunes <domusonline@gmail.com> wrote: > Out of curiosity.... What are you trying to prevent? Something happened > before? > What would a DBSA change that could hurt the engine startup?... Considering > a DBSA must know what he's doing.... > I usually have a script that allows choosing among the machine instances > and that's it... no one customizes the environment apart things that are > "personal". > > One thing you can consider is the use of -FILE but again if someone doesn't > use it... > > Regards. > > On Thu, Aug 10, 2017 at 9:03 PM, Art Kagel <art.kagel@gmail.com> wrote: > > > I agree Jonathan. No SUID script. I am going to go with the alias route. > > There's an environment script that user informix runs out of its profile. > > Will alias oninit there to a script somewhere outside of $INFORMIXDIR so > I > > don't have to remember to copy it after an upgrade, the script won't be > > suid anything and will be owned by informix. It will execute > > "$INFORMIXDIR/bin/oninit $*" after reexecuting the environment script to > > make sure that the environment is correct. That will get around the > problem > > we are trying to solve which is someone modifying their environment after > > logging in and starting the engine manually (perhaps after a crash) with > > the wrong environment. > > > > Art > > > > Art S. Kagel, President and Principal Consultant > > ASK Database Management > > www.askdbmgt.com > > > > Blog: http://informix-myview.blogspot.com/ > > > > Disclaimer: Please keep in mind that my own opinions are my own opinions > > and do not reflect on the IIUG, nor any other organization with which I > am > > associated either explicitly, implicitly, or by inference. Neither do > > those opinions reflect those of other individuals affiliated with any > > entity with which I am affiliated nor those of the entities themselves. > > > > On Thu, Aug 10, 2017 at 2:33 PM, Jonathan Leffler < > > jonathan.leffler@gmail.com> wrote: > > > > > Be very cautious about making a shell script setuid. > > > > > > On Thu, Aug 10, 2017 at 12:15 PM, david@smooth1.co.uk < > > david@smooth1.co.uk > > > > > > > wrote: > > > > > > > Art, > > > > > > > > Solved by making the oninit script setuid root, I wonder if this is > to > > do > > > > oninit checking for a non-root installation? > > > > > > > > INVESTIGATION: > > > > > > > > Tested with 12.10.xC9 on "CentOS Linux release 7.3.1611 (Core)" > > > > > > > > Playing with strace I found that oninit does a stat of itself! > > > > > > > > I created my oninit script as user informix hence it did not have the > > > same > > > > permissons as the original oninit binary. > > > > > > > > Gradually matching permissions with the oninit binary I found that if > > you > > > > make > > > > the oninit script to be setuid root then the issue is resolved. > > > > > > > > chown root oninit > > > > chmod o-r oninit > > > > chmod o-x oninit > > > > chmod u+s oninit (Solved!) > > > > > > > > ls -l oninit* > > > > -rwsrwx---. 1 root informix 99 Aug 10 20:20 oninit > > > > -rwsr-sr--. 1 root informix 25528408 Aug 9 06:38 oninit.su > > > > > > > > I suppose for completness we could do > > > > > > > > chmod g-w oninit > > > > chmod g+s oninit > > > > chmod o+r oninit > > > > > > > > ls -l oninit* > > > > -rwsr-sr--. 1 root informix 99 Aug 10 20:20 oninit > > > > -rwsr-sr--. 1 root informix 25528408 Aug 9 06:38 oninit.su > > > > > > > > Regards, > > > > David. > > > > > > > > > On 10 August 2017 at 19:35 Art Kagel <art.kagel@gmail.com> wrote: > > > > > > > > > > > > > > > Interesting idea Dan. Have to think if that works in all > > circumstances, > > > > but > > > > > it sounds like a winner. > > > > > > > > > > Art > > > > > > > > > > Art S. Kagel, President and Principal Consultant > > > > > ASK Database Management > > > > > www.askdbmgt.com > > > > > > > > > > Blog: http://informix-myview.blogspot.com/ > > > > > > > > > > Disclaimer: Please keep in mind that my own opinions are my own > > > opinions > > > > > and do not reflect on the IIUG, nor any other organization with > > which I > > > > am > > > > > associated either explicitly, implicitly, or by inference. Neither > do > > > > > those opinions reflect those of other individuals affiliated with > any > > > > > entity with which I am affiliated nor those of the entities > > themselves. > > > > > > > > > > On Thu, Aug 10, 2017 at 12:48 PM, Mueller, Daniel D. < > > > DDMueller@west.com > > > > > > > > > > wrote: > > > > > > > > > > > We do something similar except we used an alias named oninit. Do > > what > > > > you > > > > > > want > > > > > > with the alias and then call the real oninit. > > > > > > > > > > > > Dan > > > > > > > > > > > > -----Original Message----- > > > > > > From: ids-bounces@iiug.org [mailto:ids-bou

↪ replying to Art Kagel

Paul Watson — Fri, 11 Aug 2017 12:02:18 — source: IIUG Forums & Mailing Lists

In the case of TZ could you not just have a startup task that could test for the correct env and then go from there ? Cheers Paul Paul Watson Oninit www.oninit.com +1 913 387 7529 Oninit® is a Registered Trademark of Oninit LLC > On Aug 11, 2017, at 06:31, Art Kagel <art.kagel@gmail.com> wrote: > > Fernando: > > Indeed the DBA could change something personal that can affect the engine. > I'm trying to prevent a real actual problem caused by someone (OK me) > changing the TZ timezone in his personal environment. > > At all of my clients I have an environment file that mostly sets some > personal aliases that I have become used to using, like "dir" for "ls > -laF", emacs shell edit mode instead of vi mode, etc. I run this script > manually when I am logged into a client's servers so only I have this > environment. At this one site which is in US Central Time they run their > servers on US Eastern time for historical reasons and applications depend > on that timezone. A couple of years ago the timezone difference must have > annoyed me and I set TZ to Central Time in my environment file. Recently we > had to bounce their production engine to fix a problem (open PMR). I > bounced it manually using my environment. So, for several hours until we > realized the problem and bounced it again, taking another 5 minute > downtime, the server was running with the "wrong" timezone which caused > application problems. This is what I am trying to avoid. > > So, there is now an oninit.sh script that sets the environment exactly to > the desired one and calls the actual oninit with a full path > ($INFORMIXDIR/bin/oninit). The "informix" environment has an alias for > "oninit" that calls oninit.sh. The oninit.sh is placed in a bin directory > outside of INFORMIXDIR so it is independent of version upgrades. > > My thanks to Daniel and everyone else on this discussion thread for helping > me get to a workable solution. > > Art > > Art S. Kagel, President and Principal Consultant > ASK Database Management > www.askdbmgt.com > > Blog: http://informix-myview.blogspot.com/ > > Disclaimer: Please keep in mind that my own opinions are my own opinions > and do not reflect on the IIUG, nor any other organization with which I am > associated either explicitly, implicitly, or by inference. Neither do

↪ replying to Paul Watson

Art Kagel — Fri, 11 Aug 2017 12:30:52 — source: IIUG Forums & Mailing Lists

Paul: Yes, but that doesn't prevent a DBA from running oninit directly and bypassing the startup script. "The problem with making things foolproof is that fools are so devious!" Including this old fool. Art Art S. Kagel, President and Principal Consultant ASK Database Management www.askdbmgt.com Blog: http://informix-myview.blogspot.com/ Disclaimer: Please keep in mind that my own opinions are my own opinions and do not reflect on the IIUG, nor any other organization with which I am associated either explicitly, implicitly, or by inference. Neither do those opinions reflect those of other individuals affiliated with any entity with which I am affiliated nor those of the entities themselves. On Fri, Aug 11, 2017 at 7:02 AM, Paul Watson <paul@oninit.com> wrote: > In the case of TZ could you not just have a startup task that could test > for > the correct env and then go from there ? > > Cheers > Paul > > Paul Watson > Oninit www.oninit.com > +1 913 387 7529 > > OninitÂ® is a Registered Trademark of Oninit LLC > > > On Aug 11, 2017, at 06:31, Art Kagel <art.kagel@gmail.com> wrote: > > > > Fernando: > > > > Indeed the DBA could change something personal that can affect the > engine. > > I'm trying to prevent a real actual problem caused by someone (OK me) > > changing the TZ timezone in his personal environment. > > > > At all of my clients I have an environment file that mostly sets some > > personal aliases that I have become used to using, like "dir" for "ls > > -laF", emacs shell edit mode instead of vi mode, etc. I run this script > > manually when I am logged into a client's servers so only I have this > > environment. At this one site which is in US Central Time they run their > > servers on US Eastern time for historical reasons and applications depend > > on that timezone. A couple of years ago the timezone difference must have > > annoyed me and I set TZ to Central Time in my environment file. Recently > we > > had to bounce their production engine to fix a problem (open PMR). I > > bounced it manually using my environment. So, for several hours until we > > realized the problem and bounced it again, taking another 5 minute > > downtime, the server was running with the "wrong" timezone which caused > > application problems. This is what I am trying to avoid. > > > > So, there is now an oninit.sh script that sets the environment exactly to > > the desired one and calls the actual oninit with a full path > > ($INFORMIXDIR/bin/oninit). The "informix" environment has an alias for > > "oninit" that calls oninit.sh. The oninit.sh is placed in a bin directory > > outside of INFORMIXDIR so it is independent of version upgrades. > > > > My thanks to Daniel and everyone else on this discussion thread for > helping > > me get to a workable solution. > > > > Art > > > > Art S. Kagel, President and Principal Consultant > > ASK Database Management > > www.askdbmgt.com > > > > Blog: http://informix-myview.blogspot.com/ > > > > Disclaimer: Please keep in mind that my own opinions are my own opinions > > and do not reflect on the IIUG, nor any other organization with which I > am > > associated either explicitly, implicitly, or by inference. Neither do > > > ************************************************************ > ******************* > Forum Note: Use "Reply" to post a response in the discussion forum. > >

↪ replying to Art Kagel

Paul Watson — Fri, 11 Aug 2017 12:53:52 — source: IIUG Forums & Mailing Lists

Nothing can prevent the wrong env if the DBA wants it wrong :-) Paul Watson Oninit www.oninit.com +1 913 387 7529 Oninit® is a Registered Trademark of Oninit LLC > On Aug 11, 2017, at 07:30, Art Kagel <art.kagel@gmail.com> wrote: > > Paul: > > Yes, but that doesn't prevent a DBA from running oninit directly and > bypassing the startup script. "The problem with making things foolproof is > that fools are so devious!" Including this old fool. > > Art > > Art S. Kagel, President and Principal Consultant > ASK Database Management > www.askdbmgt.com > > Blog: http://informix-myview.blogspot.com/ > > Disclaimer: Please keep in mind that my own opinions are my own opinions > and do not reflect on the IIUG, nor any other organization with which I am > associated either explicitly, implicitly, or by inference. Neither do > those opinions reflect those of other individuals affiliated with any > entity with which I am affiliated nor those of the entities themselves. > >> On Fri, Aug 11, 2017 at 7:02 AM, Paul Watson <paul@oninit.com> wrote: >> >> In the case of TZ could you not just have a startup task that could test >> for >> the correct env and then go from there ? >> >> Cheers >> Paul >> >> Paul Watson >> Oninit www.oninit.com >> +1 913 387 7529 >> >> Oninit® is a Registered Trademark of Oninit LLC >> >>> On Aug 11, 2017, at 06:31, Art Kagel <art.kagel@gmail.com> wrote: >>> >>> Fernando: >>> >>> Indeed the DBA could change something personal that can affect the >> engine. >>> I'm trying to prevent a real actual problem caused by someone (OK me) >>> changing the TZ timezone in his personal environment. >>> >>> At all of my clients I have an environment file that mostly sets some >>> personal aliases that I have become used to using, like "dir" for "ls >>> -laF", emacs shell edit mode instead of vi mode, etc. I run this script >>> manually when I am logged into a client's servers so only I have this >>> environment. At this one site which is in US Central Time they run their >>> servers on US Eastern time for historical reasons and applications depend >>> on that timezone. A couple of years ago the timezone difference must have >>> annoyed me and I set TZ to Central Time in my environment file. Recently >> we >>> had to bounce their production engine to fix a problem (open PMR). I >>> bounced it manually using my environment. So, for several hours until we >>> realized the problem and bounced it again, taking another 5 minute >>> downtime, the server was running with the "wrong" timezone which caused >>> application problems. This is what I am trying to avoid. >>> >>> So, there is now an oninit.sh script that sets the environment exactly to >>> the desired one and calls the actual oninit with a full path >>> ($INFORMIXDIR/bin/oninit). The "informix" environment has an alias for >>> "oninit" that calls oninit.sh. The oninit.sh is placed in a bin directory >>> outside of INFORMIXDIR so it is independent of version upgrades. >>> >>> My thanks to Daniel and everyone else on this discussion thread for >> helping >>> me get to a workable solution. >>> >>> Art >>> >>> Art S. Kagel, President and Principal Consultant >>> ASK Database Management >>> www.askdbmgt.com >>> >>> Blog: http://informix-myview.blogspot.com/ >>> >>> Disclaimer: Please keep in mind that my own opinions are my own opinions >>> and do not reflect on the IIUG, nor any other organization with which I >> am >>> associated either explicitly, implicitly, or by inference. Neither do >> >> >> ************************************************************ >> ******************* >> Forum Note: Use "Reply" to post a response in the discussion forum. >> >> > > > ******************************************************************************* > Forum Note: Use "Reply" to post a response in the discussion forum.

↪ replying to Paul Watson

Art Kagel — Fri, 11 Aug 2017 13:21:06 — source: IIUG Forums & Mailing Lists

Agreed, but at least we'll have to work at screwing up now. Art Art S. Kagel, President and Principal Consultant ASK Database Management www.askdbmgt.com Blog: http://informix-myview.blogspot.com/ Disclaimer: Please keep in mind that my own opinions are my own opinions and do not reflect on the IIUG, nor any other organization with which I am associated either explicitly, implicitly, or by inference. Neither do those opinions reflect those of other individuals affiliated with any entity with which I am affiliated nor those of the entities themselves. On Fri, Aug 11, 2017 at 7:53 AM, Paul Watson <paul@oninit.com> wrote: > Nothing can prevent the wrong env if the DBA wants it wrong :-) > > Paul Watson > Oninit www.oninit.com > +1 913 387 7529 > > OninitÂ® is a Registered Trademark of Oninit LLC > > > On Aug 11, 2017, at 07:30, Art Kagel <art.kagel@gmail.com> wrote: > > > > Paul: > > > > Yes, but that doesn't prevent a DBA from running oninit directly and > > bypassing the startup script. "The problem with making things foolproof > is > > that fools are so devious!" Including this old fool. > > > > Art > > > > Art S. Kagel, President and Principal Consultant > > ASK Database Management > > www.askdbmgt.com > > > > Blog: http://informix-myview.blogspot.com/ > > > > Disclaimer: Please keep in mind that my own opinions are my own opinions > > and do not reflect on the IIUG, nor any other organization with which I > am > > associated either explicitly, implicitly, or by inference. Neither do > > those opinions reflect those of other individuals affiliated with any > > entity with which I am affiliated nor those of the entities themselves. > > > >> On Fri, Aug 11, 2017 at 7:02 AM, Paul Watson <paul@oninit.com> wrote: > >> > >> In the case of TZ could you not just have a startup task that could test > >> for > >> the correct env and then go from there ? > >> > >> Cheers > >> Paul > >> > >> Paul Watson > >> Oninit www.oninit.com > >> +1 913 387 7529 > >> > >> OninitÂ® is a Registered Trademark of Oninit LLC > >> > >>> On Aug 11, 2017, at 06:31, Art Kagel <art.kagel@gmail.com> wrote: > >>> > >>> Fernando: > >>> > >>> Indeed the DBA could change something personal that can affect the > >> engine. > >>> I'm trying to prevent a real actual problem caused by someone (OK me) > >>> changing the TZ timezone in his personal environment. > >>> > >>> At all of my clients I have an environment file that mostly sets some > >>> personal aliases that I have become used to using, like "dir" for "ls > >>> -laF", emacs shell edit mode instead of vi mode, etc. I run this script > >>> manually when I am logged into a client's servers so only I have this > >>> environment. At this one site which is in US Central Time they run > their > >>> servers on US Eastern time for historical reasons and applications > depend > >>> on that timezone. A couple of years ago the timezone difference must > have > >>> annoyed me and I set TZ to Central Time in my environment file. > Recently > >> we > >>> had to bounce their production engine to fix a problem (open PMR). I > >>> bounced it manually using my environment. So, for several hours until > we > >>> realized the problem and bounced it again, taking another 5 minute > >>> downtime, the server was running with the "wrong" timezone which caused > >>> application problems. This is what I am trying to avoid. > >>> > >>> So, there is now an oninit.sh script that sets the environment exactly > to > >>> the desired one and calls the actual oninit with a full path > >>> ($INFORMIXDIR/bin/oninit). The "informix" environment has an alias for > >>> "oninit" that calls oninit.sh. The oninit.sh is placed in a bin > directory > >>> outside of INFORMIXDIR so it is independent of version upgrades. > >>> > >>> My thanks to Daniel and everyone else on this discussion thread for > >> helping > >>> me get to a workable solution. > >>> > >>> Art > >>> > >>> Art S. Kagel, President and Principal Consultant > >>> ASK Database Management > >>> www.askdbmgt.com > >>> > >>> Blog: http://informix-myview.blogspot.com/ > >>> > >>> Disclaimer: Please keep in mind that my own opinions are my own > opinions > >>> and do not reflect on the IIUG, nor any other organization with which I > >> am > >>> associated either explicitly, implicitly, or by inference. Neither do > >> > >> > >> ************************************************************ > >> ******************* > >> Forum Note: Use "Reply" to post a response in the discussion forum. > >> > >> > > > > > > > ************************************************************ > ******************* > > Forum Note: Use "Reply" to post a response in the discussion forum. > > > ************************************************************ > ******************* > Forum Note: Use "Reply" to post a response in the discussion forum. > >

Glossary

chunk