Re: dbaccess Permissions

ckipp@vth1.vth.colostate.edu (Cathy Kipp) wrote: >Folks, > >I know it is not generally considered a good idea to change Unix file >permissions on Informix files, but I do have a problem I think this change >would help me with anyway, or maybe you all have a better solution. > >Problem: User A has been granted a wide variety of permissions to Informix > tables and databases because the user runs applications which > require these permissions. However, if User A were to become a > more advanced user, he/she could easily execute dbaccess from the > Unix command line and create all sorts of havoc by inserting, > updating, and deleting data which I really don't want them touching > except through an application program. (This is becoming as issue > since users now have access to Unix where before they were confined > to menus.) > >Potential Solutions: > >1) Change dbaccess permissions from: -rwxr-xr-x informix informix > to: -rwxr-x--- informix infmx_user > > where the group infmx_user includes only the half dozen people who have > any business executing this program. At the moment this is my preferred > solution. Are there any problems with this scenario I am missing? > We are using a slight variation of solution 1. Only user informix and group informix have execute access. All other users (which is everyone but informix) use an utility developed in-house to read from the database. This utility accepts the SQL statements (from a file or interactively), parses these statements to ensure that only retrieval verbs are being used and runs a C executable (uid bit set to informix) that runs dbaccess against these statements. Raj