Re: Dynamic libraries and setuid

In article <4177cd$e438.2af@www.qed.com>, Paul Mailman <pamailman@qed.com> writes >The latest release of Informix that we received (Informix 7.2, SE, Unix >(Unisys OS 1.4)) reorganized the Informix libraries and for the first time >required the use of the environment variable LD_LIBRARY_PATH to specify at run >time the path that the dynamic loader uses to locate Informix's shared >libraries. > >After rebuilding under Informix 7.2, several of our ESQL programs can no >longer execute. The dynamic loader reports being unable to find an Informix >library. > >It appears that the problem is those programs that run "setuid", i.e. when >executing they assume the identify of the owner of the program instead of the >person executing the program. Our Unix documentation reveals that for >security reasons if a program runs setuid, the LD_LIBRARY_PATH environment >variable is ignored except for "trusted" directories, of which there is only >one, /usr/lib. > >This makes sense from a security standpoint, but what it means, then is that >the default Informix method of linking with shared libraries and using >LD_LIBRARY PATH is no good for setuid programs. > >I am eager to hear from other ESQL programmers who have faced this problem >and how you may have solved it. > >I can see several solutions, all with drawbacks: > > - Use archives instead of shared libraries. Disadvantages: larger >executables, possible need to relink for Informix upgrades/fixes, > > - Move Informix shared libraries into /usr/lib. Disadvantages: Messes with >Informix installation files, makes it dangerous or perhaps impossible to have >more than one version of Informix installed on the same machine (which is >important on our development machine when coming up on a new version, and on >our customer machines to minimize downtime when upgrading). > Informix 4GL release notes say this is required on some platforms which only allow use of shared libs in /usr/lib. You should copy them to /usr/lib. Note: the name of the shared libaries now includes the version number E.g. i...602.so hence several versions of Informix should not be a problem. As far as I am concerned the OS is broken if you cannot specify additional directories for 'trusted' shared libs. There should be a file which is owner by root and mode rw-r-r which defines additional directories E.g. call it /etc/sharedlibs.conf Perhaps ask Unisys to include this in the next release of the OS... > - Use environment variable LD_RUN_PATH when linking, to "hard code" the >dynamic library search path into the executable. Disadvantage: need to relink >programs if Informix changes its directory structure yet again. (Despite its >drawbacks, this is my current preference.) > >Does anyone have any other ideas? Surely we're not the first to have faced >this. > >I'd appreciate replies or cc's by Email since our darling ISP, PSI, is >occasionally up to two days behind on our news feed. :-( > -- David Williams