Re: tape parameters

On Mon, 16 Oct 2000, Art S. Kagel wrote: > Ontape is SUPPOSED to run as root. ls -l $INFORMIXDIR/bin/ontape should > say: > > -rwsr-sr-x 1 root informix ..................... ontape I was told that suid to root applications should be avoided. And I think it a good idea. They are normal reasons to cracks of the system. Saludos... ;-) -- "And I'm happy, because you make me feel good, about me." - Melvin Udall ----------------------------------------------------------------- Mart'n Marqu's email: martin@math.unl.edu.ar Santa Fe - Argentina http://math.unl.edu.ar/~martin/ Administrador de sistemas en math.unl.edu.ar -----------------------------------------------------------------

"Martin A. Marques" wrote: > On Mon, 16 Oct 2000, Art S. Kagel wrote: > > Ontape is SUPPOSED to run as root. ls -l $INFORMIXDIR/bin/ontape should > > say: > > > > -rwsr-sr-x 1 root informix ..................... ontape > > I was told that suid to root applications should be avoided. And I think it a > good idea. They are normal reasons to cracks of the system. That is true, but before you remove the SUID root privileges, you need to verify whether the program will work when it is not SUID root. For ontape, I believe the answer is "no, it won't work, unless you are using it while logged in as root (or su'd to root) anyway". Similar comments apply to every one of the SUID root programs in the Informix suite -- there is a reason why the program is SUID root and removing the SUID root property will mean that the program won't work unless you're root when you run it. Generally speaking, there's only one thing worse than using SUID root programs, and that is doing everything as root. Most Informix administration should be done as user informix, and that requires the programs to be SUID root. -- Yours, Jonathan Leffler (Jonathan.Leffler@Informix.com) #include <disclaimer.h> Guardian of DBD::Informix v1.00.PC1 -- http://www.perl.com/CPAN "I don't suffer from insanity; I enjoy every minute of it!"