Re: Q: start ontape -c as non-dba
JoSchneidr wrote:
>
> Hy out there,
>
> my question in detail is :
>
> In our company we have a group of people who are responsible for
> the productivity-process of our applications, which means that they check
> that the database is online, the programs are running etc.
> The real dba's don't want them to have access to the shell and login as
> a informix dba, but everything I tried to prevent it failed.
>
> Here's what i tried:
> 1) chmod 6775 ontape
> didn't work, because the message "must be dba ..." comes up. I thought
> ontape would run under the file-owner id "informix" which has dba privileges !?
> 2) login through a script using expect
> didn't work because after the command "su informix" another subshell is
> started, which is not controlled by the script anymore
>
> I know that there is a possibility to administer special informix users with
> some privileges (f.e. start ontape), but I would prefer solution 1).
>
> Any ideas ???
>
> Thanks in advance
Here is a example of a C-Code that does the job for ontape -s -L 0:
/* program example
should do: execute ontape NOT as user "informix" or "root"
solution : this little program should have the following rights:
rwsr-x--- root operator
each member of group "operator" can execute ontape
*/
#include
#include
#include
#include
main()
{
char par[10][10];
char *p_par[10];
p_par[0] = par[0];
p_par[1] = par[1];
p_par[2] = par[2];
p_par[3] = par[3];
p_par[4] = (char *)0;
strcpy(par[0],"ontape");
strcpy(par[1],"-s");
strcpy(par[2],"-L");
strcpy(par[3],"0");
printf("%s %s %s %s\\n",par[0],par[1],par[2],par[3]);
setuid(500);
/* 500 means gid (groupid) of "informix" */
execv("/informix/software/V7.1/bin/ontape",p_par);
/*
or (less complicated):
execl("/informix/software/V7.1/bin/ontape","ontape","-s","-L",(char
*)0);
*/
}
HTH
Bye
Tini Lang
SNI Munich