How to run onbar as non-Informix user?
I am wondering how one can run onbar as a non-informix user. Onbar somehow checks to see if the user is the Informix or Root user and simply making the onbar files world executable does not cut it. I also tried setting the sticky bit but it did not work either.
I found a program written by Mark Collins to allow others to execute the ontape command in the same manner as I want to execute the onbar command. I modified it to use onbar instead but unfortunately it does not working for me. The program uses setuid and execv functions to spawn the onbar process as the informix user. When I run ps -ef, this is true, but onbar does not want to run properly.
When I run onbar as the informix user (or the program I modified), things work:
informix@ck230[~informix]% >./su_onbar -b -F
Onbar PID: 10014
Onbar Return code: 0
or
informix@ck230[~informix]% >onbar -b -F
Onbar PID: 10014
Onbar Return code: 0
But when I run it as a different user, I get:
> ./su_onbar -b -F
Onbar PID: 10036
Onbar Return code: 154
When I check ps -ef while running this, it spawns as the informix user:
informix 10036 10035 0 15:24:42 pts/27 0:00 /opt/resolve/thirdparty/informix/bin/onbar_d -b -F
resadm 10034 25531 0 15:24:42 pts/28 0:00 grep onbar
informix 10035 22830 0 15:24:42 pts/27 0:00 /bin/sh /opt/resolve/thirdparty/informix/bin/onbar -b -F
informix 10036 10035 1 15:24:42 pts/27 0:00 /opt/resolve/thirdparty/informix/bin/onbar_d -b -F
resadm 10038 25531 0 15:24:42 pts/28 0:00 grep onbar
informix 10035 22830 0 15:24:42 pts/27 0:00 /bin/sh /opt/resolve/thirdparty/informix/bin/onbar -b -F
informix 10036 10035 1 15:24:42 pts/27 0:00 /opt/resolve/thirdparty/informix/bin/onbar_d -b -F
resadm 10040 25531 0 15:24:43 pts/28 0:00 grep onbar
informix 10035 22830 0 15:24:42 pts/27 0:00 /bin/sh /opt/resolve/thirdparty/informix/bin/onbar -b -F
informix 10036 10035 2 15:24:42 pts/27 0:00 /opt/resolve/thirdparty/informix/bin/onbar_d -b -F
resadm 10042 25531 0 15:24:43 pts/28 0:00 grep onbar
informix 10035 22830 0 15:24:42 pts/27 0:00 /bin/sh /opt/resolve/thirdparty/informix/bin/onbar -b -F
So, what gives? Anyone know what I could do to make onbar work when called by a non-informix user? Below is the program source and the permission listings for tthe files involved. Oh, I'm using Informix 7.3 and SunOS Release 5.5.1 Version Generic_103640-08 [UNIX(R) System V Release 4.0].
-rwsr-xr-x 1 informix informix 11772 Sep 17 14:09 su_onbar
-rwxr-xr-x 1 informix informix 2181 Sep 17 14:18 /opt/resolve/thirdparty/informix/bin/onbar
-rwsr-sr-x 1 informix informix 2040380 Apr 17 08:21 /opt/resolve/thirdparty/informix/bin/onbar_d
/****************************************************************
* *
* This code has been altered by Andrew Gajewski at CrossKeys *
* Systems Corporation to run the onbar -b -F utility as the *
* resadm user. This is the only command, with these options *
* that is allowed to be executed *
* *
* I have not changed any of the existing code or comments, *
* only enough to execute and reflect onbar -b -F. We have to *
* use setuid() and not setresuid(). *
* *
****************************************************************/
/*-----------------------------------------------------------------------------
Module: su_ontape.c
Author: mark collins
Date: 07/17/96
Comments:
This program allows anyone with execute authority to run the Informix
"ontape" utility. Normally, this utility must be run by either "root"
or "informix" user. The program constructs a full path reference to
the "ontape" executable. It then searches the user database (/etc/passwd)
to find the entry for user "informix" and switches to that user.
Finally, it performs execv() to perform the "ontape" command. It
passes any command line arguments to ontape.
For this to work, the executable of this program must be owned by
user "informix" and permissions must be set to allow set-user
(e.g., -rwsrwxrwx).
For those systems which do not support the setresuid() call, modify
main() to use the older setuid() call instead. For details, see
your man pages.
With only a few changes in create_command_line() and check_args(),
this program can be used to invoke onmode, oncheck, oninit, or many
non-Informix utilities.
Contents:
main()
check_args()
check_env_vars()
create_command_line()
print_error()
Warnings:
This program has only been tested on Informix 7.10 running on HP-UX 9.04.
No other platforms have been tested. No support is provided for any
platforms.
Each installation will need to evaluate the list of allowed options in
check_args() for suitability to their own situation.
---------------------------------------------------------------------------- */
#include <stdio.h>
#include <errno.h>
#include <pwd.h>
#include <grp.h>
#include <unistd.h>
#include <varargs.h>
#include <string.h>
#include <stdlib.h>
/* required for setuid() */
#include <sys/types.h>
extern char **environ;
/*-----------------------------------------------------------------------------
function prototypes
(I know, I know. These should be in a "*.h" file. Sue me.)
---------------------------------------------------------------------------- */
int check_args(char **argv);
int check_env_vars(void);
int create_command_line(char *cmd_line);
void print_error(char *error_msg);
/*-----------------------------------------------------------------------------
Function: main
Author: mark collins
Date: 07/17/96
Arguments: argc integer counter of arguments passed to the program,
argv a null-terminated list of pointers to character arrays
holding the arguments passed to the program
Decription:
Return Value: none. Since this program performs an execv(), the
return code is actually that from ontape.
---------------------------------------------------------------------------- */
main(int argc, char** argv)
{
char user_name[] = "informix";
char root_user_name[] = "root";
char command_line[119]="";
uid_t informix_uid;
uid_t root_uid;
uid_t current_uid;
struct passwd *password_entry;
/* */
/* Check environemt variables. If they are not set, get out */
/* now. */
/* */
if (check_env_vars ())
return 1;
/* */
/* try to create the full path to "ontape". If any errors, */
/* get out now. */
/* */
if (create_command_line (command_line))
return 1;
/* */
/* lookup user entry for "root" in /etc/passwd */
/* */
password_entry = getpwnam(root_user_name);
root_uid = password_entry->pw_uid;
/* */
/* lookup user entry for "informix" in /etc/passwd */
/* */
password_entry = getpwnam(user_name);
informix_uid = password_entry->pw_uid;
/* */
/* get uid for current us